feast-dev / feast-dev/feast

Adding IAM role config to online store

Open
#1,857 10 comments 0 reactions 0 assignees View on GitHub
keep-open kind/feature not-critical
Dominant language
Python
Stars
7.3k
Forks
1.4k
Avg merge
1d 21h
Merged PRs (30d)
15

Description

**Is your feature request related to a problem? Please describe.**

_s3_staging_location field_

I would like to understand why was associated a deployment environment name in this variable name: `s3_staging_location`. It's makes some confusion when we try to understand how the things works behind the scenes. Besides, this field name can lead to fake semantics. For exemple, in our context we have the `s3_staging_location` with a production location value.

_iam_role field_

Why the iam_role field is exclusive to the offline store scope? In this way is not possible to reuse the role to the online store scope.

**Describe the solution you'd like**
```
offline_store:
type: redshift
region: us-west-2
cluster_id: ******
database: ******
user: ******
s3_staging_location: ******
iam_role: arn:aws:iam::account_id:role/role_1
online_store:
type: dynamodb
region: us-east-1
iam_role: arn:aws:iam::account_id:role/role_1
```

**Describe alternatives you've considered**
We created a role that was not possible to reuse in the online store context. So, we increased the permissions to the role (role_2) used by the aws-vault:
```
aws-vault exec profile (that uses role_2) -- pipenv run feast apply
```

**Additional context**
The additional permission was restricted to one user group, we can't use the same solution for other user groups due security issues.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.