afterhours-shift-manager/terraform/iam.tf

# Execution, task, and EventBridge Scheduler roles for the Fargate API.

data "aws_iam_policy_document" "ecs_assume" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "jobs_scheduler_assume" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["scheduler.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "ecs_task_boundary" {
  statement {
    sid    = "DdbCrud"
    effect = "Allow"
    actions = [
      "dynamodb:BatchGetItem",
      "dynamodb:BatchWriteItem",
      "dynamodb:ConditionCheckItem",
      "dynamodb:DeleteItem",
      "dynamodb:DescribeTable",
      "dynamodb:GetItem",
      "dynamodb:PutItem",
      "dynamodb:Query",
      "dynamodb:Scan",
      "dynamodb:UpdateItem",
    ]
    resources = [
      "arn:aws:dynamodb:${var.aws_region}:${local.account_id}:table/${local.table_name}",
      "arn:aws:dynamodb:${var.aws_region}:${local.account_id}:table/${local.table_name}/index/*",
    ]
  }

  statement {
    sid       = "Secrets"
    effect    = "Allow"
    actions   = ["secretsmanager:GetSecretValue"]
    resources = ["arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:afterhours-shift-manager/*"]
  }

  statement {
    sid    = "HolidaySchedules"
    effect = "Allow"
    actions = [
      "scheduler:CreateSchedule",
      "scheduler:DeleteSchedule",
      "scheduler:GetSchedule",
    ]
    resources = ["arn:aws:scheduler:${var.aws_region}:${local.account_id}:schedule/default/holiday-*"]
  }

  statement {
    sid       = "PassHolidayScheduler"
    effect    = "Allow"
    actions   = ["iam:PassRole"]
    resources = [local.holiday_scheduler_role_arn]

    condition {
      test     = "StringEquals"
      variable = "iam:PassedToService"
      values   = ["scheduler.amazonaws.com"]
    }
  }

  statement {
    sid       = "InvokeHolidayRouter"
    effect    = "Allow"
    actions   = ["lambda:InvokeFunction"]
    resources = [local.holiday_router_arn]
  }

  statement {
    sid    = "JobsQueue"
    effect = "Allow"
    actions = [
      "sqs:SendMessage",
      "sqs:ReceiveMessage",
      "sqs:DeleteMessage",
      "sqs:GetQueueAttributes",
    ]
    resources = ["arn:aws:sqs:${var.aws_region}:${local.account_id}:${local.project}-jobs"]
  }

  dynamic "statement" {
    for_each = var.checkcomponents_queue_arn == "" ? [] : [1]
    content {
      sid       = "CheckcomponentsSend"
      effect    = "Allow"
      actions   = ["sqs:SendMessage"]
      resources = [var.checkcomponents_queue_arn]
    }
  }

  statement {
    sid       = "EcrAuth"
    effect    = "Allow"
    actions   = ["ecr:GetAuthorizationToken"]
    resources = ["*"]
  }

  statement {
    sid    = "EcrPull"
    effect = "Allow"
    actions = [
      "ecr:BatchCheckLayerAvailability",
      "ecr:BatchGetImage",
      "ecr:GetDownloadUrlForLayer",
    ]
    resources = ["arn:aws:ecr:${var.aws_region}:${local.account_id}:repository/${local.project}"]
  }

  statement {
    sid    = "TaskLogs"
    effect = "Allow"
    actions = [
      "logs:CreateLogStream",
      "logs:PutLogEvents",
      "logs:CreateLogGroup",
    ]
    resources = [
      "arn:aws:logs:${var.aws_region}:${local.account_id}:log-group:/ecs/${local.project}",
      "arn:aws:logs:${var.aws_region}:${local.account_id}:log-group:/ecs/${local.project}:*",
    ]
  }
}

resource "aws_iam_policy" "ecs_task_boundary" {
  name        = "${local.project}-ecs-task-boundary"
  path        = "/tf-managed/"
  description = "Permissions boundary for the afterhours-shift-manager ECS task role"
  policy      = data.aws_iam_policy_document.ecs_task_boundary.json
}

resource "aws_iam_role" "ecs_execution" {
  name                 = "${local.project}-ecs-exec"
  path                 = "/tf-managed/"
  assume_role_policy   = data.aws_iam_policy_document.ecs_assume.json
  permissions_boundary = aws_iam_policy.ecs_task_boundary.arn
}

resource "aws_iam_role_policy_attachment" "ecs_execution" {
  role       = aws_iam_role.ecs_execution.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

resource "aws_iam_role" "ecs_task" {
  name                 = "${local.project}-api"
  path                 = "/tf-managed/"
  assume_role_policy   = data.aws_iam_policy_document.ecs_assume.json
  permissions_boundary = aws_iam_policy.ecs_task_boundary.arn
}

resource "aws_iam_role_policy" "ecs_task" {
  name   = "api-runtime"
  role   = aws_iam_role.ecs_task.id
  policy = data.aws_iam_policy_document.ecs_task_boundary.json
}

resource "aws_iam_role" "jobs_scheduler" {
  name                 = "${local.project}-scheduler"
  path                 = "/tf-managed/"
  assume_role_policy   = data.aws_iam_policy_document.jobs_scheduler_assume.json
  permissions_boundary = aws_iam_policy.ecs_task_boundary.arn
}

data "aws_iam_policy_document" "jobs_scheduler" {
  statement {
    sid       = "SendJobs"
    effect    = "Allow"
    actions   = ["sqs:SendMessage"]
    resources = [aws_sqs_queue.jobs.arn]
  }
}

resource "aws_iam_role_policy" "jobs_scheduler" {
  name   = "enqueue-jobs"
  role   = aws_iam_role.jobs_scheduler.id
  policy = data.aws_iam_policy_document.jobs_scheduler.json
}