fedora-infrastructure

#12931 Request: AWS Access
Closed: Fixed with Explanation by mwinters. Opened by mwinters.

Closed: Fixed with Explanation
Reopen Issue

This request has two possible scopes, and you can choose which one to proceed with:

  1. Make me the equivalent of an "AWS sysadmin-main" since I'm an AWS expert and eager to help. I've been using it professionally since 2009 and have been a Certified Solutions Architect (Professional) since 2015; I previously worked at AWS as a Sr. Solutions Architect (L6); I've been a certified CISSP since 2018; and I've consulted to Fortune 100 companies for help adopting and managing it. I'm behind the curve on the Fedora mega-Ansible and much of our datacenter stuff, but I'd love to assist Fedora Infra with all things AWS. (And let's talk about the TODO list there!) I would have suggested this months ago but I didn't realize we even had an AWS account.

  2. Much more narrowly, the Data WG has been approved to create a Date Lakehouse POC using S3 Tables. We have several ways we could go with this:

    • 2a: You create an AWS Account within the Organization for Data WG. You create an SCP policy enabling only S3 / S3 Tables and DynamoDB. You add me as an admin to this account. Our "prod" and "staging" will live in the same account. I will create our stuff using terraform checked into ForgeJo, presuming we do not have a central CI/CD platform deploying our AWS infra. (If you choose the broader scope #1 then I'd be happy to assign myself a separate ticket to create all of these things for Data WG.)
    • 2b: You create the Account / SCP. You grant me access to whatever CI/CD system you're using for infra deployment. You grant me read-only access to the AWS API (e.g. the console).
    • 2c: Some hybrid of these three options / some alternative I'm unaware of. HMU!

Screenshot_From_2025-11-22_15-48-59.png

URL for the above: https://cp.certmetrics.com/amazon/en/public/verify/credential/N0DDP0WLFE11QLG1

I do not like either of those options. ;) But let me give you some more background...

Amazon provides us with a community account. They pick up the tab for it, which is awsome! Thank you amazon.

However, we cannot create subaccounts in it. I sure wish we could, it would make so many things so much easier, but we cannot. It's already a subaccount of the amazon community account.

Our account is currently used by: infra, centos, fedora-ci, openqa, logdetective, coreos, cloud, abrt and some more...

So, what we have done is that we setup these groups with a aws role (assigned by membership in a fas group), and then we have IAM rules that restrict roles to only managing resources that are tagged with their FedoraGroup. So, if I login with say the infra role, I cannot mess up, or even see resources tagged by other groups. Unfortunately this means we need to make those IAM rules based on what the group needs to do. This is explained somewhat in https://docs.fedoraproject.org/en-US/infra/sysadmin_guide/aws-access/

So, My prefrence would be:

  1. We create a commops role/group, add you to it and then make a IAM policy so you can spin up/manage the things you need to for this work. Do you know what things you might need to use? We have some older copies of some policies under https://pagure.io/fedora-infra/ansible/blob/main/f/files/aws/iam/policies if you want to look at constructing one for this?

Note that I am out on PTO all next week. Other folks in the aws-master group should be able to help with this their time permitting, or I can when I get back.

Metadata Update from @phsmoura:
- Issue priority set to: Waiting on Assignee (was: Needs Review)
- Issue tagged with: low-gain, low-trouble, ops

Copy that. It's never easy, is it? :) FYI I've made a docs PR to the AWS SOP to add the above info.

For Option 1 (my personal access), let's chat in Matrix about whether & how I might contribute to the AWS side of the house given the state of the world.

For Option 2 (the lakehouse POC), I'll close this ticket and go create the POC in my own AWS account with Terraform, based on your FYIs above. Then I'll open a new ticket when it's ready for review.

Metadata Update from @mwinters:
- Issue close_status updated to: Fixed with Explanation
- Issue status updated to: Closed (was: Open)

Sorry for the delay here. I was out all last week and I have been really slammed. ;(

Thanks for the docs pr!

And thanks for helping out on various aws tickets/discussions!

ok on the POC, but I don't think it's right for you to pay out of pocket a bunch for this. If it turns out it cannot be done cheaply, please do let us know and we can try and do something.

I still think it makes sense to make a commops role for these things. The tricky part will be the IAM rules, but probibly you could write those up faster than at least I could.
Metadata
None

low-gain low-trouble ops

None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.