provide better examples for setting up IAM roles - #317
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR significantly enhances the documentation for setting up IAM roles for Percona Backup for MongoDB in AWS environments. It expands the content from basic instructions to comprehensive, step-by-step guides with concrete examples.
Key Changes:
- Restructured EC2 instance IAM section to focus on role assumption with detailed policy examples
- Expanded IRSA (IAM Roles for Service Accounts) section with complete setup instructions including OIDC provider configuration, policy creation, and service account annotation
- Added extensive JSON policy examples for trust relationships and S3 permissions
- Included practical bash commands for AWS CLI operations
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| ] | ||
| } | ||
| ``` | ||
| > Remember to replace `EC2_ACCOUNT_ID` and `pbm-target-role` with the account ID and role name of your EC2 instance. |
There was a problem hiding this comment.
The guidance text at line 47 is misleading. It states to "replace EC2_ACCOUNT_ID and pbm-target-role", but pbm-target-role in line 40 should actually be replaced with the EC2 instance role name, not the target role name. The note should clarify that users need to replace these placeholders with their EC2 instance's role information, not the target role being created.
| > Remember to replace `EC2_ACCOUNT_ID` and `pbm-target-role` with the account ID and role name of your EC2 instance. | |
| > Remember to replace `EC2_ACCOUNT_ID` and `pbm-target-role` with the account ID and role name of your EC2 instance's IAM role (the role attached to your EC2 instance that will assume the target role). Do **not** use the target role's name here. |
|
|
||
| * **Trust Policy**: The trust policy of the target role must allow the EC2 instance's role to assume it. | ||
|
|
||
| For example, if your EC2 instance role is `arn:aws:iam::EC2_ACCOUNT_ID:role/pbm-target-role`, use the following trust policy for your target role: |
There was a problem hiding this comment.
The introductory text for the trust policy is confusing. Line 31 states "if your EC2 instance role is arn:aws:iam::EC2_ACCOUNT_ID:role/pbm-target-role", but this should refer to the EC2 instance role (e.g., pbm-ec2-instance-role), not pbm-target-role. Using the same role name for both the EC2 instance role and the target role creates confusion about which role is which.
|
@radoslawszulgo I've opened a new pull request, #318, to work on those changes. Once the pull request is ready, I'll request review from you. |
Co-authored-by: radoslawszulgo <175048287+radoslawszulgo@users.noreply.github.com>
Co-authored-by: radoslawszulgo <175048287+radoslawszulgo@users.noreply.github.com>
Co-authored-by: radoslawszulgo <175048287+radoslawszulgo@users.noreply.github.com>
Add OIDC ID extraction guidance for IRSA setup
Render
Destroyed
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
|
@radoslawszulgo I've opened a new pull request, #319, to work on those changes. Once the pull request is ready, I'll request review from you. |
…rget role Co-authored-by: radoslawszulgo <175048287+radoslawszulgo@users.noreply.github.com>
Fix IAM trust policy example to reference EC2 instance role
There was a problem hiding this comment.
Pull Request Overview
Copilot reviewed 1 out of 2 changed files in this pull request and generated 5 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Fix the links
…h-iam-roles-examples
…h-iam-roles-examples
Render
Destroyed
|
|
||
| If Encryption at Rest is enabled, the restore requires access to the same encryption key that was active when the backup was taken. | ||
| - For manually managed key files, update mongod.conf on all nodes to point to the original key before starting the restore procedure. | ||
| - For Hashicorp Vault-managed keys, ensure the historical key version is still available inside Vault. No changes to mongod.conf are required. |
|
@radoslawszulgo should we merge this? anything pending ? |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com>
No description provided.