[IT-3953] disable SameRegionResourceAccessToBucket

[zaro0508]

issue https://sagebionetworks.jira.com/browse/IT-3953 caused the AWS deployment to fail so we need to temporarily disable SameRegionResourceAccessToBucket

[brucehoff]

The error you put in IT-3953 says, "failed to create RestrictBucketDownloadRegionFunction". If the currently existing buckets already have the IPAddressRestictionLambda, why are they affected by a failure to create the Lambda? Shouldn't the problem affect only new buckets?

If we merge this PR then seven buckets will lose their protection against costly egress. How is this risk mitigated?

[zaro0508]

The error you put in IT-3953 says, "failed to create RestrictBucketDownloadRegionFunction". If the currently existing buckets already have the IPAddressRestictionLambda, why are they affected by a failure to create the Lambda? Shouldn't the problem affect only new buckets?

It's affecting existing buckets because there was a change to update tags on existing buckets.

If we merge this PR then seven buckets will lose their protection against costly egress. How is this risk mitigated?

There are PRs in this repo waiting to merge so my idea was to temporarily disable RestrictBucketDownloadRegionFunction to keep deployments working. The alternative is to fix IT-3953 instead of temporarily disabling RestrictBucketDownloadRegionFunction. Another alternative is to manually deploy PRs until we fix IT-3953. Is there an option that you prefer @brucehoff ?

[brucehoff]

The error you put in IT-3953 says, "failed to create RestrictBucketDownloadRegionFunction". If the currently existing buckets already have the IPAddressRestictionLambda, why are they affected by a failure to create the Lambda? Shouldn't the problem affect only new buckets?

It's affecting existing buckets because there was a change to update tags on existing buckets.

If we merge this PR then seven buckets will lose their protection against costly egress. How is this risk mitigated?

There are PRs in this repo waiting to merge so my idea was to temporarily disable RestrictBucketDownloadRegionFunction to keep deployments working. The alternative is to fix IT-3953 instead of temporarily disabling RestrictBucketDownloadRegionFunction. Another alternative is to manually deploy PRs until we fix IT-3953. Is there an option that you prefer @brucehoff ?

Thank you for presenting these options. As suggested in our meeting today, can you please prioritize fixing IT-3953?

[zaro0508]

replaced with PRs Sage-Bionetworks/aws-infra#416 and #649