Skip to content

Conversation

marcelovilla
Copy link
Member

@marcelovilla marcelovilla commented May 22, 2025

This PR adds two example IAM policies with the minimium required permissions to deploy and destroy Nebari on the Deploy Nebari on AWS of the How-to Guides section.

Reference Issues or PRs

Closes #580
xref: #107, #231

What does this implement/fix?

Put a x in the boxes that apply

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds a feature)
  • Breaking change (fix or feature that would cause existing features not to work as expected)
  • Documentation Update
  • Code style update (formatting, renaming)
  • Refactoring (no functional changes, no API changes)
  • Build related changes
  • Other (please describe):

Testing

  • Did you test the pull request locally?
  • Did you add new tests?

Documentation

Access-centered content checklist

Text styling

  • The content is written with plain language (where relevant).
  • If there are headers, they use the proper header tags (with only one level-one header: H1 or # in markdown).
  • All links describe where they link to (for example, check the Nebari website).
  • This content adheres to the Nebari style guides.

Non-text content

  • All content is represented as text (for example, images need alt text, and videos need captions or descriptive transcripts).
  • If there are emojis, there are not more than three in a row.
  • Don't use flashing GIFs or videos.
  • If the content were to be read as plain text, it still makes sense, and no information is missing.

Any other comments?

The two policies added in this PR were initially written using https://github.com/iann0036/iamlive 1 when deploying and destroying Nebari. However, manual changes to the generated policies were needed as there were still some permissions missing.

I tested this PR by both deploying to AWS locally and triggering Nebari's deployment tests after changing our CI role's permissions. Here's a successful run for reference.

To test this PR yourself, you can:

  1. Create two AWS IAM policies following the deploy and destroy templates, replacing the placeholders with the appropriate values.
  2. Attach them to a new or existing user, making sure they are the only policies attached
  3. Deploy Nebari to AWS
  4. Destroy Nebari to AWS

If you succeed without running into PermissionDenied errors, you're good to go.

Footnotes

  1. To reproduce, run the following command in one window:

    iamlive --set-ini --mode proxy --output-file aws-destroy-policy.json --refresh-rate 1 --sort-alphabetical
    

    And then, export the following environment variables in the terminal where you will run the nebari deploy and nebari destroy commands:

    export HTTP_PROXY=http://127.0.0.1:10080
    export HTTPS_PROXY=http://127.0.0.1:10080
    export AWS_CA_BUNDLE=~/.iamlive/ca.pem
    export NO_PROXY=localhost,127.0.0.1,eks.amazonaws.com,oidc.eks.eu-central-1.amazonaws.com
    

Copy link

netlify bot commented May 22, 2025

Deploy Preview for nebari-docs ready!

Name Link
🔨 Latest commit 7282ad9
🔍 Latest deploy log https://app.netlify.com/projects/nebari-docs/deploys/683457cb1c584500086f6a29
😎 Deploy Preview https://deploy-preview-581--nebari-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Copy link
Contributor

@viniciusdc viniciusdc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM


As a [best practice](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#lock-away-credentials), do not use the AWS account `root` user for any task where it's not
required. Instead, create a new IAM user for each person that requires administrator access. Then make those users administrators by placing them into an "Administrators" user
group, to which you attach the `AdministratorAccess` managed policy.
required. Instead, create a new IAM user for each person that requires administrator access. Then make those users administrators by placing them into an "Administrators" (or any other name) user group, to which you attach the policies outlined above.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If possible, include a link for this or an image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Todo 📬
Development

Successfully merging this pull request may close these issues.

[DOC] - Document minimal AWS IAM policies required for deploying and destroying Nebari
2 participants