Fix: Alarm api_unauthorized for HeadBucket/Object from SSM agent (#6141) #6151

dsotirho-ucsc · 2024-04-09T23:12:46Z

Connected issues: #6141

Checklist

Author

PR is a draft
Target branch is develop
Name of PR branch matches issues/<GitHub handle of author>/<issue#>-<slug>
On ZenHub, PR is connected to all issues it (partially) resolves
PR description links to connected issues
PR title matches¹ that of a connected issue _{or comment in PR explains why they're different}
PR title references all connected issues
For each connected issue, there is at least one commit whose title references that issue

Author (partiality)

Added p tag to titles of partial commits
This PR is labeled partial _{or completely resolves all connected issues}
This PR partially resolves each of the connected issues _{or does not have the partial label}

¹ when the issue title describes a problem, the corresponding PR
title is Fix: followed by the issue title

Author (chains)

This PR is blocked by previous PR in the chain _{or is not chained to another PR}
The blocking PR is labeled base _{or this PR is not chained to another PR}
This PR is labeled chained _{or is not chained to another PR}

Author (reindex, API changes)

Added r tag to commit title _{or this PR does not require reindexing}
This PR is labeled reindex:dev _{or does not require reindexing dev}
This PR is labeled reindex:anvildev _{or does not require reindexing anvildev}
This PR is labeled reindex:anvilprod _{or does not require reindexing anvilprod}
This PR is labeled reindex:partial and its description documents the specific reindexing procedure for dev, anvildev, anvilprod and prod _{or requires a full reindex or carries none of the labels reindex:dev, reindex:anvildev, reindex:anvilprod and reindex:prod}
This PR and its connected issues are labeled API _{or this PR does not modify a REST API}
Added a (A) tag to commit title for backwards (in)compatible changes _{or this PR does not modify a REST API}
Updated REST API version number in app.py _{or this PR does not modify a REST API}

Author (upgrading deployments)

Documented upgrading of deployments in UPGRADING.rst _{or this PR does not require upgrading deployments}
Added u tag to commit title _{or this PR does not require upgrading deployments}
Ran make image_manifests.json and committed the resulting changes _{or this PR does not modify azul_docker_images, or any other variables referenced in the definition of that variable}
This PR is labeled upgrade _{or does not require upgrading deployments}
This PR is labeled deploy:shared _{or does not modify image_manifests.json, and does not require deploying the shared component for any other reason}
This PR is labeled deploy:gitlab _{or does not require deploying the gitlab component}
This PR is labeled deploy:runner _{or does not require deploying the runner image}

Author (operator tasks)

Added checklist items for additional operator tasks _{or this PR does not require additional tasks}

Author (hotfixes)

Added F tag to main commit title _{or this PR does not include permanent fix for a temporary hotfix}
Reverted the temporary hotfixes for any connected issues _{or the prod branch has no temporary hotfixes for any connected issues}

Author (before every review)

Rebased PR branch on develop, squashed old fixups
Ran make requirements_update _{or this PR does not modify requirements*.txt, common.mk, Makefile and Dockerfile}
Added R tag to commit title _{or this PR does not modify requirements*.txt}
This PR is labeled reqs _{or does not modify requirements*.txt}
make integration_test passes in personal deployment _{or this PR does not modify functionality that could affect the IT outcome}

Peer reviewer (after requesting changes)

Uncheck the Author (before every review) checklists.

Peer reviewer (after approval)

PR is not a draft
Ticket is in Review requested column
Requested review from system administrator
PR is assigned to only the system administrator

System administrator (after requesting changes)

Uncheck the before every review checklists. Update the N reviews label.

System administrator (after approval)

Actually approved the PR
Labeled connected issues as demo or no demo
Commented on connected issues about demo expectations _{or all connected issues are labeled no demo}
Decided if PR can be labeled no sandbox
A comment to this PR details the completed security design review _{or this PR is a promotion or a backport}
PR title is appropriate as title of merge commit
N reviews label is accurate
Moved ticket to Approved column
PR is assigned to only the operator

Operator (before pushing merge the commit)

System administrator

Background migrations for dev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
Background migrations for anvildev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
Background migrations for anvilprod.gitlab are complete _{or this PR is not labeled deploy:gitlab}
PR is assigned to only the operator

Operator (before pushing merge the commit)

Operator (chain shortening)

Changed the target branch of the blocked PR to develop _{or this PR is not labeled base}
Removed the chained label from the blocked PR _{or this PR is not labeled base}
Removed the blocking relationship from the blocked PR _{or this PR is not labeled base}
Removed the base label from this PR _{or this PR is not labeled base}

Operator (after pushing the merge commit)

¹ When pushing the merge commit is skipped due to the PR being
labelled no sandbox, the next build triggered by a PR whose merge commit is
pushed determines this checklist item.

Operator (reindex)

Operator

Propagated the deploy:shared, deploy:gitlab, deploy:runner, reindex:partial and reindex:prod labels to the next promotion PR _{or this PR carries none of these labels}
Propagated any specific instructions related to the deploy:shared, deploy:gitlab, deploy:runner, reindex:partial and reindex:prod labels from the description of this PR to that of the next promotion PR _{or this PR carries none of these labels}
PR is assigned to no one

Shorthand for review comments

L line is too long
W line wrapping is wrong
Q bad quotes
F other formatting problem

dsotirho-ucsc · 2024-04-09T23:33:53Z

With this change, the gitlab_boundary policy (on anvilprod) would increase from 5,306 to 5,528 characters.

Terraform will perform the following actions:

  # aws_iam_policy.gitlab_boundary will be updated in-place
  ~ resource "aws_iam_policy" "gitlab_boundary" {
        id        = "arn:aws:iam::122796619775:policy/azul-boundary"
        name      = "azul-boundary"
      ~ policy    = jsonencode(
          ~ {
              ~ Statement = [
                    {
                        Action   = [
                            "s3:ListAllMyBuckets",
                            "s3:HeadBucket",
                            "s3:GetAccountPublicAccessBlock",
                        ]
                        Effect   = "Allow"
                        Resource = "*"
                    },
                  ~ {
                      ~ Resource = [
                            # (3 unchanged elements hidden)
                            "arn:aws:s3:::edu-ucsc-gi-platform-hca-dev-*",
                          + "arn:aws:s3:::aws-ssm-document-attachments-us-east-1/*",
                          + "arn:aws:s3:::aws-ssm-document-attachments-us-east-1",
                          + "arn:aws:s3:::amazon-ssm-packages-us-east-1/*",
                          + "arn:aws:s3:::amazon-ssm-packages-us-east-1",
                        ]
                        # (2 unchanged attributes hidden)
                    },
                    {
                        Action   = [
                            "kms:ListKeys",
                            "kms:ListAliases",
                        ]
                        Effect   = "Allow"
                        Resource = "*"
                    },
                    # (28 unchanged elements hidden)
                ]
                # (1 unchanged attribute hidden)
            }
        )
        tags      = {
            "Name"                = "azul-gitlab_boundary"
            "billing"             = "hca"
            "component"           = "azul-gitlab_boundary"
            "deployment"          = "dev"
            "owner"               = "[email protected]"
            "service"             = "azul"
            "terraform_component" = "gitlab"
        }
        # (4 unchanged attributes hidden)
    }

  # aws_iam_policy.gitlab_iam will be updated in-place
  ~ resource "aws_iam_policy" "gitlab_iam" {
        id        = "arn:aws:iam::122796619775:policy/azul-gitlab-iam"
        name      = "azul-gitlab-iam"
      ~ policy    = jsonencode(
          ~ {
              ~ Statement = [
                    # (13 unchanged elements hidden)
                    {
                        Action   = [
                            "kms:UpdateKeyDescription",
                            "kms:UpdateAlias",
                            "kms:UntagResource",
                            "kms:TagResource",
                            "kms:ScheduleKeyDeletion",
                            "kms:DeleteAlias",
                            "kms:CreateAlias",
                        ]
                        Effect   = "Allow"
                        Resource = [
                            "arn:aws:kms:us-east-1:122796619775:key/*",
                            "arn:aws:kms:us-east-1:122796619775:alias/*",
                        ]
                    },
                  ~ {
                      ~ Resource = [
                            "arn:aws:s3:::aws-ssm-document-attachments-us-east-1/*",
                          + "arn:aws:s3:::aws-ssm-document-attachments-us-east-1",
                            "arn:aws:s3:::amazon-ssm-packages-us-east-1/*",
                          + "arn:aws:s3:::amazon-ssm-packages-us-east-1",
                        ]
                        # (2 unchanged attributes hidden)
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        tags      = {
            "Name"                = "azul-gitlab_iam"
            "billing"             = "hca"
            "component"           = "azul-gitlab_iam"
            "deployment"          = "dev"
            "owner"               = "[email protected]"
            "service"             = "azul"
            "terraform_component" = "gitlab"
        }
        # (4 unchanged attributes hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

coveralls · 2024-04-09T23:35:04Z

coverage: 85.342% (-0.005%) from 85.347%
when pulling 2a3e350 on issues/dsotirho-ucsc/6141-api-unauthorized-assumedrole
into 8e79850 on develop.

codecov · 2024-04-09T23:35:31Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 85.32%. Comparing base (8e79850) to head (2a3e350).

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #6151      +/-   ##
===========================================
- Coverage    85.32%   85.32%   -0.01%     
===========================================
  Files          154      154              
  Lines        20129    20129              
===========================================
- Hits         17176    17175       -1     
- Misses        2953     2954       +1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

hannes-ucsc · 2024-04-10T21:59:24Z

hannes-ucsc · 2024-04-10T22:02:25Z

Security design review: This PR grants the required permissions to SSM agent running on the GitLab instance. A previous PR attempted to grant the same permissions but failed to do so correctly. This PR addresses that. It affects the monitoring of the system in that it will cause fewer false positive alarms to be triaged.

hannes-ucsc · 2024-04-10T22:10:01Z

1 review because PR was still a draft and peer review checklist was incomplete.

dsotirho-ucsc added the deploy:gitlab [process] PR requires deploying `gitlab` component label Apr 9, 2024

github-actions bot added the orange [process] Done by the Azul team label Apr 9, 2024

dsotirho-ucsc changed the title ~~Fix: Alarm api_unauthorized for HeadBucket/Object from AssumedRole azul-gitlab (#6141)~~ Fix: Alarm api_unauthorized for HeadBucket/Object from SSM agent (#6141) Apr 10, 2024

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/6141-api-unauthorized-assumedrole branch from 6da2f86 to 24b7b1e Compare April 10, 2024 19:41

dsotirho-ucsc assigned hannes-ucsc Apr 10, 2024

hannes-ucsc approved these changes Apr 10, 2024

View reviewed changes

hannes-ucsc marked this pull request as ready for review April 10, 2024 21:57

hannes-ucsc added the 1 review [process] Lead requested changes once label Apr 10, 2024

hannes-ucsc assigned dsotirho-ucsc and unassigned hannes-ucsc Apr 10, 2024

Fix: Alarm api_unauthorized for HeadBucket/Object from SSM agent (#6141)

2a3e350

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/6141-api-unauthorized-assumedrole branch from 24b7b1e to 2a3e350 Compare April 10, 2024 22:24

dsotirho-ucsc assigned hannes-ucsc and dsotirho-ucsc and unassigned dsotirho-ucsc and hannes-ucsc Apr 10, 2024

dsotirho-ucsc added the sandbox [process] Resolution is being verified in sandbox deployment label Apr 10, 2024

dsotirho-ucsc merged commit 4ed893e into develop Apr 11, 2024
12 checks passed

dsotirho-ucsc deleted the issues/dsotirho-ucsc/6141-api-unauthorized-assumedrole branch April 11, 2024 03:44

dsotirho-ucsc removed their assignment Apr 12, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix: Alarm api_unauthorized for HeadBucket/Object from SSM agent (#6141) #6151

Fix: Alarm api_unauthorized for HeadBucket/Object from SSM agent (#6141) #6151

dsotirho-ucsc commented Apr 9, 2024 •

edited

Loading

dsotirho-ucsc commented Apr 9, 2024 •

edited

Loading

coveralls commented Apr 9, 2024 •

edited

Loading

codecov bot commented Apr 9, 2024 •

edited

Loading

hannes-ucsc commented Apr 10, 2024 •

edited

Loading

hannes-ucsc commented Apr 10, 2024 •

edited

Loading

hannes-ucsc commented Apr 10, 2024

Fix: Alarm api_unauthorized for HeadBucket/Object from SSM agent (#6141) #6151

Fix: Alarm api_unauthorized for HeadBucket/Object from SSM agent (#6141) #6151

Conversation

dsotirho-ucsc commented Apr 9, 2024 • edited Loading

Checklist

Author

Author (partiality)

Author (chains)

Author (reindex, API changes)

Author (upgrading deployments)

Author (operator tasks)

Author (hotfixes)

Author (before every review)

Peer reviewer (after requesting changes)

Peer reviewer (after approval)

System administrator (after requesting changes)

System administrator (after approval)

Operator (before pushing merge the commit)

System administrator

Operator (before pushing merge the commit)

Operator (chain shortening)

Operator (after pushing the merge commit)

Operator (reindex)

Operator

Shorthand for review comments

dsotirho-ucsc commented Apr 9, 2024 • edited Loading

coveralls commented Apr 9, 2024 • edited Loading

codecov bot commented Apr 9, 2024 • edited Loading

Codecov Report

hannes-ucsc commented Apr 10, 2024 • edited Loading

Security design review

hannes-ucsc commented Apr 10, 2024 • edited Loading

hannes-ucsc commented Apr 10, 2024

dsotirho-ucsc commented Apr 9, 2024 •

edited

Loading

dsotirho-ucsc commented Apr 9, 2024 •

edited

Loading

coveralls commented Apr 9, 2024 •

edited

Loading

codecov bot commented Apr 9, 2024 •

edited

Loading

hannes-ucsc commented Apr 10, 2024 •

edited

Loading

hannes-ucsc commented Apr 10, 2024 •

edited

Loading