added cross-account OSS bucket configuration #22632
added cross-account OSS bucket configuration #22632wildpcww wants to merge 7 commits intopingcap:release-8.5from
Conversation
- Add manual backup feature with key characteristics and creation steps
- Update PITR window to 7 days for premium instances
- Fix Premium naming consistency using {{{ .premium }}} variable
- Remove manual backup limitation note since it's now supported
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Co-authored-by: Aolin <aolinz@outlook.com>
…dit logging Added documentation for configuring OSS bucket and RAM role when they are in different cloud accounts. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
ti-chi-bot
bot
added
contribution
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request enhances the TiDB Cloud documentation by providing detailed instructions for configuring Alibaba Cloud OSS buckets for audit log storage in a cross-account scenario. This addresses a common enterprise use case where resources might be distributed across different cloud accounts, ensuring that audit logs can be securely stored and accessed even when the storage bucket and the accessing role reside in separate Alibaba Cloud accounts. The changes clarify the necessary RAM and Bucket policy configurations to facilitate this secure cross-account data flow. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
ti-chi-bot
bot
added
the
size/M
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds documentation for configuring cross-account OSS bucket access for audit logs. The review suggests improvements to technical accuracy, such as correcting the bucket policy's Action from oss:GetObject to oss:PutObject and updating the Principal format. It also recommends enhancing clarity by explicitly defining account roles, using more descriptive placeholders, and providing clear replacement instructions. Additionally, the review advises adhering to the style guide by using sentence case for headings and formatting configuration parts as a numbered list.
| **Cross-Account OSS Bucket Configuration** | ||
|
|
||
| If the OSS bucket storing the audit logs and the role accessing the OSS bucket are in different cloud accounts, the configuration process is slightly different. | ||
|
|
||
| **1. RAM Policy Configuration** | ||
| When creating the RAM policy, you need to add the information of User Account 2 in the Resource field. Define the policy using the following JSON script: | ||
|
|
||
| ```json | ||
| { | ||
| "Version": "1", | ||
| "Statement": [ | ||
| { | ||
| "Effect": "Allow", | ||
| "Action": "oss:PutObject", | ||
| "Resource": "acs:oss:oss-<region>:<User Account 2>:<bucket-name>/*" | ||
| } | ||
| ] | ||
| } | ||
| ``` | ||
|
|
||
| **2. Bucket Policy Configuration** | ||
| In addition, you also need to configure a Bucket Policy on the destination OSS bucket to allow the assumed role from the different account to access it. Use the following configuration: | ||
|
|
||
| ```json | ||
| { | ||
| "Version": "1", | ||
| "Statement": [ | ||
| { | ||
| "Action": [ | ||
| "oss:GetObject" | ||
| ], | ||
| "Effect": "Allow", | ||
| "Principal": [ | ||
| "arn:sts::<User Account 1>:assumed-role/<role-name>/*" | ||
| ], | ||
| "Resource": [ | ||
| "acs:oss:*:<User Account 2>:<bucket-name>/*" | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| ``` |
There was a problem hiding this comment.
Hello! As a senior technical writer, I've reviewed this section and have a suggestion to improve its technical accuracy, clarity, and adherence to our documentation style guide.
Here's a summary of the proposed changes:
-
Technical Accuracy:
- The bucket policy's
Actionhas been corrected fromoss:GetObjecttooss:PutObject, which is required for TiDB Cloud to write audit logs. This is to ensure technical accuracy as per the style guide. - The
Principalin the bucket policy has been updated to use the correct format for an Alibaba Cloud RAM role, as the previous format appeared to be for AWS.
- The bucket policy's
-
Clarity and Readability:
- The guide now explicitly defines which account holds which resource to avoid ambiguity.
- Placeholders like
<User Account 1>have been replaced with more descriptive ones like<role-account-id>. - Added clear instructions on what to replace the placeholders with.
-
Style and Formatting:
- The heading is now in sentence case and uses a standard heading level (
#####) for better document structure. - The two configuration parts are now presented as a numbered list of steps.
- The heading is now in sentence case and uses a standard heading level (
I've provided a ready-to-commit suggestion that incorporates all these improvements. Thank you for your contribution!
##### Cross-account OSS bucket configuration
If your OSS bucket and RAM role are in different Alibaba Cloud accounts, you need to perform additional configurations for cross-account access. For the purpose of this guide, assume that the RAM role for TiDB Cloud is in `Account 1` and the OSS bucket is in `Account 2`.
1. **Configure the RAM policy in `Account 1`**
When you create the RAM policy for the role in `Account 1`, you need to specify the bucket in `Account 2` as the resource. Use the following policy:
```json
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": "oss:PutObject",
"Resource": "acs:oss:oss-<region>:<bucket-account-id>:<bucket-name>/*"
}
]
}
```
In the policy, replace `<bucket-account-id>` with the ID of `Account 2`.
2. **Configure the bucket policy in `Account 2`**
In `Account 2`, you also need to configure a bucket policy on the destination OSS bucket to grant the RAM role from `Account 1` permission to write objects. Use the following policy:
```json
{
"Version": "1",
"Statement": [
{
"Action": "oss:PutObject",
"Effect": "Allow",
"Principal": {
"RAM": [
"acs:ram::<role-account-id>:role/<role-name>"
]
},
"Resource": "acs:oss:*:<bucket-account-id>:<bucket-name>/*"
}
]
}
```
In the policy, make the following replacements:
- Replace `<role-account-id>` with the ID of `Account 1`.
- Replace `<role-name>` with the name of the RAM role you created in `Account 1`.
- Replace `<bucket-account-id>` with the ID of `Account 2`.References
- The suggested changes improve technical accuracy, clarity, and readability, as outlined in lines 14 and 16 of the repository's style guide. (link)
- The heading has been changed to sentence case to follow the style guide (line 32). (link)
- The configuration parts have been formatted as an ordered list for steps, as recommended by the style guide (line 33). (link)
|
@wildpcww: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
ti-chi-bot
bot
removed
the
missing-translation-status
lilin90
added
missing-translation-status
3 participants
First-time contributors' checklist
What is changed, added or deleted? (Required)
Which TiDB version(s) do your changes apply to? (Required)
Tips for choosing the affected version(s):
By default, CHOOSE MASTER ONLY so your changes will be applied to the next TiDB major or minor releases. If your PR involves a product feature behavior change or a compatibility change, CHOOSE THE AFFECTED RELEASE BRANCH(ES) AND MASTER.
For details, see tips for choosing the affected versions.
What is the related PR or file link(s)?
Do your changes match any of the following descriptions?