Repository navigation
feat(atlassian): give a group every java.no account with all_java_no_accounts - #148
Merged
Merged
Conversation
…accounts A group in atlassian.yaml can set all_java_no_accounts to include every active managed @java.no account — everyone with a java.no Google account, since the Google Workspace user sync mirrors them into Atlassian. Meant for confluence-users, so Confluence access isn't limited to heroes. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Terraform Plan🚧 Changes detected — Plan: 0 to add, 2 to change, 231 to destroy. Plan outputLLM ReviewRisk: 🔴 HIGH Plan destroys 231 IAM resources (20 team guardrail policies, CI deploy and ECS exec roles and their inline policies/attachments) and updates 2 resources (a Lambda and its password_set policy) with 0 additions; the 205 resources after the first 28 shown in the diff were not reviewed in full, only judged by address and action, so this HIGH rating is driven by the scale of the IAM teardown.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
atlassian.py: a group withall_java_no_accounts: truealso gets every active, managed@java.noaccount. Those are exactly the Google Workspace users, because the Google user sync mirrors them into Atlassian. Unmanaged accounts on a java.no address (e.g. the olddrift@java.nologin) and inactive accounts are excluded.provision-atlassian.pypasses the flag through.atlassian_sync_applyunchanged).Why
Confluence access should cover everyone with a java.no Google account, not just
helter.Verification
confluence-users+47 / −118 (all 118 removals are personal accounts), no member missing an account, no java.no account removed.Merge order
After this applies, merge javaBin/registry#39 (it uses the flag). Note: main's apply is currently blocked behind #135's HIGH-risk destroys and needs the board override; this change rides along.
🤖 Generated with Claude Code