Reduce privileges for application managers #1090
Conversation
I think the application manager role is a bit over privileged. They should probably not have unilateral access to the secrets manger in the entire AWS account.
yes, that is correct @brucehoff. There are lots of app managers now including people who are not app developers. My concern is that it could be deleted/changed by non developers. if you feel that this is fine then we can just close this PR. |
No, I do NOT feel it is fine to give people excessive access. We have to give people the right level of access, meaning that non-developers should not have access to the secret store but neither should we remove access to the secret store from the application mangers who require it. |
@brucehoff for further context, here's @milen-sage request https://sagebionetworks.slack.com/archives/CEFQD0KU1/p1706290847735899 |
|
No need to do it this way. We accomplished least privilege with an alternative approach. We give Application Manager role to a few developers while we give everyone else access to the Viewer Plus role. |
I think the application manager role is a bit over privileged. They should probably not have unilateral access to the secrets manger in the entire AWS account.