Update aws-batch.mdx External ID for Cloud#1511
Conversation
DRAFT improve external ID Signed-off-by: MichaelTansiniSeqera <michael.tansini@seqera.io>
✅ Deploy Preview for seqera-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Signed-off-by: MichaelTansiniSeqera <michael.tansini@seqera.io>
Signed-off-by: MichaelTansiniSeqera <michael.tansini@seqera.io>
Signed-off-by: MichaelTansiniSeqera <michael.tansini@seqera.io>
Signed-off-by: MichaelTansiniSeqera <michael.tansini@seqera.io>
Signed-off-by: MichaelTansiniSeqera <michael.tansini@seqera.io>
Signed-off-by: MichaelTansiniSeqera <michael.tansini@seqera.io>
Signed-off-by: MichaelTansiniSeqera <michael.tansini@seqera.io>
Signed-off-by: MichaelTansiniSeqera <michael.tansini@seqera.io>
Signed-off-by: MichaelTansiniSeqera <michael.tansini@seqera.io>
MichaelTansiniSeqera
changed the title
MichaelTansiniSeqera
requested review from
gwright99,
justinegeffen and
munishchouhan
|
Adding reviewers, specifically @munishchouhan for correctness and @gwright99 for technical clarity |
justinegeffen
added
the
3. Dev/PM/SME reviews complete
stefanoboriero
left a comment
stefanoboriero
left a comment
There was a problem hiding this comment.
We have 3 ways AWS credentials can be defined:
- With AWS user access keys
- With an AWS role and AWS user access keys to be used to assume the role (so the role is still assumed by the customer AWS user)
- With an AWS role and externalID + trust policy for the role to be assumed by Seqera jump role
This change effectively removes the documentation of option number 2, driving people who want to user an AWS role towards the externalID option: I wanted to check if this is intentional. Feels a bit off removing documentation for something that is still supported by Platform and not deprecated AFAIK
justinegeffen
added
1. Dev/PM/SME
| To create and launch pipelines, explore buckets with Data Explorer or run Studio sessions with the AWS Batch compute environment, an IAM user with specific permissions must be provided. Some permissions are mandatory for the compute environment to be created and function correctly, while others are optional and used for example to provide list of values to pick from in the Platform UI. | ||
|
|
||
| Permissions can be attached directly to an [IAM user](#iam-user-creation), or to an [IAM role](#iam-role-creation-optional) that the IAM user can assume when accessing AWS resources. | ||
| Permissions can be attached directly to an [IAM user](#iam-user-creation), or to an [IAM role](#iam-role-based-credential-creation) that the IAM user can assume when accessing AWS resources. |
There was a problem hiding this comment.
do we want clarify here which IAM user will assume the role?
There was a problem hiding this comment.
Yes - so replace 'IAM user' with Seqera Cloud?
There was a problem hiding this comment.
yes some thing like platform cloud pod identity
@stefanoboriero no we should still include this but perhaps put it within its own section to make clear it's a hybrid role - I will amend. |
6 participants
DRAFT improve external ID