Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

document S3 RBAC preference on v5.14+ #11111

Open
wants to merge 4 commits into
base: develop
Choose a base branch
from
Open

document S3 RBAC preference on v5.14+ #11111

Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
106ebe4
#10707 document S3 RBAC preference on v5.14+
donsizemore Dec 19, 2024
b77a7a1
#10707 Jim points out that this applies only to the default profile
donsizemore Dec 20, 2024
8b3f0e1
#10707 make named profiles more explicit per qqmyers
donsizemore Dec 20, 2024
ac60f4b
#10707 final round of corrections per qqmyers
donsizemore Dec 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 2 additions & 7 deletions doc/sphinx-guides/source/installation/config.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1093,6 +1093,8 @@ The Dataverse Software S3 driver supports multi-part upload for large files (ove
First: Set Up Accounts and Access Credentials
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

**Note:** As of version 5.14, if Dataverse is running in an EC2 instance it will prefer RBAC for the S3 default profile, even if administrators configure Dataverse with programmatic access keys. This is preferential from a security perspective as there are no keys to rotate or have stolen. If you intend to assign a role to your EC2 instance, you will still need the ``~/.aws/config`` file to specify the region but you need not generate credentials for the default profile. For more information please see https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the update. Minor text edit suggestions below.

Note: As of version 5.14, if Dataverse is running in an EC2 instance it will prefer Role Based Access Control (RBAC) over the S3 default profile, even if administrators configure Dataverse with programmatic access keys. (Named profiles can still be used to override RBAC for specific stores.) RBAC is preferential from a security perspective as there are no keys to rotate or have stolen. If you intend to assign a role to your EC2 instance, you will still need the ~/.aws/config file to specify the region but you need not generate credentials for the default profile. For more information please see https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html


donsizemore marked this conversation as resolved.
Show resolved Hide resolved
The Dataverse Software and the AWS SDK make use of the "AWS credentials profile file" and "AWS config profile file" located in
``~/.aws/`` where ``~`` is the home directory of the user you run Payara as. This file can be generated via either
of two methods described below:
Expand All @@ -1116,13 +1118,6 @@ To **create a user** with full S3 access and nothing more for security reasons,
for more info on this process.

To use programmatic access, **Generate the user keys** needed for a Dataverse installation afterwards by clicking on the created user.
(You can skip this step when running on EC2, see below.)

.. TIP::
If you are hosting your Dataverse installation on an AWS EC2 instance alongside storage in S3, it is possible to use IAM Roles instead
of the credentials file (the file at ``~/.aws/credentials`` mentioned below). Please note that you will still need the
``~/.aws/config`` file to specify the region. For more information on this option, see
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html

Preparation When Using Custom S3-Compatible Service
###################################################
Expand Down
Loading