Skip to content

Conversation

@nhinsch
Copy link
Contributor

@nhinsch nhinsch commented Mar 30, 2021

What does this PR do?

Make two changes to the integration tests that allow us to use narrower IAM permissions for the serverless-github-actions-user:

  • Change the name of the service from python-integration-tests to integration-tests-python. This is significant because now the resources deployed during the integration tests will begin with the prefix integration-tests. The new IAM policy allows for the deletion of certain resources such as Lambdas and S3 buckets, but only if they begin with this prefix. By using the language-neutral prefix integration-tests, the same prefix can be used as we start to run integration tests in GitHub for more projects without updating the IAM policy.
  • Pass a specific role ARN to be used by all deployed Lambda functions. The new policy allows the GitHub Actions user to pass only this specific role to Lambda functions. So, the GitHub actions user cannot be used to create a Lambda with administrator permissions.

Motivation

We want to grant the GitHub Actions IAM user as few permissions as possible.

Testing Guidelines

The integration tests still run with the updated IAM role.

Types of Changes

  • Bug fix
  • New feature
  • Breaking change
  • Misc (docs, refactoring, dependency upgrade, etc.)

Check all that apply

  • This PR's description is comprehensive
  • This PR contains breaking changes that are documented in the description
  • This PR introduces new APIs or parameters that are documented and unlikely to change in the foreseeable future
  • This PR impacts documentation, and it has been updated (or a ticket has been logged)
  • This PR's changes are covered by the automated tests
  • This PR collects user input/sensitive content into Datadog
  • This PR passes the integration tests (ask a Datadog member to run the tests)

@nhinsch nhinsch requested a review from a team as a code owner March 30, 2021 23:17
@nhinsch nhinsch merged commit 104f571 into main Mar 31, 2021
@nhinsch nhinsch deleted the ngh/iam-test branch March 31, 2021 15:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants