1325657 - pulse_actions - Remove powerful scopes once treeherder handles tc creds

Status: RESOLVED WONTFIX

(Testing :: General, defect)

Comment 1

[Armen [:armenzg]]

Excited to see this filed! Thanks bstack

Comment 2

[Ed Morley [:emorley]]

Moving to Testing::General, since that's where I see most of the other pulse_actions bugs are (since this doesn't involve changes to treeherder directly). I have permissions to create Bugzilla components, if you wanted one added for pulse_actions? :-)

Comment 3

[Brian Stack [:bstack]]

This bug was created because we initially had to give pulse_actions ["queue:route:tc-treeherder.v2.*" "queue:route:tc-treeherder-stage.v2.*"] in order to backfill. I went today to remove those scopes since all of this happens from inside treeherder ui now, but pulse_actions now has the scopes:

    assume:repo:hg.mozilla.org/*
    auth:aws-s3:read-write:tc-gp-public-31d/ateam/pulse-action-dev/*
    queue:create-task:*
    queue:define-task:*
    scheduler:create-task-graph
    scheduler:extend-task-graph

(link: https://tools.taskcluster.net/auth/clients/#project%252fateam%252fpulse_actions)

This is far greater than we added for the backfilling tasks and I'm not sure how to proceed in rolling back these permissions from the perspective of this bug. I assume these scopes were needed for some other thing that pulse_actions does. Unfortunately, we don't know when these were changed or who changed them.

Comment 4

[Armen [:armenzg]]

Shutting pulse_actions off (see bug 1379172).