docs: onboarding guide for federated private S3 backends#18
Draft
alukach wants to merge 1 commit into
Draft
Conversation
Adds a "Connect a Private S3 Bucket" guide under Using Source: how Source serves a private bucket via OIDC federation (Source stores only a role ARN, no credentials), the federation contract (issuer / audience / subject), step-by-step IAM setup, and copy-paste CloudFormation + Terraform parameterized by connection id, bucket, and prefix. Addresses source-cooperative/source.coop#330. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft. Addresses source-cooperative/source.coop#330 (app-side epic source-cooperative/source.coop#325).
What
A new Connect a Private S3 Bucket guide under Using Source (
docs/using-source/connect-private-s3.md, added to the sidebar after Access Data Through the Source Data Proxy).It covers customer onboarding for federated backends:
AssumeRoleWithWebIdentityat request time — Source stores only the role ARN, no secret at rest).https://data.source.coop, audiencesource-coop-data-proxy, subjectscv1:conn:<connection-id>:<account>/<product>(trust-policy wildcardscv1:conn:<connection-id>:*).Matches the design pivot: one fixed product-grained subject → a single trust-policy template (the original issue's "per-
subject_scope" examples are obsolete). Pairs with the in-UIsub-pattern preview in source-cooperative/source.coop#377.data.source.coop#137/#141) isn't shipped;https://data.source.coop/.well-known/openid-configurationcurrently returns 403. The guide documents an unreleased flow.aud(source-coop-data-proxy), the issuer host, and thesubformat (scv1:conn:{id}:{account}/{product}). These come from the epic design; they must match what the proxy actually mints.npm installin the sandbox) — relying on CI/preview to confirm it builds. The doc is plain.mdmatching existing conventions, and the sidebar id matches the file path.🤖 Generated with Claude Code