Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Platform] Support instance profiles for default CMK policy #2949

Closed
daniel-yb opened this issue Nov 15, 2019 · 0 comments
Closed

[Platform] Support instance profiles for default CMK policy #2949

daniel-yb opened this issue Nov 15, 2019 · 0 comments
Assignees
@daniel-yb
Labels
area/platform Yugabyte Platform
Milestone
v2.1

Comments

@daniel-yb
Copy link
Contributor

When a CMK policy is not passed in, we are expecting the kms_config to contain IAM user credentials for creating the Yugabyte default CMK policy. We should support the case of instance profile credentials + not passing in a CMK policy such that the encryption at rest service grabs the arn of the role attached to the instance profile when creating the default CMK policy.
@daniel-yb daniel-yb self-assigned this Nov 15, 2019
@daniel-yb daniel-yb added the area/platform Yugabyte Platform label Nov 20, 2019
@daniel-yb daniel-yb added this to the v2.1 milestone Nov 20, 2019
daniel-yb added a commit that referenced this issue Nov 22, 2019
@daniel-yb
[Platform] Support instance profiles for default CMK policy #2949
f7c57c0 
Summary:
When an instance profile is being used, we should try and retrieve the arn for the role
attached to the instance profile instead of an IAM user's arn when creating a default CMK policy. This will allow users using an instance profile to not have to upload a custom CMK policy every time they want to encrypt a universe at rest using AWS KMS.

Also update the default CMK policy to use minimum-needed actions.

Test Plan:
Do not provide a custom CMK policy when encrypting a universe using AWS KMS with the KMS
config using instance profile credentials -> everything should work

Reviewers: sanketh, ram

Reviewed By: ram

Subscribers: rao, jenkins-bot, yugaware

Differential Revision: https://phabricator.dev.yugabyte.com/D7593
@snyk-bot snyk-bot mentioned this issue May 6, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@daniel-yb daniel-yb

Labels
area/platform Yugabyte Platform
Projects
None yet
Milestone
v2.1
Development

No branches or pull requests
1 participant
@daniel-yb