add permission needed by datadog for cache bucket#98
add permission needed by datadog for cache bucket#98bwmetcalf wants to merge 3 commits intocloudposse:mainfrom
Conversation
|
@Gowiem @nitrocode Could one of you take a look at this MR? Thanks! |
Gowiem
added
bugfix
|
/terratest |
Head branch was pushed to by a user without write access
|
hi @Gowiem, thanks for thereview. It turns out datadog is now complaining about not being able to |
|
@Gowiem Any chance you could review this again. I added a new permission that datadog requires. |
| "s3:PutObject", | ||
| "s3:ListObject", | ||
| "s3:DeleteObject", | ||
| "s3:ListBucket", |
There was a problem hiding this comment.
Is this the correct statement block to add this? From the problem statement, it doesn't seem like it's related to a forwarder, is it ?
There was a problem hiding this comment.
It's interesting that this is also included in a statement block above if s3_logs_enabled is true. I wonder if this would be better to add to the new statement block for tag:GetResources ?
cc @Gowiem
There was a problem hiding this comment.
The s3:ListBucket error we were getting was reported against the cache bucket, but given that the tag:GetResources applies to all resources it would work in either place, I think.
My fork with these changes seems to have addressed the issue, so I believe the resulting permissions are what we want. The updated permissions where applied to the IAM role in question.
There was a problem hiding this comment.
I'll go through our use case again with this additional context and provide an update. Thanks for the feedback.
3 participants
what
We are seeing security signals from Datadog indicating
s3:ListBucketis needed by the role accessing the cache bucket created bymodule "tags_cache_s3_bucket" {}.why
Ensure Datadog has permissions needed.