Allow access to multiple s3 buckets from the hub

[yuvipanda]

Context

From https://2i2c.freshdesk.com/a/tickets/149,

We have some folks wanting to connect to existing buckets in other AWS accounts (s3://eis-dh-hydro).

In the past we gave groups our service account identifier (arn:aws:iam::783380859522:role/jovyan-serviceaccount) to get permissions, and if I remember correctly I had to also add permissions to the service account policy...

What is the service account identifier I should use? Can I modify the necessary config, or do I need a 2i2c engineer to modify the policy?

Proposal

No response

Updates and actions

No response

[yuvipanda]

Tried to just grant access to the role specified in

infrastructure/terraform/aws/buckets.tf

Line 46 in 5951fb6

aws_iam_role.irsa_role[each.value.hub_name].arn

but that didn't work.

[choldgraf]

Can you flesh out the issue title? It is unclear what "different" refers to...is it scratch buckets?

[yuvipanda]

@choldgraf no idea how those words went missing! Fixed

[scottyhq]

I’ll have to loop you into the emails with the NASA account admin to double check the settings on their end...

Last year we also had to add explicit permissions to the hub service account policy, see here https://github.com/snowex-hackweek/jupyterhub/blob/main/terraform/eks/s3-data-bucket.tf

Could also test with the following requester-pays bucket. I have no problem accessing this with full S3 permissions on my own AWS account, but from the snowex hub it is permission denied.

aws s3 ls --request-payer requester s3://usgs-landsat/collection02/

[scottyhq]

Just noting that aws_iam_role.irsa_role[each.value.hub_name].arn ->

infrastructure/config/clusters/uwhackweeks/snowex.values.yaml

Line 4 in 5951fb6

eks.amazonaws.com/role-arn: arn:aws:iam::740010314650:role/uwhackweeks-snowex

..rather than adding each specific bucket though it seems like all S3 list,read permissions could be default (just exclude permissions to create and delete buckets)?

[yuvipanda]

Fixed by #1488