Document how to get gcp and aws access and aws permissions error due to MFA (#1610)

This commit is contained in:
Tiina
2021-07-13 21:13:05 +02:00
committed by GitHub
parent f920287a2c
commit 38712c7d4c
4 changed files with 50 additions and 6 deletions

View File

@@ -0,0 +1,30 @@
---
title: AWS tips and faq
sidebar: Handbook
showTitle: true
---
### How do I get access?
Ask in slack in #team-deployments-and-infrastructure as someone needs to add you. Though note that anyone who has edit access can do it.
To give someone access: navigate to [IAM](https://console.aws.amazon.com/iamv2/home#/users) and use the Add Users button at the top right to add their posthog email as user name, pick "AWS Management Console access" and add them to the "Team" group, then slack them the sign-in URL, User name and password.
### Permissions errors using aws cli
If you see something like
```
<my-user> is not authorized to perform: <action> on resource: <resource> with an explicit deny
```
Note the "with an explicit deny" in the end which likely is due to the fact that we force MFA. Follow [this guide](https://aws.amazon.com/premiumsupport/knowledge-center/authenticate-mfa-cli/) to use a session token. TLDR:
1. look up your security credential MFA device name from AWS console from `https://console.aws.amazon.com/iam/home#/users/<user-name>?section=security_credentials`
1. run `aws sts get-session-token --serial-number <arn-of-the-mfa-device> --token-code <code-from-token>` where `code-from-token` is the same code you'd use to login to the AWS console (e.g. from Authy app).
1.
```
export AWS_ACCESS_KEY_ID=example-access-key-as-in-previous-output
export AWS_SECRET_ACCESS_KEY=example-secret-access-key-as-in-previous-output
export AWS_SESSION_TOKEN=example-session-token-as-in-previous-output
```

View File

@@ -0,0 +1,11 @@
---
title: GCP tips and faq
sidebar: Handbook
showTitle: true
---
### How do I get access?
Ask in slack in #team-deployments-and-infrastructure as someone needs to add you. Though note that anyone who has edit access can do it.
To give someone access: navigate to [Posthog project IAM](https://console.cloud.google.com/iam-admin/iam?project=posthog-301601&supportedpurview=project) and use the +Add button at the top to add their posthog email and Basic -> Editor role.

View File

@@ -362,7 +362,9 @@
"handbook/engineering/ee-setup",
"handbook/engineering/common-issues",
"handbook/engineering/feature-parity",
"handbook/engineering/mdx"
"handbook/engineering/mdx",
"handbook/engineering/aws",
"handbook/engineering/gcp"
]
},
{

View File

@@ -14750,14 +14750,15 @@ react-responsive-mixin@^0.4.0:
enquire.js "^2.1.1"
json2mq "^0.2.0"
react-responsive@^6.1.2:
version "6.1.2"
resolved "https://registry.yarnpkg.com/react-responsive/-/react-responsive-6.1.2.tgz"
integrity sha512-AXentVC/kN3KED9zhzJv2pu4vZ0i6cSHdTtbCScVV1MT6F5KXaG2qs5D7WLmhdaOvmiMX8UfmS4ZSO+WPwDt4g==
react-responsive@^8.2.0:
version "8.2.0"
resolved "https://registry.yarnpkg.com/react-responsive/-/react-responsive-8.2.0.tgz#e0ffb306cfd8f38c9c12e26725b9e1245fa9debc"
integrity sha512-iagCqVrw4QSjhxKp3I/YK6+ODkWY6G+YPElvdYKiUUbywwh9Ds0M7r26Fj2/7dWFFbOpcGnJE6uE7aMck8j5Qg==
dependencies:
hyphenate-style-name "^1.0.0"
matchmediaquery "^0.3.0"
prop-types "^15.6.1"
shallow-equal "^1.1.0"
react-side-effect@^1.1.0:
version "1.2.0"
@@ -15843,7 +15844,7 @@ shallow-compare@^1.2.2:
resolved "https://registry.yarnpkg.com/shallow-compare/-/shallow-compare-1.2.2.tgz"
integrity sha512-LUMFi+RppPlrHzbqmFnINTrazo0lPNwhcgzuAXVVcfy/mqPDrQmHAyz5bvV0gDAuRFrk804V0HpQ6u9sZ0tBeg==
shallow-equal@^1.0.0:
shallow-equal@^1.0.0, shallow-equal@^1.1.0:
version "1.2.1"
resolved "https://registry.yarnpkg.com/shallow-equal/-/shallow-equal-1.2.1.tgz"
integrity sha512-S4vJDjHHMBaiZuT9NPb616CSmLf618jawtv3sufLl6ivK8WocjAo58cXwbRV1cgqxH0Qbv+iUt6m05eqEa2IRA==