datomic 2023-02-13 | Slack Archive

Ben Hammond11:02:15

Hi, I've just torn down my nested Datomic Cloud Stack and created a split stack, following the instructions in https://docs.datomic.com/cloud/operation/split-stacks.html I find the my Http Direct ions no longer have permission to access ssm:GetParametersByPath I can see that the new datomic-compute stack has created Roles for • ComputeLambdaExecutionRole • DatomicLambdaRole • StatesExecutionRole Which of those gets applied to datomic ions httpdirect executions ?

Ben Hammond11:02:41

so I can fix up the role permissioning

Ben Hammond11:02:20

Is there a recommended way to configure custom IAM policies so that they will survive a datomic upgrade?

Ben Hammond11:02:02

I guess I try adding the policy to each one in turn and see when it works....

Ben Hammond11:02:38

I can make it work by adding all the datomic roles and I can take out the roles one by one and then it still works when I have taken out all the roles

Ben Hammond11:02:09

guess I will need to redeploy to break it again

Ben Hammond12:02:25

ah its the > foobar-compute-eu-west-2 role that requires the policy

Ben Hammond12:02:25

well, that works for me, so I will stop looking perhaps there are other roles that I could attach the policy to that would also work?

Daniel Jomphe13:02:50

Hi Ben, doing it the documented way with https://docs.datomic.com/cloud/operation/access-control.html#authorize-ions makes for easy configuration. This way, no need to ever modify any role defined by Cognitect.

👀 1

👍 1

Ben Hammond13:02:03

Thanks, hadn't spotted that

2023-02-13

Channels