run_c3abf410da83700e

input

{
  "request": "Triage Jira ticket MZCLD-3809: JIT/PAM for GCPv1 dataops top-level folder",
  "references": [
    "https://mozilla-hub.atlassian.net/browse/MZCLD-3809"
  ],
  "sourceContext": {
    "issue": "MZCLD-3809"
  }
}

summary

MZCLD-3809 requests that the Controls team investigate a time-boxed (2-4 hour) proof-of-concept for Just-In-Time / Privileged Access Management (JIT/PAM) on the GCPv1 `dataops` top-level folder (or specific subfolders), to unblock DPE from needing Cloud Eng to run terraform plan/apply and ad-hoc backfill scripts. This is currently an unassigned Backlog item with no comments and no linked runbook/design doc. A fallback option (provisioning named firefox.gcp.mozilla.com accounts added to the datasre#admins workgroup) has already been approved by DPE/Jason if the PAM approach proves too costly to build quickly.

findings

• none

proposed actions

tool calls

[
  {
    "capability": "jira.issue.read",
    "args": {
      "key": "MZCLD-3809"
    },
    "result": {
      "key": "MZCLD-3809",
      "summary": "JIT/PAM for GCPv1 dataops top-level folder",
      "status": "Backlog",
      "description_text": "/CC As     is effectively stalled I\u2019m finding myself blocking DPE from making changes to the data platform because they need somebody to run terraform/tofu plan / apply or e.g. run scripts to overwrite stable tables for backfills. While we\u2019ve gone to some lengths to avoid handing them the keys (and footguns) associated with v1, given the stall in moving the systems to v2 I feel somewhat strongly that I\u2019m wasting both my time and DPE\u2019s time by being in the loop for most of these changes. After discussing the situation with DPE and Cloud Eng we\u2019ve identified two options for short term (this year) mitigation: Make  firefox.gcp.mozilla.com  accounts for specific DE that get added to  https://dawg.quick.mozilla.cloud/workgroup/datasre#admins This would fulfill the ancient prophecy of This would likely be a subset of  dataplatform/admins  and maybe just one or two users Bespoke JIT/PAM on the top-level  dataops  folder or perhaps specific subfolders Because this would need to be used for terraform and administration of arbitrary resources, the grants need to be fairly high privilege, e.g.  roles/bigquery.dataEditor  for    would not be sufficient has the newer  roles/admin  which probably does the trick, but note that the newer basic roles that work with JIT are in preview Cloud Eng would prefer to implement the latter mechanism if it\u2019s fairly simple to set up, but I have buy-in from DPE and approval from Jason to proceed with creating accounts if for some reason it isn\u2019t. As such this is a time-boxed request for the Controls team to investigate setting up a bespoke PAM config for the Data Platform: if this can\u2019t be done in ~2-4 hours we should provision specific accounts instead.",
      "comment_count": 0,
      "comments": []
    }
  }
]

log