Currently the membership of cn=wmf and cn=nda grants access to Logstash. This access is fairly sensitive and by far not anyone who's in these groups for other reasons actually needs Logstash. As such, the plan is to split it out to a separate group cn=logstash-access.
Next steps:
- Create the group
- Generate an initial list of users who have access Logstash in the last X days
- Create a process to request users to cn=logstash-access for those who don't have it yet (eventually this will be implemened in Bitu/idm.wikimedia.org, but in the interim probably via Clinic Duty)