You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I love the project, I ran it and was quite surprised by the results
Using AWS console is pretty terrible experience, and without 10,000s lines of code for AWS Config Custom Rules most of the output of this tool is hidden from users!
That is to say, this simple tool saves me writing all those AWS Config custom rules!
I have a plan to produce 1000s lines of JSON for SCP, and there is no way I am going to write that by hand, so I am making a generator to produce the desired SCPs - but to code that I need to get a handle on our tags used across the organisation on all of our accounts
The only way to use this tool is to use the hardcoded config path ~/.tagger/config.ini which supports reporting on a single account, and to make this tool support multiple accounts I need to run tagger in sequence per account by programmatically creating this hardcoded config file before running tagger each time - not ideal
This is even less trivial than explained because our access is via assume-role (best practice) and tagger doesn't support IAM Roles.. meaning we need to run a separate script to prepare the ~/.aws/config with the session needed for tagger in advance also, and the session is limited to 1 hour making that other script a just-in-time execution for tagger AND tagger still may fail if it runs longer than 1 hour (which it did over night due to API rate limits)
All the above challenges are easily addressed by adding simple boto3 iam role support and a tagger config per execution. specifically:
support -c | --config-path cli argument, instead of hardcoding TAGGER_PATH and FILE_PATH
support IAM Role
support graceful IAM Role expiry and re-assume
These really just are basic things that need to be done to make tagger usable in any situation with more than a single AWS account (any AWS Organizations would have many aws accounts)
I have limited time, but I can provide limited help if these are features you want. maybe get a PR started and add in a draft of these features
The text was updated successfully, but these errors were encountered:
I love the project, I ran it and was quite surprised by the results
Using AWS console is pretty terrible experience, and without 10,000s lines of code for AWS Config Custom Rules most of the output of this tool is hidden from users!
That is to say, this simple tool saves me writing all those AWS Config custom rules!
I have a plan to produce 1000s lines of JSON for SCP, and there is no way I am going to write that by hand, so I am making a generator to produce the desired SCPs - but to code that I need to get a handle on our tags used across the organisation on all of our accounts
The only way to use this tool is to use the hardcoded config path
~/.tagger/config.ini
which supports reporting on a single account, and to make this tool support multiple accounts I need to run tagger in sequence per account by programmatically creating this hardcoded config file before running tagger each time - not idealThis is even less trivial than explained because our access is via
assume-role
(best practice) and tagger doesn't support IAM Roles.. meaning we need to run a separate script to prepare the~/.aws/config
with the session needed for tagger in advance also, and the session is limited to 1 hour making that other script a just-in-time execution for tagger AND tagger still may fail if it runs longer than 1 hour (which it did over night due to API rate limits)All the above challenges are easily addressed by adding simple boto3 iam role support and a tagger config per execution. specifically:
-c | --config-path
cli argument, instead of hardcodingTAGGER_PATH
andFILE_PATH
These really just are basic things that need to be done to make tagger usable in any situation with more than a single AWS account (any AWS Organizations would have many aws accounts)
I have limited time, but I can provide limited help if these are features you want. maybe get a PR started and add in a draft of these features
The text was updated successfully, but these errors were encountered: