Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Scope down promote_release IAM role S3 permissions #279

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

dangardner
Copy link

Based on my limited understanding of the promote_release role, it only needs to read and delete objects from the artifacts bucket and doesn't need to write anything there. This change removes s3:PutObject and s3:PutObjectAcl permissions on the artifacts bucket from the promote_release role. I have tested with terraform validate (with some local mods to, e.g. bucket names) but I am not able to validate this any further. Any feedback would be welcome.

Action = [
"s3:GetObjectAcl",
"s3:GetObject",
"s3:DeleteObject",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hm, I actually am not sure we need delete permissions on the CI artifacts bucket -- I think we should only read from that bucket. Are you aware of some deletion in our scripts?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants