Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add policy statement for opensearch service #187

Open
wants to merge 8 commits into
base: main
Choose a base branch
from

Conversation

sebastien-rosset
Copy link
Contributor

Add policy for PR ansible-collections/community.aws#859
Not ready for review yet.

@sebastien-rosset sebastien-rosset changed the title Initial policy statement for opensearch service Add policy statement for opensearch service Jan 15, 2022
@sebastien-rosset
Copy link
Contributor Author

sebastien-rosset commented Jan 15, 2022

In which group should the opensearch policy be added? The CI is failing because it complains the aws/policy/data-services.yaml file is too big.

@alinabuzachis
Copy link
Collaborator

alinabuzachis commented Jan 19, 2022

@sebastien-rosset let's wait for @jillr's feedback.

@sebastien-rosset
Copy link
Contributor Author

@jillr , @alinabuzachis , how can I make progress with this? It's not possible to test without having the right permissions.

@alinabuzachis
Copy link
Collaborator

@jillr , @alinabuzachis , how can I make progress with this? It's not possible to test without having the right permissions.

@sebastien-rosset We need to wait for @jillr's suggestion. They generally do the triage on this repo on Thursday. I will try to ask and let you know. Thank you.

@jillr
Copy link
Collaborator

jillr commented Jan 27, 2022

As long as we can bring the policy under the character limit data-services is the closest IMO. If not, @alinabuzachis we might need to refactor the policies again. :)

Describe and List actions can be added as wildcards for any AWS services that do not affect security (ie; IAM or STS). So some of these can be condensed to es:Describe* and es:List*. es:Get* can be treated the same. They also should go under a more general Sid (Kafka is a bad example in this policy), like AllowGlobalUnrestrictedResourceActionsWhichIncurNoFees. CreateDomain, UpdateDomainConfig, and anything else which can affect the pricing used for opensearch should be under a AllowGlobalRestrictedResourceActionsWhichIncurFees Sid and limited to a domain* resource. The actual policy actions included here lgtm - thanks @sebastien-rosset!

@jillr
Copy link
Collaborator

jillr commented Jan 28, 2022

Since this is the first time we're enabling opensearch, we will also need a class added to the terminator: https://github.com/mattclay/aws-terminator/blob/master/aws/terminator/data_services.py
This is a lamnda that we run to automatically check for and clean-up allowed resources after they exceed an age limit (defaults to 20 minutes) in case the CI job fails to delete a resource for some reason.

@sebastien-rosset sebastien-rosset marked this pull request as ready for review January 28, 2022 22:42
@sebastien-rosset
Copy link
Contributor Author

@jillr , is this what you were looking for?

@gravesm
Copy link
Collaborator

gravesm commented Feb 21, 2022

I posted on the associated PR, but just to add here, I don't think we should merge these changes at this time. Our CI constraints would currently prevent us from being able to run a test suite that spans several hours.

softwarefactory-project-zuul bot pushed a commit to ansible-collections/community.aws that referenced this pull request Jun 13, 2022
Add 'opensearch' and 'opensearch_info' modules

SUMMARY


Add opensearch module to create/update AWS OpenSearch/Elasticsearch  domains.
Add opensearch_info module to query AWS OpenSearch/Elasticsearch domains.

Fixes #858
Requires mattclay/aws-terminator#187

ISSUE TYPE


New Module Pull Request

COMPONENT NAME

Creates OpenSearch or ElasticSearch domain.
ADDITIONAL INFORMATION



The minimum version of botocore for these modules is 1.21.38.
The integration tests take more than 4 hours to execute. Tests time out in the CI. I was able to run the integration tests locally.

Reviewed-by: Alina Buzachis <None>
Reviewed-by: Sebastien Rosset <None>
Reviewed-by: Mark Chappell <None>
Reviewed-by: Markus Bergholz <[email protected]>
abikouo pushed a commit to abikouo/amazon.aws that referenced this pull request Sep 18, 2023
Add 'opensearch' and 'opensearch_info' modules

SUMMARY


Add opensearch module to create/update AWS OpenSearch/Elasticsearch  domains.
Add opensearch_info module to query AWS OpenSearch/Elasticsearch domains.

Fixes ansible-collections#858
Requires mattclay/aws-terminator#187

ISSUE TYPE


New Module Pull Request

COMPONENT NAME

Creates OpenSearch or ElasticSearch domain.
ADDITIONAL INFORMATION



The minimum version of botocore for these modules is 1.21.38.
The integration tests take more than 4 hours to execute. Tests time out in the CI. I was able to run the integration tests locally.

Reviewed-by: Alina Buzachis <None>
Reviewed-by: Sebastien Rosset <None>
Reviewed-by: Mark Chappell <None>
Reviewed-by: Markus Bergholz <[email protected]>
abikouo pushed a commit to abikouo/amazon.aws that referenced this pull request Sep 18, 2023
Add 'opensearch' and 'opensearch_info' modules

SUMMARY


Add opensearch module to create/update AWS OpenSearch/Elasticsearch  domains.
Add opensearch_info module to query AWS OpenSearch/Elasticsearch domains.

Fixes ansible-collections#858
Requires mattclay/aws-terminator#187

ISSUE TYPE


New Module Pull Request

COMPONENT NAME

Creates OpenSearch or ElasticSearch domain.
ADDITIONAL INFORMATION



The minimum version of botocore for these modules is 1.21.38.
The integration tests take more than 4 hours to execute. Tests time out in the CI. I was able to run the integration tests locally.

Reviewed-by: Alina Buzachis <None>
Reviewed-by: Sebastien Rosset <None>
Reviewed-by: Mark Chappell <None>
Reviewed-by: Markus Bergholz <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants