feat: Least Access Privilege iam BYOB (#50)

* feat: Least Access Privilege iam BYOB --------- Co-authored-by: Zachary Blasczyk <zb@Zachary-Blasczyk-TW7P70V256.local>
wandb · Feb 22, 2023 · 3ed0179 · 3ed0179
1 parent af42339
commit 3ed0179
Show file tree

Hide file tree

Showing 2 changed files with 50 additions and 14 deletions.
diff --git a/examples/byob/README.md b/examples/byob/README.md
@@ -51,18 +51,24 @@ purposes. It will require to have the following policy:
   "Version": "2012-10-17",
   "Statement": [
     {
-      "Sid": "Internal",
-      "Effect": "Allow",
-      "Principal": { "AWS": "<you account id>" },
-      "Action": "kms:*",
-      "Resource": "*"
+      "Sid" : "Internal",
+      "Effect" : "Allow",
+      "Principal" : { "AWS" : "<you account id>" },
+      "Action" : "kms:*",
+      "Resource" : "*"
     },
     {
-      "Sid": "External",
-      "Effect": "Allow",
-      "Principal": { "AWS": "arn:aws:iam::830241207209:root" },
-      "Action": "kms:*",
-      "Resource": "*"
+      "Sid" : "External",
+      "Effect" : "Allow",
+      "Principal" : { "AWS" : "arn:aws:iam::830241207209:root" },
+      "Action" : [
+        "kms:Decrypt",
+        "kms:Describe*",
+        "kms:Encrypt",
+        "kms:ReEncrypt*",
+        "kms:GenerateDataKey*"
+      ],
+      "Resource" : "*"
     }
   ]
 }
@@ -101,7 +107,19 @@ Finally, grant the Weights & Biases Deployment account access to this S3 bucket:
       "Sid": "WAndBAccountAccess",
       "Effect": "Allow",
       "Principal": { "AWS": "arn:aws:iam::830241207209:root" },
-      "Action": "s3:*",
+        "Action" : [
+          "s3:GetObject*",
+          "s3:GetEncryptionConfiguration",
+          "s3:ListBucket",
+          "s3:ListBucketMultipartUploads",
+          "s3:ListBucketVersions",
+          "s3:AbortMultipartUpload",
+          "s3:DeleteObject",
+          "s3:PutObject",
+          "s3:GetBucketCORS",
+          "s3:GetBucketLocation",
+          "s3:GetBucketVersioning"
+        ],
       "Resource": [
         "arn:aws:s3:::<WANDB_BUCKET>",
         "arn:aws:s3:::<WANDB_BUCKET>/*"

diff --git a/examples/byob/main.tf b/examples/byob/main.tf
@@ -50,7 +50,13 @@ resource "aws_kms_key" "key" {
         "Sid" : "External",
         "Effect" : "Allow",
         "Principal" : { "AWS" : "${local.wandb_deployment_account_arn}" },
-        "Action" : "kms:*",
+        "Action" : [
+          "kms:Decrypt",
+          "kms:Describe*",
+          "kms:Encrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*"
+        ],
         "Resource" : "*"
       }
     ]
@@ -87,7 +93,19 @@ resource "aws_s3_bucket_policy" "default" {
         "Sid" : "WAndBAccountAccess",
         "Effect" : "Allow",
         "Principal" : { "AWS" : "${local.wandb_deployment_account_arn}" },
-        "Action" : "s3:*",
+        "Action" : [
+          "s3:GetObject*",
+          "s3:GetEncryptionConfiguration",
+          "s3:ListBucket",
+          "s3:ListBucketMultipartUploads",
+          "s3:ListBucketVersions",
+          "s3:AbortMultipartUpload",
+          "s3:DeleteObject",
+          "s3:PutObject",
+          "s3:GetBucketCORS",
+          "s3:GetBucketLocation",
+          "s3:GetBucketVersioning"
+        ],
         "Resource" : [
           "${module.resources.bucket_arn}",
           "${module.resources.bucket_arn}/*",
@@ -103,4 +121,4 @@ output "bucket_name" {
 
 output "bucket_kms_key_arn" {
   value = aws_kms_key.key.arn
-}
+}