Remove analytics worker + associated IAM policies#226
Conversation
|
Setting this to draft, dandi/dandi-archive#2425 must be merged first. |
|
@jjnesbitt this is ready now, since dandi/dandi-archive#2425 is merged. |
| } | ||
|
|
||
| data "aws_iam_policy_document" "dandiset_log_bucket_policy" { | ||
| statement { |
There was a problem hiding this comment.
Sorry -- just want to make sure we do not remove some used IAM:
I wonder if this is anyhow relates to IAM key/secret for which @satra recently shared with me and @CodyCBakerPhD to setup our processing? is there a way to check if this IAM was used recently?
There was a problem hiding this comment.
This is removing a bucket policy, not an IAM role, so technically there is no concept of "last used". The associated IAM role that the policy is attached to, dandi-api-heroku, is used by the Django app and all the celery workers for AWS access. If it's being used elsewhere, we should phase that out and create a new IAM role/policy for it (I imagine this is not the case though).
3 participants
With dandi/dandi-archive#2425, we no longer need the extra celery worker or extra IAM policies to grant the Heroku user access to the logging bucket.