paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 23 Packages Projects Releases Wiki Activity

Add IAM policy permissions to s3 tech docs docs (#5359)

Browse Source 
List minimal permissions needed to write and read tech docs on AWS environment

Signed-off-by: Jussi Hallila <jussi@hallila.com>
Co-authored-by: Emma Indal <emma.indahl@gmail.com>

Co-authored-by: Emma Indal <emma.indahl@gmail.com>
This commit is contained in:
Jussi Hallila
2021-04-19 15:04:36 +02:00
committed by GitHub
parent 398cd6726b
commit 734c7d5238
1 changed files with 18 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/features/techdocs/using-cloud-storage.md
+18 -4
View File
@@ -135,7 +135,21 @@ techdocs:
bucketName: 'name-of-techdocs-storage-bucket'
```
**3a. (Recommended) Setup authentication the AWS way, using environment
**3. Create minimal AWS IAM policies to manage TechDocs**
To _write_ TechDocs into the S3 bucket the IAM policy needs to have at a minimum
permissions to:
- `s3:ListBucket` to retrieve bucket metadata
- `s3:PutObject` to upload files to the bucket
To _read_ TechDocs from the S3 bucket the IAM policy needs to have at a minimum
permissions to:
- `s3:ListBucket` - To retrieve bucket metadata
- `s3:GetObject` - To retrieve files from the bucket
**4a. (Recommended) Setup authentication the AWS way, using environment
variables**
You should follow the
@@ -166,7 +180,7 @@ more in
The AWS Region of the bucket is optional since TechDocs uses AWS SDK V2 and not
V3.
**3b. Authentication using app-config.yaml**
**4b. Authentication using app-config.yaml**
AWS credentials and region can be provided to the AWS SDK via `app-config.yaml`.
If the configs below are present, they will be used over existing `AWS_*`
@@ -187,7 +201,7 @@ techdocs:
Refer to the
[official AWS documentation for obtaining the credentials](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/getting-your-credentials.html).
**3c. Authentication using an assumed role** Users with multiple AWS accounts
**4c. Authentication using an assumed role** Users with multiple AWS accounts
may want to use a role for S3 storage that is in a different AWS account. Using
the `roleArn` parameter as seen below, you can instruct the TechDocs publisher
to assume a role before accessing S3.
@@ -207,7 +221,7 @@ Note: Assuming a role requires that primary credentials are already configured
at `AWS.config.credentials`. Read more about
[assuming roles in AWS](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html).
**4. That's it!**
**5. That's it!**
Your Backstage app is now ready to use AWS S3 for TechDocs, to store and read
the static generated documentation files. When you start the backend of the app,