Solr Broker User Permission Mark 4

[nickumia-reisys]

Related to

• Use Broker-specific Credentials for Solrcloud Broker data.gov#3950
• Solr Broker User Permissions Mark 3 #168

Fixes

• Error: error retrieving LB Attributes: AccessDenied: User: ssb-solr-broker is not authorized to perform: elasticloadbalancing:DescribeLoadBalancerAttributes
• Switch from individual ELB permission to ELB Full Access

References:

• https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/managed-policies.html

[github-actions]

Terraform plan for staging

Plan: 1 to add, 1 to change, 0 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # aws_iam_user_policy_attachment.solr_broker_policies["arn:aws:iam::aws:policy/ElasticLoadBalancingFullAccess"] will be created
  + resource "aws_iam_user_policy_attachment" "solr_broker_policies" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/ElasticLoadBalancingFullAccess"
      + user       = "ssb-solr-broker"
    }

  # module.solr_brokerpak_policy.aws_iam_policy.policy will be updated in-place
  ~ resource "aws_iam_policy" "policy" {
        id          = "arn:aws:iam::054110281448:policy/solr_brokerpak_policy"
        name        = "solr_brokerpak_policy"
      ~ policy      = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Action   = [
                          - "elasticloadbalancing:ModifyLoadBalancerAttributes",
                          - "elasticloadbalancing:DescribeTargetGroupAttributes",
                            "iam:CreateUser",
                            # (56 unchanged elements hidden)
                        ]
                        # (2 unchanged elements hidden)
                    },
                ]
                # (1 unchanged element hidden)
            }
        )
        tags        = {}
        # (5 unchanged attributes hidden)
    }

Plan: 1 to add, 1 to change, 0 to destroy.

✅ Plan applied in apply #116

[github-actions]

Terraform plan for production

Plan: 1 to add, 1 to change, 0 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # aws_iam_user_policy_attachment.solr_broker_policies["arn:aws:iam::aws:policy/ElasticLoadBalancingFullAccess"] will be created
  + resource "aws_iam_user_policy_attachment" "solr_broker_policies" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/ElasticLoadBalancingFullAccess"
      + user       = "ssb-solr-broker"
    }

  # module.solr_brokerpak_policy.aws_iam_policy.policy will be updated in-place
  ~ resource "aws_iam_policy" "policy" {
        id          = "arn:aws:iam::821341638715:policy/solr_brokerpak_policy"
        name        = "solr_brokerpak_policy"
      ~ policy      = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Action   = [
                          - "elasticloadbalancing:ModifyLoadBalancerAttributes",
                          - "elasticloadbalancing:DescribeTargetGroupAttributes",
                            "iam:CreateUser",
                            # (56 unchanged elements hidden)
                        ]
                        # (2 unchanged elements hidden)
                    },
                ]
                # (1 unchanged element hidden)
            }
        )
        tags        = {}
        # (5 unchanged attributes hidden)
    }

Plan: 1 to add, 1 to change, 0 to destroy.

✅ Plan applied in apply #116