BFD-3698: Address missing global EC2 permissions #2493
Draft
+154
−75
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mjburling
commented
Nov 15, 2024
Comment on lines
+1
to
+2
| resource "aws_iam_policy" "packer_s3" { | ||
| #FIXME: This policy should be reconsidered before acceptance of BFD-3698. Suggest removal. |
There was a problem hiding this comment.
bfd-mgmt-packer-s3 was moved here as part of the consolidation effort, however, it probably shouldn't exist...
mjburling
commented
Nov 15, 2024
| aws_iam_policy.packer_ssm.arn, | ||
| aws_iam_policy.packer_s3.arn, | ||
| aws_iam_policy.packer_kms.arn, | ||
| "arn:aws:iam::aws:policy/AmazonElasticFileSystemFullAccess", #FIXME: This should be reconsidered before acceptance of BFD-3698. Suggest removal. |
There was a problem hiding this comment.
This AWS Managed policy is probably a hold-over from either earlier EFT efforts and/or self-hosted Jenkins systems that relied on EFS for multi-mount capabilities between Jenkins systems and ephemeral, Packer-managed EC2 instances. This should probably be removed.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
JIRA Ticket:
BFD-3698
What Does This PR Do?
Historically, we've just ignored AMI provisioning errors and EC2 instance initialization errors. This seeks to address the consistent errors that result from insufficient IAM privileges within the primary instance profiles through the following:
packer-iam.tfwithinmgmtfor packer-specific IAM resource consolidationmgmtstate through this packer-iam.tf fileNOTE: These have since been removed from the state and must be re-imported, i.e. execution of
terraform import aws_iam_role.packer bfd-packerandterraform import aws_iam_instance_profile.packer bfd-packerbfd-mgmt-ec2-instances-tags-ropolicy to globally allow ec2:DescribeInstances and ec2:DescribeTagsWhat Should Reviewers Watch For?
TODO
What Security Implications Does This PR Have?
Please indicate if this PR does any of the following:
Adds any new software dependencies
Modifies any security controls
Adds new transmission or storage of data
Any other changes that could possibly affect security?
I have considered the above security implications as it relates to this PR. (If one or more of the above apply, it cannot be merged without the ISSO or team security engineer's (
@sb-benohe) approval.)Validation
Have you fully verified and tested these changes? Is the acceptance criteria met? Please provide reproducible testing instructions, code snippets, or screenshots as applicable.
TODO