From 9b28857ce5476bde9b8cdac93b166db722d67c08 Mon Sep 17 00:00:00 2001 From: Michael Winters Date: Dec 06 2025 19:12:26 +0000 Subject: [PATCH 1/2] Add / clarify AWS account overview Signed-off-by: Michael Winters --- diff --git a/modules/sysadmin_guide/pages/aws-access.adoc b/modules/sysadmin_guide/pages/aws-access.adoc index 324c64c..480e4d4 100644 --- a/modules/sysadmin_guide/pages/aws-access.adoc +++ b/modules/sysadmin_guide/pages/aws-access.adoc @@ -1,10 +1,5 @@ = Amazon Web Services Access -AWS includes a highly granular set of access policies, which can be -combined into roles and groups. Ipsilon is used to translate between IAM -policy groupings and groups in the Fedora Account System (FAS). Tags and -namespaces are used to keep roles resources seperate. - == Contact Information Owner:: @@ -20,6 +15,21 @@ Servers:: Purpose:: Provide AWS resource access to contributors via FAS group membership. +== Overview + +Amazon provides us with a community account. They pick up the tab for it, which is AWSome! Thank you +Amazon! + +This account is currently used by: Fedora Infra, Centos, Fedora-CI, openQA, logdetective, CoreOS, +Cloud, ABRT and some more. Since our account is a subaccount of the Amazon community account, we +cannot use AWS Organizations features such as tagging policies and SCPs to provide segregation. + +For user access, each of these groups has an AWS Role (assigned by membership in a FAS group), with +an attached IAM policy. The policy restricts access to only the AWS services needed and to resources +tagged with each group's `FedoraGroup` tag. + +Ipsilon stores the relationshipbetween IAM Roles and FAS groups. + == Accessing the AWS Console To access the AWS Console via Ipsilon authentication, use From 05736500f80b44de46d547192addc5a86f7dfce0 Mon Sep 17 00:00:00 2001 From: Michael Winters Date: Dec 06 2025 19:12:26 +0000 Subject: [PATCH 2/2] tpyo Signed-off-by: Michael Winters --- diff --git a/modules/sysadmin_guide/pages/aws-access.adoc b/modules/sysadmin_guide/pages/aws-access.adoc index 480e4d4..400a42c 100644 --- a/modules/sysadmin_guide/pages/aws-access.adoc +++ b/modules/sysadmin_guide/pages/aws-access.adoc @@ -28,7 +28,7 @@ For user access, each of these groups has an AWS Role (assigned by membership in an attached IAM policy. The policy restricts access to only the AWS services needed and to resources tagged with each group's `FedoraGroup` tag. -Ipsilon stores the relationshipbetween IAM Roles and FAS groups. +Ipsilon stores the relationship between IAM Roles and FAS groups. == Accessing the AWS Console