Skip to content

Set AWS_REQUEST_PAYER for DAAC access #453

@anayeaye

Description

@anayeaye

What

Use requester pays configuration for DAAC bucket access.

Background

  1. IAM role based read access has been negotiated with some DAAC bucket owners for VEDA* services
  2. We also use this role to restrict which buckets can be read by the role (security purposes for public tiler)
  3. These in-region DAACs also require AWS_REQUEST_PAYER=requester
  4. We have blanket applied this parameter for veda-backend instances that require DAAC bucket access https://github.com/NASA-IMPACT/veda-backend/blob/1370e3645f4f11c91996a15a626db8707f3bfcb5/raster_api/infrastructure/construct.py#L79

Related issues

https://github.com/NASA-IMPACT/veda-architecture/issues/767
https://github.com/US-GHG-Center/ghgc-architecture/issues/914

AC

  • Discovery DAG can access protected DAAC bucket
  • Investigate if we'd incur cost if we used REQUESTER_PAYS for our own buckets and provide findings in this issue/notify team

Metadata

Metadata

Labels

No labels
No labels

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions