Create the cloud-governance infra: User, Policy, Bucket #834

athiruma · 2024-09-11T06:02:04Z

Type of change

Note: Fill x in []

bug
enhancement
documentation
dependencies

Description

Create the CloudGovernance Infra:

User
Policy
Bucket
AccessKey

Created the terraform script to create the resources.

Note: Access Keys will be displayed on the terminal output, copied and shared with the user.

For security reasons, all pull requests need to be approved first before running any automated CI

ebattat · 2024-09-11T09:25:43Z

@athiruma, do u want to add how_to image ?

athiruma · 2024-09-11T09:30:11Z

@athiruma, do u want to add how_to image ?

Writing README docs

athiruma · 2024-09-11T10:09:16Z

@athiruma, do u want to add how_to image ?

Writing README docs

Done, please verify the docs

athiruma · 2024-09-12T04:53:37Z

/review @ebattat

ebattat · 2024-09-12T05:10:06Z

iam/clouds/aws/CloudGovernanceInfra/README.md

+
+```shell
+./create_infra.sh --help
+```


Do you want to add image that the explain the process ?

./create_infra.sh --username "$USERNAME" --s3-bucket-name "$BUCKET_NAME" --policy-type delete
Dont need to run
terraform destroy

ebattat · 2024-09-12T05:10:44Z

jenkins/tenant/aws/README.md

-1. Create AWS User and attach user by [CloudGovernanceDeletePolicy.json](../../../iam/clouds/aws/CloudGovernanceDeletePolicy.json). [ Note: Replace account_id with actual account id]
+
+1. Create AWS User and attach user
+   by [CloudGovernanceDeletePolicy.json](../../../iam/clouds/aws/CloudGovernanceCloudCreds/CloudGovernanceDeletePolicy.json). [ Note: Replace account_id with actual account id]


Why its different from the create infra flow ?

ebattat · 2024-09-12T05:43:33Z

iam/clouds/aws/CloudGovernanceInfra/README.md

+- Install [AWS-CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html).
+- Configure IAM Access credentials.
+    - Permissions required for the User.
+    ```json lines


Why we need to display it in the readme, and why its include delete policies ?

ebattat · 2024-09-12T11:00:21Z

jenkins/tenant/aws/README.md

-5. Add account_name to account variable in this [PolicyJenkinsfileDaily](../aws/template/PolicyJenkinsfileDaily) and [TaggingJenkinsfileHourly](../aws/template/TaggingJenkinsfileHourly).
-6. Create two Jenkins jobs by using this two Jenkinsfile
+
+1. Create IAM User with Read/Delete Permissions and create S3 bucket.


I think you need to update the readme to use terraform steps
Also pls add the tfvars file for variable

ebattat · 2024-09-12T11:51:27Z

iam/clouds/aws/CloudGovernanceInfra/README.md

+
+```shell
+./create_infra.sh --help
+```


./create_infra.sh --username "$USERNAME" --s3-bucket-name "$BUCKET_NAME" --policy-type delete
Dont need to run
terraform destroy

ebattat · 2024-09-12T11:52:08Z

iam/clouds/aws/CloudGovernanceInfra/README.md

+
+```shell
+terraform init
+terraform apply -var=IAM_USERNAME="${USERNAME}" -var=IAM_POLICY_NAME="${IAM_POLICY_NAME}" -var =S3_BUCKET_NAME="${S3_BUCKET_NAME}"


Pls put the value of
USERNAME
IAM_POLICY_NAME
S3_BUCKET_NAME

athiruma · 2024-09-13T06:34:46Z

/review @ebattat
Added the module structure

ebattat · 2024-09-13T06:44:41Z

@athiruma, pls remove all the readme file in module and have only 1 readme with working steps:

Deploy S3 bucket (once for logs)
Deploy IAM read role (dry_run==yes)
Deploy IAM delete role(dry_run==no => actions)

athiruma · 2024-09-13T06:48:14Z

@athiruma, pls remove all the readme file in module and have only 1 readme with working steps:

Deploy S3 bucket (once for logs)

Deploy IAM read role (dry_run==yes)

Deploy IAM delete role(dry_run==no => actions)

done

ebattat · 2024-09-13T12:05:54Z

iam/clouds/aws/CloudGovernanceInfra/CloudGovernanceReadPolicy.json

      ],
      "Resource": "*"
    },
    {
      "Sid": "EC2AccountLevel",
      "Effect": "Allow",
      "Action": [
+        "ec2:DeleteTags",


Do we need it in Read policy: ec2:DeleteTags

ebattat · 2024-09-13T12:06:29Z

iam/clouds/aws/CloudGovernanceInfra/CloudGovernanceReadPolicy.json

@@ -70,7 +76,8 @@
      "Action": [
        "elasticloadbalancing:DescribeTags",
        "elasticloadbalancing:AddTags",
-        "elasticloadbalancing:DescribeLoadBalancers"
+        "elasticloadbalancing:DescribeLoadBalancers",
+        "elasticloadbalancing:RemoveTags"


"elasticloadbalancing:RemoveTags" read policy ?

athiruma force-pushed the docs_create_iam branch from 87f1d0b to b893e0b Compare September 11, 2024 08:02

athiruma force-pushed the docs_create_iam branch 5 times, most recently from 869e7c2 to 94a1b57 Compare September 11, 2024 10:06

ebattat assigned athiruma Sep 11, 2024

ebattat added the documentation Improvements or additions to documentation label Sep 11, 2024

ebattat self-requested a review September 11, 2024 12:10

ebattat reviewed Sep 12, 2024

View reviewed changes

athiruma force-pushed the docs_create_iam branch 4 times, most recently from a7868c1 to 7da3b80 Compare September 12, 2024 09:59

ebattat reviewed Sep 12, 2024

View reviewed changes

athiruma force-pushed the docs_create_iam branch 2 times, most recently from e55046b to e760460 Compare September 12, 2024 11:27

ebattat reviewed Sep 12, 2024

View reviewed changes

athiruma force-pushed the docs_create_iam branch 2 times, most recently from 3064efc to 3c1fa18 Compare September 13, 2024 06:33

athiruma force-pushed the docs_create_iam branch from 3c1fa18 to 2a1a5a6 Compare September 13, 2024 06:48

athiruma force-pushed the docs_create_iam branch from 2a1a5a6 to f56b772 Compare September 13, 2024 10:43

ebattat reviewed Sep 13, 2024

View reviewed changes

athiruma force-pushed the docs_create_iam branch from f56b772 to 2ec0837 Compare September 16, 2024 09:25

Create the cloud-governance infra: User, Policy, Bucket

6b08d03

athiruma force-pushed the docs_create_iam branch from 2ec0837 to 6b08d03 Compare September 17, 2024 06:34

ebattat merged commit 4990578 into redhat-performance:main Sep 17, 2024
6 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Create the cloud-governance infra: User, Policy, Bucket #834

Create the cloud-governance infra: User, Policy, Bucket #834

athiruma commented Sep 11, 2024 •

edited

Loading

ebattat commented Sep 11, 2024

athiruma commented Sep 11, 2024

athiruma commented Sep 11, 2024

athiruma commented Sep 12, 2024

ebattat Sep 12, 2024

ebattat Sep 12, 2024

ebattat Sep 12, 2024

ebattat Sep 12, 2024

ebattat Sep 12, 2024

ebattat Sep 12, 2024

ebattat Sep 12, 2024

athiruma commented Sep 13, 2024

ebattat commented Sep 13, 2024

athiruma commented Sep 13, 2024

ebattat Sep 13, 2024

ebattat Sep 13, 2024

Create the cloud-governance infra: User, Policy, Bucket #834

Create the cloud-governance infra: User, Policy, Bucket #834

Conversation

athiruma commented Sep 11, 2024 • edited Loading

Type of change

Description

For security reasons, all pull requests need to be approved first before running any automated CI

ebattat commented Sep 11, 2024

athiruma commented Sep 11, 2024

athiruma commented Sep 11, 2024

athiruma commented Sep 12, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

athiruma commented Sep 13, 2024

ebattat commented Sep 13, 2024

athiruma commented Sep 13, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

athiruma commented Sep 11, 2024 •

edited

Loading