865922 - Request for 'mozilla' IAM user with s3 read permissions on mozilla-identity-us-standard bucket

Status: RESOLVED FIXED

(Cloud Services :: Operations: Miscellaneous, task)

Description

[Gene Wood [:gene]]

Please create a 'mozilla' IAM user with the following S3 permission

Bucket : mozilla-identity-us-standard
Permissions needed : List (also known as "READ")

To share the API Key and Secret with me you're welcome to gpg it and drop it here or email

http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0xF0A9E7DCD39E452E

Thanks

Comment 1

[Gene Wood [:gene]]

Or an IAM role with the same permissions

Comment 2

[Wesley Dawson [:whd]]

As we're trying to minimize the need to distribute secret keys, I think an IAM role is probably a better choice.

Comment 3

[Gene Wood [:gene]]

IAM Role sounds good. Wes, can you create this for me?

Comment 4

[Wesley Dawson [:whd]]

Gene, do you have a name in mind for this role? We don't appear to have a naming convention for IAM roles yet, but to copy the only other role in prod I would name this one identity-readers.

One thing to note is that if you end up using specialized host IAM roles (like I see in dev), each role will need to have these permissions since a host cannot (yet?) have multiple IAM roles.

Comment 5

[Gene Wood [:gene]]

Ah, didn't realize instances could have only one IAM role. Let's go with a generic role name of "Identity" then.

Comment 6

[Wesley Dawson [:whd]]

I have created this role.

Comment 7

[Gene Wood [:gene]]

Got it workin. This is what the final policy looks like :



{
  "Statement": [
    {
      "Sid": "Stmt1367003275645",
      "Action": [
        "s3:ListBucket"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::mozilla-identity-us-standard"
      ]
    },
    {
      "Sid": "Stmt1367003286196",
      "Action": [
        "s3:GetObject"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::mozilla-identity-us-standard/*"
      ]
    }
  ]
}