search

linz / geostore

Central storage, management and access for important geospatial datasets
MIT License
33 stars 2 forks source link

Move bespoke roles granting S3 permission (to third party) out of the stack #2354

Open Jimlinz opened 1 year ago

Jimlinz commented 1 year ago

Geostore has some bespoke roles granting s3 permission to external accounts (i.e. koordinates lds, opentopo). For example:

As best practice, we should probably separate these out from the stack. This can become unmanageable if it grows.

A suggestion is to include this in cdk runtime context (i.e. cdk.json)

The project file cdk.context.json is where the AWS CDK caches context values retrieved from your AWS account. This practice avoids unexpected changes to your deployments when, for example, a new Availability Zone is introduced. The AWS CDK does not write context data to any of the other files listed.

Should investigate if putting this in cdk.json will work (i.e. provide us with what we need).

Jimlinz commented 1 year ago

Putting these values in parameter store could also be an option https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html