Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Application permission design #36

Closed
kohidave opened this issue Sep 16, 2019 · 9 comments
Closed

Application permission design #36

kohidave opened this issue Sep 16, 2019 · 9 comments
Assignees
@kohidave
Labels
type/enhancement Issues that are improvements for existing features.

Comments

@kohidave
Copy link
Contributor

kohidave commented Sep 16, 2019 •
edited by efekarakus
Loading

Right now we use the default profile for folks using the ECS CLI for project management. We want to copy the ecs-cli and have a .config file with the name of an application as the profile name so that we can have reliable experience when running project commands
@kohidave kohidave self-assigned this Oct 10, 2019
@sonofachamp
Copy link
Contributor

@kohidave What do you envision the .config file to contain and where would it live?

@efekarakus efekarakus added type/enhancement Issues that are improvements for existing features. needs investigation type/design Issues that are design proposals. and removed needs investigation type/design Issues that are design proposals. labels Jan 9, 2020
@efekarakus efekarakus changed the title Project Permission Design: Project Permission Design Jan 16, 2020
@efekarakus
Copy link
Contributor

See: https://twitter.com/__steele/status/1237196010130046978

For a user that wants to use environment variables to configure their project instead of named profiles.

@kohidave
Copy link
Contributor Author

This makes a lot of sense, especially since most federation tools end up generating temp credentials that folks copy into their terminals as env vars.

I'm not sure how to handle getting rid of the profiles completely. Since the project (where metadata is stored) and environment (where actual infra is created) could be totally different accounts/identities, I don't think there's a great way to specify exactly which set of creds belong to what.

If we can take a project profile for granted, then we can use the default credential provider chain for the env. We should still give folks the option of choosing a different profile, since that's the best way to show what accounts a customer has access to.

If we can't take the project profile for granted, we'll have to think of interesting solutions.

@efekarakus efekarakus changed the title Project Permission Design Application permission design Jun 10, 2020
@efekarakus
Copy link
Contributor

related #1104

@efekarakus
Copy link
Contributor

related #1105

@sonofachamp sonofachamp removed their assignment Jul 9, 2020
@efekarakus
Copy link
Contributor

related #1115

@efekarakus efekarakus mentioned this issue Jul 10, 2020
Closed
@efekarakus
Copy link
Contributor

related #1068

@efekarakus
Copy link
Contributor

related #1151

@efekarakus
Copy link
Contributor

We have now recommendations on application and environment credentials here (https://aws.github.io/copilot-cli/docs/credentials/).

We ended an entry in our roadmap to provide a way for platform teams and dev teams to have different permissions with the CLI.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@kohidave kohidave

Labels
type/enhancement Issues that are improvements for existing features.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@kohidave @efekarakus @sonofachamp