Split the project-leads user group into developer-group, ops-group, and project-leads group

[gjagnoor]

Overview

We need to decide and create user groups with the lowest level of permission needed (per group), and then reassign users to these new groups, so that we can be as secure as possible.

Action Items

• Document the groups and how to know what group a person needs to be assigned to (in this issue)
  • Get sign off by Ops
  • Add to Wiki
• Create a developer-group
• Create an ops-group
• Add relevant permissions to developer-group and ops-group
• Reassign groups to users. Project leads should be assigned to project-leads group. Developers to developer-group. Ops-group to ops-group.

Resources/Instructions

• AWS best practice is to give minimum permission to users (only what's needed for the task)
• This issue was brought up in 10/26/2022 ops meeting. We spoke about bringing the discussion here because the scope of this issue is large.

AWS documentation: Security best practices in IAM

Apply least-privilege permissions - When you set permissions with IAM policies, grant only the permissions required to perform a task. You do this by defining the actions that can be taken on specific resources under specific conditions, also known as least-privilege permissions. You might start with broad permissions while you explore the permissions that are required for your workload or use case. As your use case matures, you can work to reduce the permissions that you grant to work toward least privilege

[ExperimentsInHonesty]

Might be a duplicate of an existing issue

[chelseybeck]

Closing this issue as we are planning this here