Add support for AWS config resources - terminator and hacking policy #133
Conversation
There was a problem hiding this comment.
I'm getting failures with this PR; running python3 cleanup.py --target ConfigAggregator --target ConfigRecorder --target ConfigDeliveryChannel --target ConfigRule --stage dev -vvv -c
We're missing the various describe permissions in CI
arn:aws:sts::966509639900:assumed-role/ansible-core-ci-test-dev/cleanup is not authorized to perform: config:DescribeConfigurationAggregators"}
User: arn:aws:sts::966509639900:assumed-role/ansible-core-ci-test-dev/cleanup is not authorized to perform: config:DescribeConfigurationRecorders"}
arn:aws:sts::966509639900:assumed-role/ansible-core-ci-test-dev/cleanup is not authorized to perform: config:DescribeConfigRules"}
We're presumably need the accompanying Remove actions
There was a problem hiding this comment.
Partial review; we also need iam:PutRolePolicy and maybe iam:ListRolePolicies. I think these are fine? I need to read more IAM docs. There may be other things needed, I was not able to get the aws_config test passing and have not fully tested the new classes.
"msg": "An error occurred (AccessDenied) when calling the PutRolePolicy operation: User: arn:aws:sts::966509639900:assumed-role/ansible-core-ci-test-dev/dev=remote=jillr is not authorized to perform: iam:PutRolePolicy on resource: role ansible-test-ansible-test-59275417-lab",
| @@ -127,6 +127,12 @@ Statement: | |||
| - Sid: AllowGlobalUnrestrictedResourceActionsWhichIncurNoFees | |||
| Effect: Allow | |||
| Action: | |||
| - config:DeleteConfigRule | |||
| - config:DeleteConfigurationRecorder | |||
| - config:DeleteDeliveryChannel | |||
There was a problem hiding this comment.
| - config:DeleteDeliveryChannel | |
| - config:DeleteDeliveryChannel | |
| - config:DescribeAggregationAuthorizations | |
| - config:DescribeConfigurationAggregators |
I find terminator helpful for cleaning up my 'local' test account, however only adding to the hacking policy because AWS only supports a single recorder per account per region.