Add aws iam-bentheelder.tf #5044
Conversation
k8s-ci-robot
added
the
cncf-cla: yes
k8s-ci-robot
added
size/XS
|
In response to #5043 |
k8s-ci-robot
added
size/S
|
@TerryHowe: changing LGTM is restricted to collaborators In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
| } | ||
| resource "aws_iam_user_login_profile" "bentheelder_login" { | ||
| user = aws_iam_user.bentheelder.name | ||
| password_reset_required = true |
There was a problem hiding this comment.
I will provide you with an initial password @BenTheElder
You will then be required to change it upon login.
| } | ||
| resource "aws_iam_user_policy_attachment" "bentheelder_billing" { | ||
| user = aws_iam_user.bentheelder.name | ||
| policy_arn = "arn:aws:iam::aws:policy/AWSBillingReadOnlyAccess" |
There was a problem hiding this comment.
Is there a role for S3 metrics?
There was a problem hiding this comment.
aws iam list-policies --output=table --query 'Policies[*].[Arn] | sort_by(@, &[0])' | grep -I s3
| arn:aws:iam::aws:policy/AWSBackupServiceRolePolicyForS3Restore |
| arn:aws:iam::aws:policy/AmazonS3FullAccess |
| arn:aws:iam::aws:policy/AmazonS3OutpostsFullAccess |
| arn:aws:iam::aws:policy/AmazonS3OutpostsReadOnlyAccess |
| arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess |
| arn:aws:iam::aws:policy/aws-service-role/IVSRecordToS3 |
| arn:aws:iam::aws:policy/aws-service-role/S3StorageLensServiceRolePolicy |
| arn:aws:iam::aws:policy/service-role/AmazonDMSRedshiftS3Role |
| arn:aws:iam::aws:policy/service-role/AmazonS3ObjectLambdaExecutionRolePolicy |
| arn:aws:iam::aws:policy/service-role/QuickSightAccessForS3StorageManagementAnalyticsReadOnly |
| policy_arn = "arn:aws:iam::aws:policy/AWSBillingReadOnlyAccess" | ||
| } | ||
| resource "aws_iam_user_login_profile" "bentheelder_login" { | ||
| user = aws_iam_user.bentheelder.name |
There was a problem hiding this comment.
nit: Do you mind running terraform fmt to adjust alignment here?
There was a problem hiding this comment.
we could do this as a follow up. we could also add update/verify scripts to ensure that this the terraform fmt is run automatically and shows up as a failure instead of manual inspection (as without it, things will still creep in)
|
/approve |
k8s-ci-robot
added
the
lgtm
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dims, hh, TerryHowe The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
Request / Issue
#5043
Steps for running #sig-k8s-infra terraform for AWS
Check out k8s.io/infra/aws/terraform
git checkout https://github.com/kubernetes/k8s.io/ cd k8s.io/aws/terraform/management-accountEnsure AWS cli authentication
Ensure you are using the right profile and organization
export AWS_PROFILE=hh@kubernetes aws organizations describe-organization{ "Organization": { "Id": "o-kz4vlkihvy", "Arn": "arn:aws:organizations::348685125169:organization/o-kz4vlkihvy", "FeatureSet": "ALL", "MasterAccountArn": "arn:aws:organizations::348685125169:account/o-kz4vlkihvy/348685125169", "MasterAccountId": "348685125169", "MasterAccountEmail": "kubernetes-aws-admins@lists.cncf.io", "AvailablePolicyTypes": [ { "Type": "SERVICE_CONTROL_POLICY", "Status": "ENABLED" } ] } }Appropriate Account level
This is probably too high level of an account to run this, we should choose an account focused on running terraform. I’ll run it this once, but we need a better plan.
Ensure terraform version is 1.3.9
I am noting that terraform has a newer version at 1.4.2!
Documentation available from https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html
export TF_VERSION=1.3.9 tfswitchEnsure Terraform init
terraform state S3 shared configuration
https://developer.hashicorp.com/terraform/language/settings/backends/s3#data-source-configuration
terraform init
export AWS_PROFILE=hh@kubernetes terraform initterraform state inspection
export AWS_PROFILE=hh@kubernetes terraform state listList of Current IAM Users (Not really accounts)
S3 Related Policies sorted by arn
We have other options, but I’m assuming “arn:aws:iam::aws:policy/AWSBillingReadOnlyAccess”
List of Policies sorted by arn
We have other options, but I’m assuming “arn:aws:iam::aws:policy/AWSBillingReadOnlyAccess”
Ben IAM User Terrafrom Code
Boilerplate code / Copyright is required at the top of the file.
awsiamuser ben
terraform plan
export AWS_PROFILE=hh@kubernetes terraform plan -out terraform.newplanTODO: Figure out how to get password / console access via iam + tf
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_login_profile
paste to issue or ticket (private hackmd for now)
terraform apply
With permission, I will run the following:
export AWS_PROFILE=hh@kubernetes terraform apply terraform.newplanRetrieve bentheelder inital password
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_login_profile#password
I shared this directly via slack, but also putting into the PR/Issue the steps necessary.
export AWS_PROFILE=hh@kubernetes terraform state show aws_iam_user_login_profile.bentheelder_loginFinal Steps
Visit https://console.aws.amazon.com/console/home
Select the IAM User Radio dial
Use `kubernetes-public` as the Account ID Alias
Initially, use the password provided, but reset it upon login
Try to do what it is you need to, identify missing polices from # List of Policy ARNs are here https://us-east-1.console.aws.amazon.com/iamv2/home?region=us-east-1#/policies
You can add more policies to iam-bentheelder.tf by attaching policyarn from this list: