Currently, we specify the root account as the Principle in the permissions we tell users to apply to their buckets. This is broader scoped than is necessary, and would let anyone with access to the account use those permissions.
Technically, we should only need to grant permissions to these specific roles:
However, exposing the arns for these roles to the API (likely as env vars) is a bit challenging and it does add a potential permissions gotcha when developing HyP3 that we're not currently set up to catch.
Currently, we specify the root account as the
Principlein the permissions we tell users to apply to their buckets. This is broader scoped than is necessary, and would let anyone with access to the account use those permissions.Technically, we should only need to grant permissions to these specific roles:
get-fileslambda role: https://github.com/ASFHyP3/hyp3/blob/develop/apps/get-files/get-files-cf.yml.j2#L35upload-loglambda role: https://github.com/ASFHyP3/hyp3/blob/develop/apps/upload-log/upload-log-cf.yml.j2#L29However, exposing the arns for these roles to the API (likely as env vars) is a bit challenging and it does add a potential permissions gotcha when developing HyP3 that we're not currently set up to catch.