paas-s3-broker: bump to ..., provide with common user policy, expand custom-broker-acceptance-tests #3449
Conversation
risicle
force-pushed
the
ris-s3-broker-get-object-tagging
branch
2 times, most recently
from
f65dbe7 to
d4e64af
Compare
|
I think we need some more alterations before this will work for |
risicle
force-pushed
the
ris-s3-broker-get-object-tagging
branch
from
f2bc50f to
030646b
Compare
risicle
changed the title
s3:GetObjectTagging in custom-broker-acceptance-tests
|
Ok, this now includes the "common user policy" feature from alphagov/paas-s3-broker#56 and provides that policy to the job. It also expands the custom-broker-acceptance-tests to ensure different buckets' credentials can't access each other - something that could potentially happen if the common user policy were misconfigured. |
risicle
force-pushed
the
ris-s3-broker-get-object-tagging
branch
2 times, most recently
from
09a6a24 to
8f8328f
Compare
malcgds
force-pushed
the
ris-s3-broker-get-object-tagging
branch
from
0647ac5 to
f904b55
Compare
…g privileges now we're adding an iam identity-based policy to created users (to allow them to take any s3 action in other accounts) it's important to ensure we're not accidentally giving them more privileges than they should have in *our* account, which could potentially happen if the wrong "account id" value got used for the broker's common user policy.
malcgds
force-pushed
the
ris-s3-broker-get-object-tagging
branch
from
f904b55 to
23f2fa3
Compare
There was a problem hiding this comment.
I reviewed the deployment of the broker on a dev environment with @malcgds and went really well. I also tested the sync functionality following the instructions that @malcgds wrote and managed to sync the paas s3 bucket with one I made under an experimental account. The rest of the review (code etc has been carried out by @malcgds ). Seems good to go from my end.
What
https://www.pivotaltracker.com/story/show/186090782
Roll this change out to cf, also making our custom-broker-acceptance-tests check they can successfully call
s3:GetObjectTagging. In an ideal world we would have actually set a tag on the object to more completely test this works, but then we'd need to adds3:PutObjectTaggingwhich we currently can avoid. So here we just test for the returnedTagSet's emptiness.How to review
👀 https://deployer.dev03.dev.cloudpipeline.digital/teams/main/pipelines/create-cloudfoundry/jobs/custom-acceptance-tests/builds/21 ?
🚨⚠️ Please do not merge this pull request via the GitHub UI ⚠️ 🚨