Solr Broker User Permission Mark 2

[nickumia-reisys]

Related to

• Use Broker-specific Credentials for Solrcloud Broker data.gov#3950
• Solr Broker User Permissions Mark 1 #166

Fixes

• Error: failure configuring LB attributes: AccessDenied: User: ssb-solr-broker is not authorized to perform: elasticloadbalancing:ModifyLoadBalancerAttributes on resource: loadbalancer/app/solr-lb/lb
• Error: error listing tags for resource (namespace/ns-solr): AccessDeniedException: User: ssb-solr-broker is not authorized to perform: servicediscovery:ListTagsForResource on resource: servicediscovery:*/*

[github-actions]

Terraform plan for production

Plan: 0 to add, 1 to change, 0 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.solr_brokerpak_policy.aws_iam_policy.policy will be updated in-place
  ~ resource "aws_iam_policy" "policy" {
        id          = "arn:aws:iam::821341638715:policy/solr_brokerpak_policy"
        name        = "solr_brokerpak_policy"
      ~ policy      = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Action   = [
                          + "elasticloadbalancing:ModifyLoadBalancerAttributes",
                            "iam:CreateUser",
                            # (54 unchanged elements hidden)
                            "logs:PutRetentionPolicy",
                          + "servicediscovery:ListTagsForResource",
                        ]
                        # (2 unchanged elements hidden)
                    },
                ]
                # (1 unchanged element hidden)
            }
        )
        tags        = {}
        # (5 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

✅ Plan applied in apply #114

[github-actions]

Terraform plan for staging

Plan: 0 to add, 1 to change, 0 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.solr_brokerpak_policy.aws_iam_policy.policy will be updated in-place
  ~ resource "aws_iam_policy" "policy" {
        id          = "arn:aws:iam::054110281448:policy/solr_brokerpak_policy"
        name        = "solr_brokerpak_policy"
      ~ policy      = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Action   = [
                          + "elasticloadbalancing:ModifyLoadBalancerAttributes",
                            "iam:CreateUser",
                            # (54 unchanged elements hidden)
                            "logs:PutRetentionPolicy",
                          + "servicediscovery:ListTagsForResource",
                        ]
                        # (2 unchanged elements hidden)
                    },
                ]
                # (1 unchanged element hidden)
            }
        )
        tags        = {}
        # (5 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

✅ Plan applied in apply #114