-
Notifications
You must be signed in to change notification settings - Fork 156
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[doc] Add docs of required IAM actions for Piped #4925
Conversation
Signed-off-by: t-kikuc <tkikuchi07f@gmail.com>
Signed-off-by: t-kikuc <tkikuchi07f@gmail.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@t-kikuc Thank you for the improvement. I left some comments.
- `ecs:CreateService` | ||
- `ecs:CreateTaskSet` | ||
- `ecs:DeleteTaskSet` | ||
- `ecs:DeregisterTaskDefinition` | ||
- `ecs:DescribeServices` | ||
- `ecs:DescribeTaskSets` | ||
- `ecs:RegisterTaskDefinition` | ||
- `ecs:RunTask` | ||
- `ecs:TagResource` | ||
- `ecs:UpdateService` | ||
- `ecs:UpdateServicePrimaryTaskSet` | ||
|
||
- `elasticloadbalancing:DescribeListeners` | ||
- `elasticloadbalancing:DescribeRules` | ||
- `elasticloadbalancing:DescribeTargetGroups` | ||
- `elasticloadbalancing:ModifyListener` | ||
- `elasticloadbalancing:ModifyRule` |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[ask] I am not familiar with AWS IAM, so I have a question. Is the IAM in AWS based on the API call? I'm concerned about whether other required permission exists. 👀
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks, I forgot to list permissions that are required along with ECS/ELB/Lambda APIs.
I'll add them
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@ffjlabo
I fixed and added the following action.
{
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"arn:aws:iam::<account-id>:role/<task-execution-role>",
"arn:aws:iam::<account-id>:role/<task-role>"
]
}
@@ -0,0 +1,47 @@ | |||
--- |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[imo] How about moving to the installation section? It might be nice for users to know the requirements when installing.
https://pipecd.dev/docs-v0.47.x/installation/install-piped/
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sounds great, thank you!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
i fixed
Signed-off-by: t-kikuc <tkikuchi07f@gmail.com>
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #4925 +/- ##
==========================================
- Coverage 29.32% 29.30% -0.02%
==========================================
Files 321 321
Lines 40835 40835
==========================================
- Hits 11974 11968 -6
- Misses 27904 27910 +6
Partials 957 957 ☔ View full report in Codecov by Sentry. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice catch, thanks 👍
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🚀
What this PR does / why we need it:
as title.
Currently, it's difficult to specify which actions are necessary for deployments.
Which issue(s) this PR fixes:
Fixes #4793
Does this PR introduce a user-facing change?: N/A
How I listed
by the following commands.
List API calls -> Extract API names -> Remove duplicated