Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AWS trust policy limit of 2048 chars #5825

Open
huydhn opened this issue Oct 25, 2024 · 0 comments
Open

AWS trust policy limit of 2048 chars #5825

huydhn opened this issue Oct 25, 2024 · 0 comments

Comments

@huydhn
Copy link
Contributor

huydhn commented Oct 25, 2024

I learn today that AWS limits the trust policy in a OIDC role to 2048 chars https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#autoapproved, and we are going to hit that limit sooner or later in Nova upload binaries https://github.com/pytorch/test-infra/blob/main/.github/workflows/_binary_upload.yml#L82

In the current setup, a new repo onboarding to Nova will need to be added explicitly into the trust policy, i.e. D64996473, and the list will continue to grow over time. The limit can be raised to 4096 chars, but it's not a long term solution. So, we need to explore better alternatives:

  • Grant the permission to all PyTorch repos by default, i.e. repo:pytorch/*:environment:pytorchbot-env (is this a valid syntax?)
  • Split the role into multiple smaller ones, i.e. arn:aws:iam::749337293305:role/gha_workflow_nightly_build_wheels_000, arn:aws:iam::749337293305:role/gha_workflow_nightly_build_wheels_001, and try them out one by one in the workflow
  • Ask AWS for a really high limit that we are sure we are not going to hit it ever

cc @atalman @malfet @seemethere @ZainRizvi

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Status: Prioritized
Development

No branches or pull requests

1 participant