There are several settings for SSM such as KMS encryption and sending logs to cloudwatch that we want to manage centrally.
A user of the platform tried to amend these to improve the security and logging for SSM, but found they did not have the required permissions, but this has highlighted this to us as something we a) need to improve, and b) want to manage centrally to ensure standards are followed and consistent across the platform.
Value
This ensures that security settings or logs for SSM cannot be disabled by application teams and settings are consistent across the platform.
Questions / Assumptions
Review the SSM settings and decide on platform appropriate values to manage them centrally. Also then properly lock down the ability to change these for end users. (All of these are open for the MemberInfrastructureAccess role to amend, it was only a missing kms key role for the developer connecting via SSM that prevented the changes)
User Story
There are several settings for SSM such as KMS encryption and sending logs to cloudwatch that we want to manage centrally. A user of the platform tried to amend these to improve the security and logging for SSM, but found they did not have the required permissions, but this has highlighted this to us as something we a) need to improve, and b) want to manage centrally to ensure standards are followed and consistent across the platform.
Value
This ensures that security settings or logs for SSM cannot be disabled by application teams and settings are consistent across the platform.
Questions / Assumptions
Review the SSM settings and decide on platform appropriate values to manage them centrally. Also then properly lock down the ability to change these for end users. (All of these are open for the MemberInfrastructureAccess role to amend, it was only a missing kms key role for the developer connecting via SSM that prevented the changes)
See example of what the user wanted to do here - https://github.com/ministryofjustice/modernisation-platform-environments/pull/212/files
Definition of done
Reference
How to write good user stories