NASA-IMPACT / admg-casei

ADMG Inventory
https://impact.earthdata.nasa.gov/casei/
Apache License 2.0
1 stars 0 forks source link

Add permission to the CASEI deployment AWS Key #661

Closed willemarcel closed 1 month ago

willemarcel commented 1 month ago

During the production deploy process, we copy the flight paths geojson files from a S3 bucket managed by Development Seed to the bucket where the production website is hosted (see code). There is a new campaign file that has more than 8 MB, and it requires additional permission to be able to copy the file (see error in the deploy github action). We had the same issue in the staging deploy bucket (this one is managed by a DevSeed AWS account), and we solved it by adding the s3:GetObjectTagging permission to the AWS key we use in the deploy.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListObjectsInBucket",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::admg-inventory-staging"
            ]
        },
        {
            "Sid": "AllObjectActions",
            "Effect": "Allow",
            "Action": [
                "s3:*Object",
                "s3:PutObjectAcl",
                "s3:GetObjectTagging"
            ],
            "Resource": [
                "arn:aws:s3:::admg-inventory-staging/*"
            ]
        }
    ]
}

cc: @smwingo

EJwalker13 commented 1 month ago

Currently interfacing with Caden to look into and resolve this issue.

willemarcel commented 1 month ago

It's now solved. The permission could be added in our bucket.