Add more IAM Actions based on needs for aibs-informatics-workflows. #8
Conversation
| @@ -78,6 +123,23 @@ | |||
| "ecr:UntagResource", | |||
| ] | |||
|
|
|||
|
|
|||
| KMS_READ_ACTIONS = [ | |||
There was a problem hiding this comment.
can you add constants in alphabetical order?
There was a problem hiding this comment.
I understand that not everything is ordered alphabetically, but it would be helpful if you tried to order. even better if you ordered others by alphabet and type of constant (action lists vs policy variables)
There was a problem hiding this comment.
Tried to alphabetize and reorganize the file. Let me know if that does what you were requesting.
| *KMS_READ_ACTIONS, | ||
| *KMS_WRITE_ACTIONS, | ||
| ] | ||
|
|
||
| ECR_FULL_ACCESS_ACTIONS = [*ECR_READ_ACTIONS, *ECR_WRITE_ACTIONS, *ECR_TAGGING_ACTIONS] | ||
|
|
||
| ECS_READ_ACTIONS = ["ecs:DescribeContainerInstances"] |
There was a problem hiding this comment.
This will override what you have specified above
There was a problem hiding this comment.
Ack, thanks for catching that. Perfect example of why alphabetization helps.
| @@ -78,6 +123,23 @@ | |||
| "ecr:UntagResource", | |||
| ] | |||
|
|
|||
|
|
|||
| KMS_READ_ACTIONS = [ | |||
There was a problem hiding this comment.
I understand that not everything is ordered alphabetically, but it would be helpful if you tried to order. even better if you ordered others by alphabet and type of constant (action lists vs policy variables)
Actions added below for services brought up in aibs-informatics-workflows.
I also added a docstring to make explicit that the actions are not complete read/write actions for each service, just based on the things we've needed so far.
I did this as suggested in feedback for https://github.com/AllenInstitute/aibs-informatics-workflows/pull/1, although I am slightly torn on the approach since this means that if we add actions to the read or write lists for a service, all users of that list get the added permissions even if they don't need them, but I get that's a tradeoff between convenience and absolute strictness with provided permissions.