The human-centric platform for production ML & AI

Outerbounds

hello ! new to Metaflow :wave: . we would like multiple developers to write flows locally then deploy with AWS step functions. is there a IAM policy somewhere for _developers_ , or any other resource I can use to come up with the list of permissions required ?  for example, <https://github.com/outerbounds/terraform-aws-metaflow/blob/5b27e962649ca371bd3eddcb6575419e7f47a253/modules/metadata-service/iam.tf#L32|here> , the metadata service needs permissions to access a KMS key and an S3 bucket, do developers need the same permissions when running say `python flow.py step-functions create`  ?

I don't think we have a very clean example but <https://github.com/outerbounds/metaflow-tools/blob/master/aws/terraform/metaflow/iam-custom-role.tf#L18|this> could be a starting point. Developers do need S3 permissions in the case of `step-functions create` since Metaflow would need to package user code and put it on S3, so the steps executing on step functions can download it and run it

the permissions you need are, broadly:
• R/W to S3 (needs KMS if bucket is encrypted)
• Permissions to launch tasks on AWS Batch if using Batch
• Permissions to create/manage step functions

(you can ignore cloudformation:* and sagemaker:* permissions in the example i linked to, those are not necessary for Metaflow to function)