run_43b9562e9e58f623

input

{
  "request": "Triage Jira ticket SREIN-1674: Grant delete access to litellm artifacts in llm-proxy-prod (moz-fx-llm-proxy-prod-b0b8)",
  "references": [
    "https://mozilla-hub.atlassian.net/browse/SREIN-1674"
  ],
  "sourceContext": {
    "issue": "SREIN-1674"
  }
}

summary

SREIN-1674 requests either a permanent/temporary IAM grant of artifactregistry.versions.delete on the moz-fx-llm-proxy-prod-b0b8 (llm-proxy-prod repo) to ndelangel@mozilla.com, or that SRE delete 5 specific mistakenly-copied litellm image digests on their behalf. This is a production Artifact Registry repo, so the request should be treated as a least-privilege access request with a preference for time-boxed access or SRE-performed deletion rather than a permanent grant. Ticket has no comments yet and is still in Backlog with a stated deadline of Thu Aug 6.

findings

• none

proposed actions

Thanks for the detailed request. Given this stems from a one-time accidental copy of 5 specific artifact digests into the prod GAR repo (moz-fx-llm-proxy-prod-b0b8/llm-proxy-prod), we recommend option (b): SRE will delete the 5 listed digests (d5233c80ef7e, 021f8946bb5a, 5cb30aa04902, 582bd3ef3839, 1cccdf103988) on your behalf rather than granting a standing or even time-boxed artifactregistry.versions.delete IAM role on a production repo. This follows least-privilege practice and avoids leaving delete access on prod artifacts after the cleanup is done. Could you confirm: (1) these are the only artifacts affected, (2) no downstream consumers/pipelines have pulled these images since they were pushed, and (3) get a quick +1 from your AI Platform Services Team lead/manager on this deletion? Once confirmed, an SRE with existing prod Artifact Registry admin rights can perform the deletion ahead of your Aug 6 deadline. If there's a recurring need for your team to manage artifacts in this repo going forward, please open a separate request scoped to a non-prod staging repo or propose a narrowly-scoped, time-limited custom role instead of versions.delete on prod.

tool calls

[
  {
    "capability": "jira.issue.read",
    "args": {
      "key": "SREIN-1674"
    },
    "result": {
      "key": "SREIN-1674",
      "summary": "Grant delete access to litellm artifacts in llm-proxy-prod (moz-fx-llm-proxy-prod-b0b8)",
      "status": "Backlog",
      "description_text": "Service: oogle Cloud IAM / Artifact Registry \u2014  moz-fx-llm-proxy-prod-b0b8 , repository  us-docker.pkg.dev/moz-fx-llm-proxy-prod-b0b8/llm-proxy-prod/litellm Engineering Team: AI Platform Services Team \u2014  ndelangel@mozilla.com     Details and Context:  While testing a new automation script that copies litellm artifacts, I mistakenly copied several into the prod GAR repo above. I need to remove them. The images which need to be removed are included within the screenshot   When I click on request access this is the link which google could provides me.  console.cloud.google.com/iam-admin/troubleshooter/summary;permissions=artifactregistry.versions.delete;token=AZRajuV08W3eQq9Nxax0Tz3-ofJg5KsV9aZekWQ1lNSzDsRkYqp-wTM6GkII43IlJUBDlOtMxtZyUY4a2l6QldGCjBShF5tcyQmFz06JVyynpYzAipE6tkza-HvAdyswpu_5g8btRcy9RXuAtZ_3O1OLPu88eXzBWDfZOjArsbE9txMxVnfJ2WOt3vv2GEg972S1-CJSxKgfqxkbx1KPWRMANUpm0cqWPe_VbqkKP39a3g4IJy8?utm_campaign=role_request&utm_source=cloud_console   I have attached a screenshot below which demonstrates me trying to perform the action.   Request:  Either (a) grant artifactregistry.versions.delete on the  llm-proxy-prod  repository to  ndelangel@mozilla.com  \u2014 permanently / for 5 days \u2014 or (b) delete the following artifacts on my behalf: d5233c80ef7e, 021f8946bb5a, 5cb30aa04902, 582bd3ef3839, 1cccdf103988.   Deadline: Thursday August 6th",
      "comment_count": 0,
      "comments": []
    }
  }
]

log