This automatically runs the identity sync-identity-search command once a day at midnight UTC
Depends on D11161
Details
Details
Just terraform applied on staging. Won't land until confirmed working functionally
Diff Detail
Diff Detail
- Repository
- rCOMM Comm
- Lint
No Lint Coverage - Unit
No Test Coverage
Event Timeline
| services/terraform/remote/task_sync_identity_search.tf | ||
|---|---|---|
| 18 ↗ | (On Diff #37419) | This is for the tracing crate. The blob task sets blob= trace to provide highest setting of verbosity. I did the same, but this can also be removed without consequence. Given that the logs for the task don't spill anywhere else, I think it's fine we keep this? |
| 36 ↗ | (On Diff #37419) | I believe so. This is the same role provided to the service_identity ecs task that grants access to dynamodb for r/w |
Comment Actions
We can move the iam policy and role for scheduling to aws_iam.tf and use them in both. Will include in next rebase
Comment Actions
Actually. Rethinking this. If we included the policy, we'd probably want to put all our tasks in a single file to refer to the ws_ecs_task_definitions in the Resources block. The only thing that can probably be shared is the aws_iam_role scheduler role which would then share multiple permissions for ecs. The role could be placed in aws_iam.tf
Comment Actions
The role could be placed in aws_iam.tf
before landing, can you please address my inline question and move this role from task_blob_cleanup.tf to aws_iam.tf? we should also give it a more precise name than scheduler, maybe task_scheduler?
| services/terraform/remote/task_sync_identity_search.tf | ||
|---|---|---|
| 18 ↗ | (On Diff #37419) | seems fine. i was unfamiliar with "info,identity=trace,comm_lib=debug". looks like this sets the global log level to info, but the identity crate log level is trace and the comm_lib namespace log level is debug. this is probably so we can see the debug logs for the identity service without the noise from aws-sdk and other crates |
| 36 ↗ | (On Diff #37419) | but doesn't your task need to read from ddb and write to the opensearch index? |
Comment Actions
Forgot to leave a comment with the diff that address this: https://phab.comm.dev/D11161. I'll rebase it from scheduler to task-scheduler.
Comment Actions
ah nvm i see you moved the role in D11161. please address the inline question, though
| services/terraform/remote/task_sync_identity_search.tf | ||
|---|---|---|
| 36 ↗ | (On Diff #37419) | On rereading my config, it looks like I'm allowing access from resources in the vpc which would include the ecs task. I'm not sure if this is too permissive and I can remove if needed. Allowing access from any vpc resource would seemingly defeat the purpose of the Opensearch role access granted to the lambda. So we can either allow free range vpc access or limit to the role. |
| services/terraform/remote/task_sync_identity_search.tf | ||
|---|---|---|
| 36 ↗ | (On Diff #37419) | Here's a linear task tracking removal of replacing vpc-based access with role-based access as a identity search followup: |