CUMULUS-4416 adding sqs cross-account #4194
Conversation
| "states:SendTaskSuccess", | ||
| "states:StartExecution", | ||
| "states:StopExecution" | ||
| "states:StopExecution", |
There was a problem hiding this comment.
We should consider carefully if we want expanding the '*' resource. Generally we should be working to reduce wide-open perms as much as possible to reduce potential blast-radius.
Is there a sane way to limit scope/configure this, particularly with an eye to production?
There was a problem hiding this comment.
the problem is two fold:
#1 I would need to know the account ID in this place in order to update this permission to point at the "correct" sqs queue
#2 I would need to know the sqs queue itself. I can't point it at a queue named the same, because one queue can't point at multiple lambda functions. I need to create a new sqs queue in the daac legacy environment which ingest can be switched over to, and I need to somehow know that here
a big part of all of this is how we play well with cirrus, and this part is making me regret dealing with cirrus as it puts all of that configuration somewhere else.
| ### Changes | ||
|
|
||
| - **CUMULUS-4416** | ||
| - sqs permissions granted to "\*" instead of "\<account\>/\*" |
There was a problem hiding this comment.
Please include (either in PR or here) justification for the change
Summary: Summary of changes
Addresses CUMULUS-4416: Develop amazing new feature
Changes
PR Checklist
📝 Note:
For most pull requests, please Squash and merge to maintain a clean and readable commit history.