Tutor plugin: configuration

All plugin settings are Tutor variables prefixed with PANORAMA_. Set them with tutor config save --set PANORAMA_...=value. This page lists the variables and the AWS permissions needed for CUSTOM mode.

Important

The plugin follows Open edX’s named releases, and its default values can change between release lines. The defaults below are for the Sumac (19.x) line; where a value differs on the Teak (21.x+) line it is annotated. Some variables also exist on only one line. Always confirm the effective value for your installed version with:

tutor config printvalue PANORAMA_MODE
tutor plugins list          # shows the installed panorama plugin version

Use the plugin version that matches your Open edX release.

Configuration variables

Variable

Default

Description

PANORAMA_MODE

DEMO

Panorama mode: DEMO, FREE, SAAS, or CUSTOM. See Tutor plugin: installation and modes.

PANORAMA_BUCKET

(empty)

S3 bucket that stores the raw extracted data. Required in CUSTOM mode.

PANORAMA_RAW_LOGS_BUCKET

PANORAMA_BUCKET

S3 bucket for the tracking logs.

PANORAMA_BASE_PREFIX

openedx

Subdirectory inside the bucket that holds the raw data.

PANORAMA_AWS_ACCOUNT_ID

(empty)

AWS account ID that owns the data lake and QuickSight.

PANORAMA_REGION

us-east-1

AWS region.

PANORAMA_DATALAKE_DATABASE

panorama

Athena database name.

PANORAMA_DATALAKE_WORKGROUP

panorama

Athena workgroup name.

PANORAMA_AWS_ACCESS_KEY

OPENEDX_AWS_ACCESS_KEY

AWS access key (defaults to the Open edX AWS key).

PANORAMA_AWS_SECRET_ACCESS_KEY

OPENEDX_AWS_SECRET_ACCESS_KEY

AWS secret key (defaults to the Open edX AWS secret).

PANORAMA_MFE_ENABLED

True

Enable the Panorama MFE. Also gates installing the backend into the openedx image.

PANORAMA_ADD_DASHBOARD_LINK

False

Sumac (19.x) line only. Replace the learner-dashboard MFE with a fork that adds a link to Panorama. Removed on Teak (21.x+), where the plugin registers the Panorama MFE directly and no longer swaps the learner dashboard.

PANORAMA_DEFAULT_USER_ARN

arn:aws:quicksight:{REGION}:{ACCOUNT_ID}:user/default/{LMS_HOST}

QuickSight user ARN to map users to by default.

PANORAMA_ENABLE_STUDENT_VIEW

True

Allow students to access the student panel.

PANORAMA_MFE_PORT

2100

Internal port of the Panorama MFE.

PANORAMA_CRONTAB

55 * * * *

Cron schedule for the periodic dataset update.

PANORAMA_USE_SPLIT_MONGO

True

Set to False for Open edX versions older than Maple.

PANORAMA_FLB_LOG_LEVEL

info

Fluent Bit logging level (tracking-log shipping).

PANORAMA_RUN_K8S_FLUENTBIT

True

On Kubernetes, run the Fluent Bit DaemonSet. Leave only one namespace running it.

PANORAMA_DEBUG

False

Run the ELT agent in verbose debug mode.

PANORAMA_LOGS_TOTAL_FILE_SIZE

1M (Sumac 19.x); 50M (Teak 21.x+)

Log file size threshold before upload.

PANORAMA_LOGS_UPLOAD_TIMEOUT

15m (Sumac 19.x); 10m (Teak 21.x+)

Maximum time before log files are uploaded even if under the size limit.

PANORAMA_LOGS_UPLOAD_CHUNK_SIZE

10M (Teak 21.x+ only)

Multipart upload chunk size for tracking logs. Not present on the Sumac (19.x) line.

PANORAMA_K8S_JOB_MEMORY_REQUEST / PANORAMA_K8S_JOB_MEMORY_LIMIT

(empty)

Memory request/limit for the Panorama job on Kubernetes. Use only if pods are OOM-killed.

Note

By default PANORAMA_AWS_ACCESS_KEY and PANORAMA_AWS_SECRET_ACCESS_KEY inherit the Open edX AWS credentials. In CUSTOM mode, point them at the dedicated Panorama IAM user instead of reusing broad credentials.

CUSTOM mode: the AWS data lake

The plugin is configured to work with an AWS data lake. In CUSTOM mode you provide it. Create:

  • an IAM user or role with access to the S3 buckets, KMS (if encrypted), Glue, and Athena;

  • an S3 bucket for the data (PANORAMA_BUCKET), optionally one for raw logs (PANORAMA_RAW_LOGS_BUCKET), and one for the Athena query results;

  • the Athena database (CREATE DATABASE panorama) and a panorama workgroup whose query result location is the results bucket.

Then connect Amazon QuickSight to Athena to visualize the data. See Extract and Load: setting up the data lake for the underlying resource details.

IAM permissions

The plugin’s README ships a scoped policy for the panorama-elt user. Replace the bucket, region, and account placeholders with your values. It grants:

  • s3:PutObject on <data bucket>/openedx/* and <logs bucket>/tracking_logs/* (the extraction and tracking-log upload paths);

  • s3:PutObject and s3:DeleteObject on <data bucket>/PanoramaConnectionTest (the connection test object);

  • s3:GetBucketLocation, s3:PutObject, and s3:GetObject on the <athena results bucket> (and its contents);

  • the Glue and Athena actions needed to create and update tables, partitions, and run queries, scoped to the panorama workgroup, database, catalog, and tables; and

  • kms:GenerateDataKey and kms:Decrypt if the buckets are KMS-encrypted.

Important

Additionally, the user must have AWS Lake Formation permissions to access the data locations and to query the database and all tables. Without them, Glue/Athena calls can succeed at the IAM layer but still be denied by Lake Formation.

For the exact JSON, see the plugin’s README.rst. Note that this scoped policy is preferable to the broad s3:* form; see the least-privilege guidance in Extract and Load: setting up the data lake.

Back to Home