Adding IAM role config to online store
- Dominant language
- Python
- Stars
- 7.3k
- Forks
- 1.4k
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 15
Description
**Is your feature request related to a problem? Please describe.**
_s3_staging_location field_
I would like to understand why was associated a deployment environment name in this variable name: `s3_staging_location`. It's makes some confusion when we try to understand how the things works behind the scenes. Besides, this field name can lead to fake semantics. For exemple, in our context we have the `s3_staging_location` with a production location value.
_iam_role field_
Why the iam_role field is exclusive to the offline store scope? In this way is not possible to reuse the role to the online store scope.
**Describe the solution you'd like**
```
offline_store:
type: redshift
region: us-west-2
cluster_id: ******
database: ******
user: ******
s3_staging_location: ******
iam_role: arn:aws:iam::account_id:role/role_1
online_store:
type: dynamodb
region: us-east-1
iam_role: arn:aws:iam::account_id:role/role_1
```
**Describe alternatives you've considered**
We created a role that was not possible to reuse in the online store context. So, we increased the permissions to the role (role_2) used by the aws-vault:
```
aws-vault exec profile (that uses role_2) -- pipenv run feast apply
```
**Additional context**
The additional permission was restricted to one user group, we can't use the same solution for other user groups due security issues.
Contributor guide
Assessment
This issue has not been assessed yet.