Welcome to Skyplane Discussions!

[parasj]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we
  build together 💪.

To get started, comment below with an introduction of yourself and tell us about what you do with this community.

[srininadar]

could you please let me know the right policy by the least privilege principle to apply to Skyplane as a user in AWS?

[parasj]

Hi @srininadar, permissions depend on what runs on your laptop (the control plane that sets up VMs + monitors the transfer) and what permissions are delegated to the VMs.

For the control plane, we need access to configure VPC, IAM, read S3 and start VMs. For the data plane (VMs), see the skyplane-gateway IAM role which needs at minimum permission to read from the source region S3 bucket and permission to write to the destination region S3 bucket. By default, skyplane-gateway will have full S3 access permissions but you can scope this down if needed.

[srininadar]

@parasj thank you for your quick response. Currently, following policies are applied to the user Skyplane through group policies such as

• AmazonEC2FullAccess,
• AmazonS3FullAccess,
• AmazonVPCFullAccess,
• AmazonLambda_FullAccess,
• IAMFullAccess
• IAMUserChangePassword
• AWS_SSM_GetParameters ( only policy that is not predefined in AWS)

How can I further trim this down? From full-access to just what is required.

This seems to work fine at the moment to transfer the files.

[parasj]

Do you want to reduce permissions for the control plane or the data plane? I haven't done an inventory of the permissions the control plane requires so that is harder for me to limit in scope. Typically, users run the control plane on their laptop so this hasn't been a large issue in the past.

@sarahwooders do you know which of these are required for the control plane?

[srininadar]

Thanks Paras for writing. Currently, I am running skyplane manually from my account on the AWS CLI. Due to this, I need these permissions for the Skyplane account to transfer the files to work without any issues. I can be reached at [removed], if needed.

…

On Thu, Jun 22, 2023 at 2:11 PM Paras Jain ***@***.***> wrote: Do you want to reduce permissions for the control plane or the data plane? I haven't done an inventory of the permissions the control plane requires so that is harder for me to limit in scope. Typically, users run the control plane on their laptop so this hasn't been a large issue in the past. @sarahwooders <https://github.com/sarahwooders> do you know which of these are required for the control plane? — Reply to this email directly, view it on GitHub <#275 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AZMDDG7YIJMIZ3EQTWVTBDTXMSDGXANCNFSM5TLKW5BQ> . You are receiving this because you were mentioned.Message ID: ***@***.*** com>

[sarahwooders]

Hi @srininadar - I havent tested the exact permission scopes required, but I think these will probably suffice:

• Permissions for S3 multipart uploads and downloads: https://docs.aws.amazon.com/AmazonS3/latest/userguide/mpuoverview.html
• EC2: AmazonEC2FullAccess
• IAM: iam:GetRole, iam:CreateInstanceProfile, iam:AddRoleToInstanceProfile

[srininadar]

Thanks, I'll check them out, Sarah.

…

On Thu, Jun 22, 2023 at 6:00 PM Sarah Wooders ***@***.***> wrote: Hi @srininadar <https://github.com/srininadar> - I havent tested the exact permission scopes required, but I think these will probably suffice: - Permissions for S3 multipart uploads and downloads: https://docs.aws.amazon.com/AmazonS3/latest/userguide/mpuoverview.html - EC2: AmazonEC2FullAccess - IAM: iam:GetRole, iam:CreateInstanceProfile, iam:AddRoleToInstanceProfile — Reply to this email directly, view it on GitHub <#275 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AZMDDG4JHNJ7CCQZE7BYT5LXMS563ANCNFSM5TLKW5BQ> . You are receiving this because you were mentioned.Message ID: ***@***.*** com>

[srininadar]

Hi @sarahwooders

Instead of using IAMFullAccess, currently, I have the following policy:
Skyplane-IAM-Error.docx

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iam:GetRole",
"iam:CreateInstanceProfile",
"iam:AddRoleToInstanceProfile",
"iam:AttachRolePolicy",
"iam:UploadSSHPublicKey"
],
"Resource": "*"
}
]
}

[srininadar]

Fixed this error myself and have a new IAM Policy for the Skyplane. This can be published in the group somewhere.

[srininadar]

@parasj and @sarahwooders - Here is one more question to go beyond the transfer speed from current throughput rate of 666.6 MB/s between S3 buckets in AWS from Oregon region to the IAD region.

1. first of all, is it possible to ask higher speed?
2. Everytime Skyplane spawns an instance, it is of instance-type m5.8xlarge. Is there a way to control this instance-type to m6.8xlarge or so, in order to increase to higher throughput rate beyond 666.6 MB/s.

[AndreiGosman]

Hello,

Has on-prem to cloud transfer arrived to Skyplane?