Update StorageConfig to handle multiple auth methods
#1140
Conversation
TheAndrewJackson
changed the title
StorageConfig to handle multiple auth methods
|
@seanpreston Do you have any opinions on backwards compatibility for this ticket? Now the codebase assumes that the new |
docs/fidesops/docs/guides/storage.md
Outdated
| @@ -56,6 +57,7 @@ Params: | |||
|
|
|||
| Additional params needed for S3: | |||
|
|
|||
| - `auth_method`: Authentication method for creating a session with S3. | |||
There was a problem hiding this comment.
Should we specify the methods we support or do we support them all?
There was a problem hiding this comment.
It looks like the only accepted methods are "automatic" or "secret_keys"? We should definitely note that here.
| - `auth_method`: Authentication method for creating a session with S3. | |
| - `auth_method`: Authentication method for creating a session with S3, either `automatic` or `secret_keys`. |
There was a problem hiding this comment.
@sanders41 Are you referring to the 8 methods mentioned on the boto3 documentation? All boto3 auth methods
There was a problem hiding this comment.
Right, does the 2 ways you have here work with all 8? Or will it only work with certain ones?
There was a problem hiding this comment.
It doesn't work with all 8. I haven't verified every option that automatic covers but it should handle anything that supports automatically creating a session based on the container environment.
docs/fidesops/docs/guides/storage.md
Outdated
| - `aws_access_key_id`: AWS access key id, obtained from AWS console. | ||
| - `aws_secret_access_key`: AWS secret access key, obtained from AWS console. | ||
|
|
||
| Fidesops also supports automatically creating a session for S3. When this authentication method is selected no secrets need to be provided. Boto3 will look for credentials on the server. |
There was a problem hiding this comment.
Maybe point the the S3 docs explaining what they need to do on the server for this to work.
There was a problem hiding this comment.
| Fidesops also supports automatically creating a session for S3. When this authentication method is selected no secrets need to be provided. Boto3 will look for credentials on the server. | |
| Fidesops also supports automatically creating a session for S3. If your `auth_method` is set to `automatic`, no secrets need to be provided. Boto3 will look for credentials on the server. |
There was a problem hiding this comment.
@conceptualshark How does this look for pointing users to the boto3 docs?
Please refer to the boto3 credentials documentation for how to configure credentials for AWS.
There was a problem hiding this comment.
lgtm. @conceptualshark I'll let you merge when the docs are good.
|
👍 lgtm! |
* Initial automatic impl * Lints * disable pylint error * Fix unit tests * fix imports * Update fixture * Fix config tests * Covert type to enum * Add new unit tests * Update changelong * Update docs * Update phone number * patch task scheduler * remove pylint ignore and add exception * Update docs
Purpose
StorageConfignow supports multiple auth methods for S3. One is the previous secret key method and the second is an automatic method.Changes
get_s3_sessionto create aboto3session based on theS3AuthMethodmethod enumauth_methodkeyChecklist
CHANGELOG.mdfileCHANGELOG.mdfile is being appended toUnreleasedsection in an appropriate category. Add a new category from the list at the top of the file if the needed one isn't already there.Run Unsafe PR Checkslabel has been applied, and checks have passed, if this PR touches any external servicesTicket
Fixes #1100