👋 Love ESC so far ❤️ One pain point we have is permission with "import". If we have a

parent

environment, which imports a few children, e.g.

child1

,

child2

, and then define a role to be able to "open"

parent

, we would need to allow the role to access all children one by one. It becomes trickier when

child3

is imported. Sometimes we forget the step to allow the role to access

child3

because we just assume having access

parent

implicitly grants permission to all imported environments When we use External Secrets Operator to sync

parent

to the cluster via an access token, we would get a

400

error in such case, which sometime result in long time debugging Any suggestion?

Let me check with the team and see if we have any best practices defined here.

👋 hey @rich-whale-93740 happy to hear you are loving ESC 🙌 I do get the import model and permissions can be tricky and seems like providing better error messaging on permissions might be helpful (although tricky as well0 Have you considered using Teams instead of relying on roles assigned to individuals? This might simplify how you deal with each child (so when you define a new child, you give permission to open to the team)

Thanks for following up! Hmm... this approach similar though. When a new child is added, we need to assign it to the role. For team, that would be the same.

Yes, I understand it’s not ideal, in the future we are planning to extend our authorization game via ABAC which for sure make these cases simpler. In the meantime. The benefit is that you’ll get it for all the team members at once. You can also combine it with an automation using psp to cascade the assignments, although you’ll still will need to manually maintain the imported list

.import * as pulumiservice from "@pulumi/pulumiservice";

const envFamily = ["parent", "child1", "child2", "child3"];

envFamily.forEach(env => {
  new pulumiservice.TeamEnvironmentPermission(`perm-${env}`, {
    organization: "myorg",
    project: "myproject",
    environment: env,
    team: "backend-team",
    permission: pulumiservice.EnvironmentPermission.Open,
  });
});