Closed dvoet closed 1 month ago
@dvoet this looks good! Have you confirmed that a user with Owner role on a workspace and no special access to runtimes under it can successfully delete any runtime? I'm not sure how access to the Delete action propagates.
Attention: Patch coverage is 66.66667%
with 1 line
in your changes missing coverage. Please review.
Project coverage is 73.92%. Comparing base (
80bdc97
) to head (400e49e
).
@dvoet this looks good! Have you confirmed that a user with Owner role on a workspace and no special access to runtimes under it can successfully delete any runtime? I'm not sure how access to the Delete action propagates.
Bummer, owners do not. I drilled into what the actual resource type is (the naming in Leo hides it) and it is controlled-application-private-workspace-resource
. Only Leo has delete action on those. I am going to switch to checking delete on the workspace itself.
Conceptually I don't like checking the delete-workspace action as a proxy for delete-workspace-resource. I don't think it's much of an improvement on just checking for Owner role.
in my opinion, switching to an action check, even it if is not quite right, is vastly superior to a role check. Roles were never meant to gate access to features.
in my opinion, switching to an action check, even it if is not quite right, is vastly superior to a role check. Roles were never meant to gate access to features.
That makes sense to me. Could you add a comment to the code indicating that a check on the runtime Delete action would be preferred but that it would require implementing a Sam hierarchy from Workspace to Runtimes?
Could you add a comment to the code indicating that a check on the runtime Delete action would be preferred but that it would require implementing a Sam hierarchy from Workspace to Runtimes?
@mlilynolting I will cover this in my doc, but hierarchy is only part of the answer. Right now, there is no sam resource that exists that Leo can check to see if the caller should be able to delete the requested runtime. The right resource needs to exist and hierarchy can be used to make the correct permissions flow.
That's a good point.
Jira ticket: https://broadworkbench.atlassian.net/browse/IA-5025
Summary of changes
allow users with workspace delete action instead of workspace owner role to delete runtimes
Why
requiring owner role requires granting too much access to the rawls SA which needs to perform workspace delete
Testing these changes
What to test
Who tested and where
jenkins retest
orjenkins multi-test
.