{"action":"created","issue":{"url":"https://api.github.com/repos/DataBiosphere/leonardo/issues/220","repository_url":"https://api.github.com/repos/DataBiosphere/leonardo","labels_url":"https://api.github.com/repos/DataBiosphere/leonardo/issues/220/labels{/name}","comments_url":"https://api.github.com/repos/DataBiosphere/leonardo/issues/220/comments","events_url":"https://api.github.com/repos/DataBiosphere/leonardo/issues/220/events","html_url":"https://github.com/DataBiosphere/leonardo/issues/220","id":301146667,"number":220,"title":"Leo SA should not need permissions on user scripts","user":{"login":"ansingh7115","id":17534065,"avatar_url":"https://avatars2.githubusercontent.com/u/17534065?v=4","gravatar_id":"","url":"https://api.github.com/users/ansingh7115","html_url":"https://github.com/ansingh7115","followers_url":"https://api.github.com/users/ansingh7115/followers","following_url":"https://api.github.com/users/ansingh7115/following{/other_user}","gists_url":"https://api.github.com/users/ansingh7115/gists{/gist_id}","starred_url":"https://api.github.com/users/ansingh7115/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ansingh7115/subscriptions","organizations_url":"https://api.github.com/users/ansingh7115/orgs","repos_url":"https://api.github.com/users/ansingh7115/repos","events_url":"https://api.github.com/users/ansingh7115/events{/privacy}","received_events_url":"https://api.github.com/users/ansingh7115/received_events","type":"User","site_admin":false},"labels":[{"id":644986405,"url":"https://api.github.com/repos/DataBiosphere/leonardo/labels/bug","name":"bug","color":"ee0701","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-02-28T19:12:18Z","updated_at":"2018-02-28T20:09:06Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"Currently, when a user specifies a script, the Leonardo service account is required to have storage.objects.get access on that object for it to run (or for the script to be public). This should not be necessary. As long as the user as access to the object, leo should be able to get the script.\n\nThis may be related to a \"get\" call leo does using the Leo SA to check if the bucket exists in the first place."},"comment":{"url":"https://api.github.com/repos/DataBiosphere/leonardo/issues/comments/369366727","html_url":"https://github.com/DataBiosphere/leonardo/issues/220#issuecomment-369366727","issue_url":"https://api.github.com/repos/DataBiosphere/leonardo/issues/220","id":369366727,"user":{"login":"rtitle","id":5368863,"avatar_url":"https://avatars3.githubusercontent.com/u/5368863?v=4","gravatar_id":"","url":"https://api.github.com/users/rtitle","html_url":"https://github.com/rtitle","followers_url":"https://api.github.com/users/rtitle/followers","following_url":"https://api.github.com/users/rtitle/following{/other_user}","gists_url":"https://api.github.com/users/rtitle/gists{/gist_id}","starred_url":"https://api.github.com/users/rtitle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rtitle/subscriptions","organizations_url":"https://api.github.com/users/rtitle/orgs","repos_url":"https://api.github.com/users/rtitle/repos","events_url":"https://api.github.com/users/rtitle/events{/privacy}","received_events_url":"https://api.github.com/users/rtitle/received_events","type":"User","site_admin":false},"created_at":"2018-02-28T20:09:06Z","updated_at":"2018-02-28T20:09:06Z","author_association":"COLLABORATOR","body":"Here is the bucket \"get\" call Leo is making as the Leo service account:\r\n\r\nhttps://github.com/DataBiosphere/leonardo/blob/develop/src/main/scala/org/broadinstitute/dsde/workbench/leonardo/service/LeonardoService.scala#L315\r\n\r\nPotential solution: do this as the service account instead."}}
{"actor":{"display_login":"rtitle"}}