补充集群备份和开启 TDE 加密时所需要的 AWS 最小权限说明
Open
@bb7133 is already working on this.
Since Feb 18, 2021.
lifecycle/frozen
type/enhancement
- Dominant language
- Python
- Stars
- 1.8k
- Forks
- 1.2k
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 31
Description
Change Request
This repository is ONLY used to solve problems related to DOCS-CN.
For other issues (TiDB, TiKV, etc), please move to other repositories.
Please answer the following questions before submitting your issue. Thanks!
- Describe what you find is inappropriate or missing in the existing docs.
TiDB 集群在使用公有云资源做备份的时候需要访问 S3/GCS，使用 AWS KMS 加密的时候需要访问 KMS，目前没有明确需要什么权限
- Describe your suggestion or addition.
安全上最小权限原则，要求给出应用程序所需要的最小权限，这样能够降低安全风险。文档里面需要说明 TiDB, TiKV, BR 所需的最小权限集合，帮助用户正确设置权限。
- Provide some reference materials (documents, websites, etc) if you could.
可以通过对应组件调用公有云的 API 来确定所要的权限。比如 TiKV 调用 S3 API 在这里 https://github.com/tikv/tikv/blob/a8066964650b74f7cbb105f1fbf017cf98b460d7/components/external_storage/src/s3.rs#L285
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.