-
Notifications
You must be signed in to change notification settings - Fork 53
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Role/User changes in AIM should be run separately #423
Comments
Thanks for the suggestion @massenz! Right now we're assuming someone with AWS account's root access doing the provisioning and updating the infrastructure (creating the eks creator role...etc) and haven't been a priority as there isn't too much in the shared-env Yeah the separation down the road can definitely add value, @bmonkman what do you think? |
When the apply command runs the "shared" terraform it creates any users specified there, but previous to this step we sort of have to assume that the user has provisioned their own AWS user with admin access and some credentials, otherwise they won't be able to run anything. |
Thanks for getting back to me - I was only able to follow partially :) as I'm not that familiar with TF (otherwise, I'd have offered contribute it myself...). I still think the separation of the roles in a "God Mode" |
Several of the TF actions in the
infrastructure/terraform/environments/shared
folder make changes to the Roles and Policies in AIM, and require to essentially run thezero apply
with anAdmin
-level user; this is probably unnecessary for most of the other deployment actions, where a much lover permission level is required.Also, deploying resources with such a high privilege level may complicate matters when tearing them down.
It would be great if those could be separated out (
zero prepare
?) with a separate, admin-level user; also bearing in mind that they won't probably change much over the course of a project's life, so could easily be only run once.The text was updated successfully, but these errors were encountered: