Page MenuHomePhabricator

Data Platform access streamlining for WMDE staff
Closed, ResolvedPublic

Description

Opening this after discussion with @Ottomata on T380994.

In short, given the newly streamlined approval policy for direct WMF staff access to analytics-privatedata-users (T370424), the purpose of this task is to consider whether it makes sense to extend the same to WMDE staff.

As noted in T380994, these requests are going to be rarer (one data point: the last one of these access requests from a WMDE staff member appears to have been 2 months ago), so the reduction in overhead is clearly smaller.

At the same time, having different policies seems like a potential source of confusion.

Event Timeline

One thing to answer here would be how you would know who actually is WMDE staff. There used to be a public page that lists them but then that stopped existing.

One thing to answer here would be how you would know who actually is WMDE staff. There used to be a public page that lists them but then that stopped existing.

Every WMDE staff member who wants SSH access to production or any NDA-relevant LDAP group needs to have signed an NDA with the WMF Legal department. If they are not tracked in this spreadsheet, they need to first reach out to KFrancis and sign it: https://docs.google.com/spreadsheets/d/1xQNx5s2yErvayCMzvk9VkIA2ZihFXSBEhT5Z5ziCsi4

Yes, I approve streamlining the access to WMDE staff in the same way that we do for WMF staff as proposed in https://phabricator.wikimedia.org/T370424

Is there anything else to do here (are there any concerns left?), other than fixing documentation to apply this change? (I can do the doc changes for SRE and access requests on wikitech, puppet on data.yaml). I will send to some people the changes for review.

Olja approved, so no concerns left. Just needs to be implemented by fixing docs, etc. Thank you!

jcrespo triaged this task as Medium priority.

Change #1113420 had a related patch set uploaded (by Jcrespo; author: Jcrespo):

[operations/puppet@production] admin: Deploying approved policy change to puppet repo

https://gerrit.wikimedia.org/r/1113420

Change #1113420 merged by Jcrespo:

[operations/puppet@production] admin: Deploy WMDE privatedata policy change to puppet repo

https://gerrit.wikimedia.org/r/1113420

This is now applied.