{"action":"closed","issue":{"url":"https://api.github.com/repos/mozilla-iam/mozilla-iam/issues/23","repository_url":"https://api.github.com/repos/mozilla-iam/mozilla-iam","labels_url":"https://api.github.com/repos/mozilla-iam/mozilla-iam/issues/23/labels{/name}","comments_url":"https://api.github.com/repos/mozilla-iam/mozilla-iam/issues/23/comments","events_url":"https://api.github.com/repos/mozilla-iam/mozilla-iam/issues/23/events","html_url":"https://github.com/mozilla-iam/mozilla-iam/issues/23","id":211479296,"number":23,"title":"Refactor S3 bucket access methods","user":{"login":"gene1wood","id":1134034,"avatar_url":"https://avatars3.githubusercontent.com/u/1134034?v=3","gravatar_id":"","url":"https://api.github.com/users/gene1wood","html_url":"https://github.com/gene1wood","followers_url":"https://api.github.com/users/gene1wood/followers","following_url":"https://api.github.com/users/gene1wood/following{/other_user}","gists_url":"https://api.github.com/users/gene1wood/gists{/gist_id}","starred_url":"https://api.github.com/users/gene1wood/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gene1wood/subscriptions","organizations_url":"https://api.github.com/users/gene1wood/orgs","repos_url":"https://api.github.com/users/gene1wood/repos","events_url":"https://api.github.com/users/gene1wood/events{/privacy}","received_events_url":"https://api.github.com/users/gene1wood/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"flamingspaz","id":735045,"avatar_url":"https://avatars2.githubusercontent.com/u/735045?v=3","gravatar_id":"","url":"https://api.github.com/users/flamingspaz","html_url":"https://github.com/flamingspaz","followers_url":"https://api.github.com/users/flamingspaz/followers","following_url":"https://api.github.com/users/flamingspaz/following{/other_user}","gists_url":"https://api.github.com/users/flamingspaz/gists{/gist_id}","starred_url":"https://api.github.com/users/flamingspaz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/flamingspaz/subscriptions","organizations_url":"https://api.github.com/users/flamingspaz/orgs","repos_url":"https://api.github.com/users/flamingspaz/repos","events_url":"https://api.github.com/users/flamingspaz/events{/privacy}","received_events_url":"https://api.github.com/users/flamingspaz/received_events","type":"User","site_admin":false},"assignees":[{"login":"flamingspaz","id":735045,"avatar_url":"https://avatars2.githubusercontent.com/u/735045?v=3","gravatar_id":"","url":"https://api.github.com/users/flamingspaz","html_url":"https://github.com/flamingspaz","followers_url":"https://api.github.com/users/flamingspaz/followers","following_url":"https://api.github.com/users/flamingspaz/following{/other_user}","gists_url":"https://api.github.com/users/flamingspaz/gists{/gist_id}","starred_url":"https://api.github.com/users/flamingspaz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/flamingspaz/subscriptions","organizations_url":"https://api.github.com/users/flamingspaz/orgs","repos_url":"https://api.github.com/users/flamingspaz/repos","events_url":"https://api.github.com/users/flamingspaz/events{/privacy}","received_events_url":"https://api.github.com/users/flamingspaz/received_events","type":"User","site_admin":false}],"milestone":null,"comments":5,"created_at":"2017-03-02T18:37:33Z","updated_at":"2017-05-30T11:04:34Z","closed_at":"2017-05-30T11:04:34Z","body":"Currently the S3 buckets in the partinfra account use a combination of S3 ACLs, S3 Bucket Policies and IAM Policies to govern access to their contents. The combination of these 3 methods of access control likely result in unexpected permissions. For example, despite the clear intent that the \"jenkins-ses-iam\" IAM user only have rights to \"ses:SendRawEmail\" because of the IAM policy applied to that user, \"jenkins-ses-iam\" actually has rights to delete terraform configurations in the partinfra-tfsync S3 bucket because of an S3 ACL in place on that bucket. This means that users and roles in your account likely have unexpected permissions related to S3.\r\n\r\n\"[As a general rule, AWS recommends using S3 bucket policies or IAM policies for access control. S3 ACLs is a legacy access control mechanism that predates IAM](https://aws.amazon.com/blogs/security/iam-policies-and-bucket-policies-and-acls-oh-my-controlling-access-to-s3-resources/)\"\r\n\r\nI'd recommend going through your S3 buckets and determining the intent of the access control settings in each one and change them to be rendered in IAM policies or S3 bucket policies but not S3 ACLs\r\n"}}
{"actor":{"display_login":"flamingspaz"}}