The Red Hat CKi team (https://cki-project.org/) is using the cki-artifacts user and cki-artifacts bucket in the CentOS AWS account in us-east-2 for storing public artifacts related to Fedora/CentOS/RHEL kernel testing.

$ aws sts get-caller-identity
{
    "UserId": "AIDAR2OOCKQWY7MFIIZT3",
    "Account": "125523088429",
    "Arn": "arn:aws:iam::125523088429:user/cki-artifacts"
}

Would it be possible to

• add GetBucketLifecycleConfiguration and PutBucketLifecycleConfiguration to the S3/IAM (?) policy of the cki-artifacts user/bucket
• create a new bucket cki-artifacts-us-east-1 in us-east-1 with the same policy as the cki-artifacts bucket in us-east-2
• remove the IP limitation for write access
• get a copy of both the IAM and bucket policies for our internal documentation 🙈

For the first point, we would like to automatically expire the files in the buckets via a life-cycle policy as there are currently a lot of files in the bucket 😂.

For the second point, the internal Red Hat AWS account we are using has all of its VPC resources deployed into us-east-1. Accessing out-of-region data in the cki-artifacts S3 bucket in us-east-2 from there would incur data transfer costs that we would like to avoid. For that reason, we would like to use a new S3 bucket in us-east-1 instead.

For the third point, we have started to deploy infrastructure in other places than PSI OpenShift, e.g. CentOS CI OpenShift and AWS. Currently, it is not possible to publish artifacts from those places. For that reason, we would like to remove the IP limit currently in place. As a safeguard, we have daily monitoring in place for excessive use of the buckets.