📖 Allow Analytical Platform App Roles to be Assumed by Cloud Platform Roles

[julialawrence]

User Story

AP application authors want to make use of persistent storage, RDS and other services offered by Cloud Platform in their applications.

Value / Purpose

This would allow users to make more effective use of AP data, especially in applications that require post-load processing and retention of data.

Useful Contacts

Julia Lawrence

User Types

AP App Developers

Hypothesis

If we make an amendment to the app roles trust policy, this will give app owners more flexibility in assuming roles and would free us from having to provide persistent storage/service solution in AP directly. Something that is way outside our remit.

Proposal

1. Add a trust policy statement in the app role to allow it to be assumed by a Cloud Platform IAM role (which is in turn assumed by Cloud Platform service account)

Additional Information

Currently apps living in Cloud Platform use roles in analytical platform to access resources there. That is what they mean when they say that they can't use the same service account to access resources in CP and AP at the same time. We do it this way because we did not want to have to retrofit apps during the migration. New applications don't always require a similar retrofit so we should make this more flexible by allowing the roles to be assumed by a service account role instead.

Ref Feature Request: #5097

They would need to change their apps for that but it is pretty light touch.

Definition of Done

• Determine what the best way to get role information from users (supply or dictate name)
• Implement change in app role trust policy
• Update register an app form to allow IRSA (what exists already) or cross account IAM (this request)
• Code reviewed
• User notified
• Docs updated (@jacobwoffenden)

[jacobwoffenden]

Docs have been updated - https://user-guidance.analytical-platform.service.justice.gov.uk/apps/rshiny-app.html#cloud-platform-iam-role

[jacobwoffenden]

This is now in production