DOC-2297: Cross-account IAM delegation for BYOC on AWS (draft)#633
Draft
micheleRP wants to merge 6 commits into
Draft
DOC-2297: Cross-account IAM delegation for BYOC on AWS (draft)#633micheleRP wants to merge 6 commits into
micheleRP wants to merge 6 commits into
Conversation
Rework the AWS IAM policies reference from cloudv2 source, add a cross-account deploy how-to and concept, plus a draft What's New entry. AWS-only, new clusters only (ENG-1139, targeted 26.2). Existing clusters keep the agent-based rpk cloud byoc apply model. - security: rebuild AWS section of iam-policies.adoc partial from instance_profile.tf (30 statements) into friendly, anchored sections with why-tables and collapsible Terraform; reframe for cross-account. GCP/Azure sections unchanged. - get-started: new cross-account-iam-aws.adoc how-to + nav entry - get-started: byoc-arch.adoc provisioning-models section + create-page cross-link TIP - get-started: draft What's New entry (do not publish before GA) Contains TODO(team)/TODO(eng) placeholders pending SME confirmation. Draft, not for merge. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
✅ Deploy Preview for rp-cloud ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Rebuild the GCP and Azure sections of the iam-policies.adoc partial from cloudv2 source (role_redpanda_agent.tf, azure/agent/iam.tf) into the same friendly, anchored sections with Permission | Access | Why it is needed tables, plus a collapsible full role definition. Both keep the agent-based framing (no cross-account delegation this release). Refresh from source also closes drift: GCP adds secretmanager.* and serviceusage.* and a Redpanda SQL storage role; Azure adds the private endpoint / private DNS / Log Analytics actions the published page lacked. Reuses Denis's "why" text where the permission still exists; newer actions are marked TODO(eng). Reformatted at PM (Denis) request for consistency. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Rewrite create-byoc-cluster-aws.adoc so cross-account IAM delegation is the primary path for new AWS clusters: grant IAM permissions (create the cross-account role) as a prerequisite, then create the cluster. Retire the separate cross-account-iam-aws.adoc how-to and fold it in; its IDs are kept as page-aliases so links redirect to the create page. - nav: drop the standalone cross-account how-to entry - byoc-arch.adoc, whats-new-cloud.adoc: repoint links to the create page - cluster-types/byoc/index.adoc: note cross-account delegation for AWS The "Grant IAM permissions" section is self-contained so it can be split into a dedicated prerequisite page later if the real Terraform makes it long. Still draft: TODO(team) placeholders remain pending SME answers. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a note in the BYOC setup section so readers know the agent-based rpk cloud byoc apply flow is not the default for new AWS clusters, linking to the Provisioning models on AWS section. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Rewrite the What's New entry to lead with the benefit (simpler, more transparent deployment) rather than the feature name. Keep 'cross-account IAM delegation' in a parenthetical for searchability. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Drop the first sentence that echoed the heading; open with the concrete change instead. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Draft documentation for cross-account IAM delegation for BYOC on AWS (ENG-1139, targeted 26.2 / 2026-07-14). AWS-only, new clusters only; existing clusters and Azure/GCP keep the agent-based
rpk cloud byoc applymodel.Jira: https://redpandadata.atlassian.net/browse/DOC-2297
Changes
security:partial$iam-policies.adocfrom cloudv2apps/redpanda-agent/infra/aws/redpanda/agent/instance_profile.tf(30 statements) into friendly, anchored sections withPermission | Access | Why it is neededtables and collapsible Terraform. The published partial had drifted ~90 actions behind source; this restores full parity. GCP and Azure sections reformatted to match (same structure), and refreshed from source to close drift.byoc-arch.adoc(cross-account vs. agent-based comparison).cross-account-iam-aws.adoc(added to nav) + a cross-link TIP on the AWS create page.Status: DRAFT — not for merge
Open items are marked inline as
TODO(team)/TODO(eng), pending SME confirmation (team post + Denis's permission-justification sheet):Preview pages
Deploy preview is still building; links go live once the Netlify
deploy-previewcheck passes.🤖 Generated with Claude Code