{"push_id":2080416113,"size":1,"distinct_size":1,"ref":"refs/heads/switch-servic-user","head":"84f24c3b17dabbfce882e76af595fd6100790325","before":"d87286461cada60bdf87af19d8923a5a632a0c45","commits":[{"sha":"84f24c3b17dabbfce882e76af595fd6100790325","author":{"name":"Khai Do","email":"0e3ddef4d3468acdba86db35821bb91d33893f2d@gmail.com"},"message":"Switch BridgePF to use the new service user\n\nThe Bridge app uses the AWS heroku account to access AWS resources.\nThe problem is that the heroku account has too much access.  We want\nto enforce a least privilege model of access.\n\nSwitch BridgePF to use the CF managed BridgePF service user account\nto access AWS resources.  This user has less privileges than heroku\nand is setup with access policies specifically for BridgePF which is\nmore secure.\n\nAdditional benefits:\n\n* The management of the group, users and policies are fully automated and\nchanges to them are reviewable in git.\n* Makes CF scripts simpler because we no longer need to pass in keys to\nthe template.  The access keys are completely managed in CF.\n* Makes AWS IAM easier to manage because BridgePF only needs one service\naccount now.\n* Potentially makes BridgePF simpler since it only needs one user account\nto access only the AWS resources it needs.  It's easier to manage one\naccount than five accounts.\n\nOptional todo:\n* Refactor BridgePF to only load and use one key instaed of five keys.","distinct":true,"url":"https://api.github.com/repos/zaro0508/BridgePF-infra/commits/84f24c3b17dabbfce882e76af595fd6100790325"}]}
{"actor":{"display_login":"zaro0508"}}