Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
1b42712 to
e7b878c
Compare
|
I'm starting a first review of this pull request. You can view the conversation on Warp. I completed the review and no human review was requested for this pull request. Comment Powered by Oz |
![warp-for-oss[bot]](https://avatars.githubusercontent.com/in/3450139?s=60&v=4){kind=small}
There was a problem hiding this comment.
Overview
This PR adds a new self-hosted agent data storage page, related terminology entries, and sidebar placement. The overall structure is useful, but two issues should be fixed before merge: the new page uses an unsupported callout type and the IAM examples document overly broad KMS permissions.
Concerns
- Replace the
:::warningcallout with a supported Starlight callout type. - Make the SSE-KMS permissions opt-in and key-scoped instead of telling customers to attach a default
Resource: "*"KMS statement. - Fix the isolated Admin Panel casing issue called out inline.
Security
- The sample KMS statement grants decrypt/data-key permissions over
Resource: "*"; customer-facing IAM examples should avoid broad cross-key access.
Verdict
Found: 0 critical, 2 important, 1 suggestions
Request changes
Comment /warp-agent-review on this pull request to retrigger a review (up to 3 times on the same pull request).
Powered by Oz
|
|
||
| Only team admins can connect, remap, or disconnect storage. See [Access, billing, and identity](/platform/team-access-billing-and-identity/) for more on team roles. | ||
|
|
||
| :::warning |
There was a problem hiding this comment.
:::warning is not one of the Starlight callout types used in this repo, so this callout may render incorrectly or fail validation; use :::caution for this caveat.
| :::warning | |
| :::caution |
|
|
||
| ### 4. Attach the permissions policy | ||
|
|
||
| The KMS statement applies only if you later enable SSE-KMS on the bucket; it's included by default and has no effect otherwise. |
There was a problem hiding this comment.
Resource: "*", which grants the assumed Warp role decrypt/data-key access to any IAM-authorized KMS key via S3. Make the SSE-KMS statement opt-in and scope it to the specific customer key ARN in both the JSON and Terraform examples.
| Self-hosted storage is configured in Warp's [Admin Panel](/enterprise/team-management/admin-panel/). The storage connection dialog generates the exact policies that your IAM role needs. | ||
| Open it before creating the role, so you can copy those values directly. It can be reopened at any time. | ||
|
|
||
| In the admin panel, go to the **Platform** settings tab. Under **Agent data storage**, click **Connect external storage** and choose **AWS S3**. Enter your bucket name and region in the "Bucket" and "Region" fields, and leave the dialog open — the next two steps use the policies it displays below the form. |
There was a problem hiding this comment.
💡 [SUGGESTION] Use the proper feature-name casing for Admin Panel.
| In the admin panel, go to the **Platform** settings tab. Under **Agent data storage**, click **Connect external storage** and choose **AWS S3**. Enter your bucket name and region in the "Bucket" and "Region" fields, and leave the dialog open — the next two steps use the policies it displays below the form. | |
| In the Admin Panel, go to the **Platform** settings tab. Under **Agent data storage**, click **Connect external storage** and choose **AWS S3**. Enter your bucket name and region in the "Bucket" and "Region" fields, and leave the dialog open — the next two steps use the policies it displays below the form. |
e7b878c to
2214030
Compare
2214030 to
ab1c1ad
Compare
This branch was successfully deployed
1 participant
Summary
This adds documentation for configuring self-hosted agent data storage.
It includes:
Related issues
None
Validation
Ran a local dev server
Screenshots
Follow-ups
We need to document GCS and Azure setup once those ship