This is the first of a few deprecation notice for shared resources in tvlk-prod legacy account. If you have any shared resources in tvlk-prod, please start planning the deprecation and if needed you can ask for help from Cloud Infra team regarding your plan.

Overview

traveloka S3 bucket is a shared bucket used by multiple product domains for multiple use cases.

In late 2018, when removing tv-s3 IAM user we identify several s3 paths/prefixes being used by product domains in traveloka S3 bucket. Some of them used exclusively by a product domain, some of them are shared between multiple product domains.

Fast forward to this year it seems only a few product migrating from this bucket to their own dedicated bucket. We reminded by this fact the hard way by incident on February 28th 2020 [1]. Therefore, Cloud Infra team is initiating deprecation of traveloka S3 bucket.

Why?

Reduce risk of incident affecting multiple products caused by unavailability of traveloka s3 bucket.
Better cost-allocation to product domain.
Having a clear ownership of data stored in S3 bucket.

Plan

[DONE] From March 9th 2020 going forward, no new AWS principals (e.g: IAM Role) will be added to traveloka S3 bucket bucket policy.
[DONE] On October 19th 2020

all write access to traveloka s3 bucket from any AWS principals will be removed from bucket policy.

[DONE] On November 30th 2020

Public access for static assets will be removed.

[DONE] On Jan 2021

Remove public access from object ACL.

[DONE] On March 31st, 2021, all read access from any AWS Principals will be removed from bucket policy.
[DONE] On April 12th 2021, we will put DENY ALL on traveloka s3 bucket policy.
On June 30th 2021, we will remove traveloka s3 bucket and its objects. There will be no backup or archive.

What do you need to do?

Please check your application code for reference to traveloka S3 bucket. You can see list of prefixes in traveloka bucket in [2] or [3].
Create new s3 bucket for your application use case. Do not mix the usage of an S3 bucket for data that contain sensitive information with data that doesn’t contain one. Please check with Information Security GRC team for data classification.
Start serving data from new bucket and migrate data that belong to your product from traveloka bucket to your new S3 bucket. Be really careful when migrating data from shared prefix.

Should you have questions or concerns regarding this deprecation please do let Cloud Infra know in #site-infra-channel.

Blog Post: https://29022131.atlassian.net/wiki/x/WIzPT

Deprecating traveloka S3 Bucket

Overview

Why?

Plan

What do you need to do?

References