hi y'all! we're looking at setting up Dagster Cloud Hybrid via the "new VPC" CloudFormation stack, and just wanted to clarify some of the required permissions. 🧵

The wildcard match is because we’re not opinionated about how you choose to name any secrets you want to expose to your agent: https://docs.dagster.io/dagster-cloud/deployment/agents/amazon-ecs/configuration-reference#environment-variables-and-secrets But in general, the quickstart template is just to get you up and running. Most of our hybrid users end up modifying it to fit their needs (changing networking, IAM permissions, capacity providers, etc.)

ok - it sounds like you're saying "by default, the agent can read all secrets, in case we need it to"?

Secrets are not required for communicating with the control plane. But they’re often necessary for your jobs to connect to any external resources. The cloudformation template biases toward quick onboarding. https://docs.dagster.io/dagster-cloud/deployment/agents/amazon-ecs/manually-provisioning-ecs-agent goes into a bit more detail about actual requirements although it too admittedly doesn’t go into detail on the minimally viable set of IAM permissions. The feedback about better documenting the template is good - I’ll make sure it gets passed along.

Thanks! We decided to manually allow-list individual secrets we want the code running in dagster to have access to (e.g., read-only access to our production DB is sufficient for now)