004. Migration of Non-OSDU Platform Teams from OSDU Platform
Date: 03-17-2025
State: Proposed/Accepted/Deprecated/Superseded
Status: Proposed
Context
Currently, multiple team members, including those from the SDMC team, have access to the OSDU Azure platform via PIM-enabled role assignments, but they are not part of the OSDU Platform Team. For example, the osdu-data-application-team group has Privileged Identity Management (PIM) rights in our subscriptions. This setup creates an overlap where non-OSDU Platform teams are utilizing OSDU Platform Team-managed resources, leading to potential security and governance concerns.
To enforce clearer boundaries and ensure teams have their own dedicated environments, we need to migrate the SDMC team and any other teams out of our environment and into their own subscription or a separate managed environment.
Additionally, apart from group-based PIM assignments, there are other PIM-eligible roles assigned in our environments, including individual users and service principals. These assignments should also be reviewed to ensure they align with the new access structure and governance policies like for example having dedicated az_accounts for priveleged access.
Decision
We have agreed to remove the osdu-data-application-team group from our environment. The SDMC team, along with any other non-OSDU Platform teams, will need to transition to their own subscription or another managed environment. Additionally, we will review and, if necessary, remove other PIM-eligible roles assigned in our environments that are not part of the OSDU Platform Team, including individual users and service principals.
Consequences
Improved Security & Access Governance
- Removes non-OSDU Platform teams from the OSDU platform, ensuring better control over who has access.
Clearer Environment Separation
- SDMC team and any other teams will operate in a dedicated space.
⚠ Transition Planning Required
- SDMC team and any other teams must be allocated a new environment (either a new subscription or a designated alternative) before decommissioning their access to our platform.