From ecba68f92b0e6b8cdd8e00a10818b66a7bc9116a Mon Sep 17 00:00:00 2001 From: yh-noh Date: Tue, 6 Oct 2026 15:09:25 +0900 Subject: [PATCH] =?UTF-8?q?fix(env):=20AWS=5FIDENTITY=5FPROVIDER=5FARN?= =?UTF-8?q?=C2=B7ROLE=5FARN=EC=9D=84=20mc-iam-manager=20.env.setup=20?= =?UTF-8?q?=EC=A0=95=EC=9D=98=EC=99=80=20=EC=9D=BC=EC=B9=98?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - PROVIDER_ARN이 내부 Keycloak 호스트(MC_IAM_MANAGER_KEYCLOAK_DOMAIN)와 OIDC 클라이언트명으로 조합되던 것을 PUBLIC_DOMAIN/auth/realms/REALM으로 변경 - ROLE_ARN 역할명을 MC_IAM_MANAGER_CSP_ROLE_PREFIX 기반으로 변경 - ARN 블록을 MC_IAM_MANAGER_PUBLIC_DOMAIN 정의 뒤로 이동 (dotenv 순차 치환) --- conf/docker/.env.setup | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/conf/docker/.env.setup b/conf/docker/.env.setup index 434c5b3..792abf1 100644 --- a/conf/docker/.env.setup +++ b/conf/docker/.env.setup @@ -158,8 +158,6 @@ MC_IAM_MANAGER_DEFAULT_WORKSPACE_NAME=ws01 MC_IAM_MANAGER_AWS_STS_ENDPOINT=https://sts.amazonaws.com MC_IAM_MANAGER_AWS_ACCOUNT_ID=notyet -MC_IAM_MANAGER_AWS_IDENTITY_PROVIDER_ARN=arn:aws:iam::${MC_IAM_MANAGER_AWS_ACCOUNT_ID}:oidc-provider/${MC_IAM_MANAGER_KEYCLOAK_DOMAIN}/realms/${MC_IAM_MANAGER_KEYCLOAK_OIDC_CLIENT_NAME} -MC_IAM_MANAGER_AWS_IDENTITY_ROLE_ARN=arn:aws:iam::${MC_IAM_MANAGER_AWS_ACCOUNT_ID}:role/mciam-platformadmin MC_IAM_MANAGER_CSP_ROLE_PREFIX=mciam @@ -172,6 +170,10 @@ MC_IAM_MANAGER_PUBLIC_DOMAIN=mciam.local MC_IAM_MANAGER_PUBLIC_HOST=https://${MC_IAM_MANAGER_PUBLIC_DOMAIN} MC_IAM_MANAGER_PUBLIC_KEYCLOAK_HOST=${MC_IAM_MANAGER_PUBLIC_HOST}/auth +# === AWS IAM ARN (auto-composed from MC_IAM_MANAGER_PUBLIC_DOMAIN / MC_IAM_MANAGER_AWS_ACCOUNT_ID) === +MC_IAM_MANAGER_AWS_IDENTITY_PROVIDER_ARN=arn:aws:iam::${MC_IAM_MANAGER_AWS_ACCOUNT_ID}:oidc-provider/${MC_IAM_MANAGER_PUBLIC_DOMAIN}/auth/realms/${MC_IAM_MANAGER_KEYCLOAK_REALM} +MC_IAM_MANAGER_AWS_IDENTITY_ROLE_ARN=arn:aws:iam::${MC_IAM_MANAGER_AWS_ACCOUNT_ID}:role/${MC_IAM_MANAGER_CSP_ROLE_PREFIX}-platformadmin + # === nginx HTTPS Reverse Proxy Ports (for iframe/external access — same as direct published ports) === MC_OBSERVABILITY_FRONT_PROXY_PORT=18081 MC_OBSERVABILITY_FRONT_PUBLIC_HOST=https://${MC_IAM_MANAGER_PUBLIC_DOMAIN}:${MC_OBSERVABILITY_FRONT_PROXY_PORT}