Document what exact AWS-managed policies are needed for the access key about lamby

[tcannonfodder]

It is! That little signpost is perfect. 😄

[metaskills]

Because installing a root access key feels like A Bad Idea...

Agreed. But I'm not sure I'm following you on what we are doing badly or what "installing" means here. Are you thinking the aws configure is installing AWS crews in the container shipped to prod?

Also, have you see the full deployment guides where we advocate for (post experimenting) a least privilege user or Open ID Connect for the CI/CD pipeline? https://lamby.custominktech.com/docs/anatomy#deployment--cicd

[tcannonfodder]

Sorry, I just had my first cup of coffee, so I'm still booting up 😅

Sorry about the confusion here; I don't think aws configure is actually installing the credentials to production.

The process I went through was:

1. Work through the Quick Start Guide
2. Get to the aws configure step
3. Realize I need to get a new AWS account for personal experimenting. And also know that I don't want to just have a root access key lying around, so I want to make a user + group permissions for this experiment.
4. Realize there isn't documentation in this page about what permissions are actually needed to make the deployment according to the quick start guide
5. Lose a lot of time navigating the Vogon directory of AWS permissions

[tcannonfodder]

I hadn't seen that section of the documentation; maybe we should link to it & expand it, or make it its own section ("Securing your deployment process")?

Also, thank you for the work on this project! It's very interesting; and you've got a lot of work to make the bootstrapping as painless as possible 😄 (and I know I went off the beaten path a bit here 😜)

[metaskills]

No worries. Thank you so much for trying it out. Indeed, #3-5 🤣 is not really in scope here. But such a good idea. I did that a few years ago too and it was kind of a scary pain. My AWS account is old as dirt.

Anyways, I updated this little section a little. Do you think this is helpful? https://lamby.custominktech.com/docs/quick-start#deploy-to-lambda