Infrastructure/infra-docs-fpo
1
0
Fork 0
Code Issues 100 Pull requests 6 Projects Releases Packages Wiki Activity Actions

update aws acess doc for saml role mappings

Browse source 
Signed-off-by: Mark O Brien <markobri@redhat.com>
This commit is contained in:
Mark O Brien 2022-04-22 12:10:57 +01:00 • committed by mobrien
parent 24b185baab
commit 508897bc70
1 changed files with 11 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

21
modules/sysadmin_guide/pages/aws-access.adoc
View file

@ -60,20 +60,20 @@ You'll need this in the mapping below.
=== Adding a group to FAS === Adding a group to FAS
When finished, login to FAS and create a group to correspond to the new When finished, login to ipa and create a group to correspond to the new
role. Use the prefix _aws-_ to denote new AWS roles in FAS. This makes role. Use the prefix _aws-_ to denote new AWS roles in FAS. This makes
them easier to locate in a search. them easier to locate in a search.
It may be appropriate to set group ownership for _aws-_ groups to an Add the relevant sponsors as appropriate to the group. If the group allows
Infrastructure team principal, and then add others as users or sponsors. a high level of access it should be monitored to ensure it is not being
This is especially worth considering for groups that have modify (full) misused.
access to an AWS resource.
=== Adding an IAM role mapping in Ipsilon === Adding an IAM role mapping in Ipsilon
Add the new role mapping for FAS group to Role ARN in the ansible git Clone the git repo available here: https://pagure.io/fedora-infra/ipsilon-fedora
repo, under _roles/ipsilon/files/infofas.py_. Current mappings look like
this: Edit the file ipsilon/info/infofas.py add the new role mapping following
the examples below
.... ....
aws_groups = { aws_groups = {
@ -85,8 +85,9 @@ aws_groups = {
} }
.... ....
Add your mapping to the dictionary as shown. Start a new build/rollout Add your mapping to the dictionary as shown. Create a pull request against
of the ipsilon project in openshift to make the changes live. the ipsilon-fedora repo. When this is merged run the ipsilon playbook to take
in the new changes.
=== User accounts === User accounts