fedora-infrastructure

#6844 AWS prod tokens don't have appropriate access
Closed: Fixed Opened by sayanchowdhury.

Closed: Fixed
Reopen Issue

AWS production tokens needs to be updated to have the access to S3. Right now, euca-import-volume gives me the Access Denied.

hey @sayanchowdhury - I sent this in IRC as well but probably good to put here as well:

17:15:38 dustymabe | hey - patrick is looking for a list of the API calls or the IAM permissions that we need access for
17:15:45 dustymabe | can you see if you can come up with that list?

ok we need an s3 bucket created (fedora-s3-bucket-fedimg) and the following permissions for now: 

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeAvailabilityZones",
                "ec2:ImportVolume",
                "ec2:DescribeConversionTasks",
                "ec2:DescribeVolumes",
                "ec2:CreateSnapshot",
                "ec2:DescribeSnapshots",
                "ec2:RegisterImage",
                "ec2:DeleteVolume",
                "ec2:DescribeImages",
                "ec2:ModifyImageAttribute",
                "ec2:ModifySnapshotAttribute",
                "ec2:CopyImage"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::fedora-s3-bucket-fedimg/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:CreateTags"
            ],
            "Resource": [
                "arn:aws:ec2:*::snapshot/*"
            ]
        }
    ]
}

Note that these permissions are a bit more "loose" than what we want. we want to limit some of them to only operate on resources that have been tagged with a certain tag. The permissions above are so that we can get a two week atomic release out and then we'll put in the tagging/more strict permissions.

Slight modification to the policy I provided above:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeAvailabilityZones",
                "ec2:ImportVolume",
                "ec2:DescribeConversionTasks",
                "ec2:DescribeVolumes",
                "ec2:CreateSnapshot",
                "ec2:DescribeSnapshots",
                "ec2:RegisterImage",
                "ec2:DeleteVolume",
                "ec2:DescribeImages",
                "ec2:ModifyImageAttribute",
                "ec2:ModifySnapshotAttribute",
                "ec2:CopyImage"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::fedora-s3-bucket-fedimg"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::fedora-s3-bucket-fedimg/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:CreateTags"
            ],
            "Resource": [
                "arn:aws:ec2:*::snapshot/*"
            ]
        }
    ]
}
Edited by dustymabe

This is done now.

Metadata Update from @kevin:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.