mirror of
https://github.com/Sea-Haven-Industries/afterhours-shift-manager.git
synced 2026-09-30 17:13:12 +00:00
8a23d06a64
* ci(workflows): call org reusable CI and Fargate CD Local CI and the image deploy duplicated the org workflows and still required ci / ci. Pin the callers to those workflows and trust the reusable deploy ref. * test(ci): probe ruff with an undefined name * test(ci): remove the undefined-name ruff probe * ci: retrigger checks after removing the ruff probe * test(ci): probe ruff with an unused import * style: apply formatter * test(ci): remove the autofix probe --------- Co-authored-by: sea-haven-auto-fix[bot] <332630863+sea-haven-auto-fix[bot]@users.noreply.github.com>
116 lines
2.9 KiB
HCL
116 lines
2.9 KiB
HCL
# GitHub Actions OIDC role for the thin deploy-api.yaml caller of
|
|
# org reusable cd-hcp-fargate.yaml.
|
|
#
|
|
# One role: GitHub Environments have a single DEPLOY_ROLE_ARN. Trust is pinned
|
|
# to Environments dev and prod. job_workflow_ref matches the reusable at any ref.
|
|
# AWS STS GitHub condition keys include job_workflow_ref, not workflow_ref.
|
|
|
|
data "aws_iam_policy_document" "github_deploy_assume" {
|
|
statement {
|
|
sid = "GithubDeployOidc"
|
|
effect = "Allow"
|
|
actions = ["sts:AssumeRoleWithWebIdentity"]
|
|
|
|
principals {
|
|
type = "Federated"
|
|
identifiers = [local.github_oidc_provider_arn]
|
|
}
|
|
|
|
condition {
|
|
test = "StringEquals"
|
|
variable = "token.actions.githubusercontent.com:aud"
|
|
values = ["sts.amazonaws.com"]
|
|
}
|
|
|
|
condition {
|
|
test = "StringEquals"
|
|
variable = "token.actions.githubusercontent.com:sub"
|
|
values = local.github_oidc_subs
|
|
}
|
|
|
|
condition {
|
|
test = "StringLike"
|
|
variable = "token.actions.githubusercontent.com:job_workflow_ref"
|
|
values = [
|
|
"Sea-Haven-Industries/.github/.github/workflows/cd-hcp-fargate.yaml@*",
|
|
]
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "aws_iam_role" "github_deploy" {
|
|
name = local.deploy_role
|
|
path = "/tf-managed/"
|
|
description = "GitHub Actions image deploy role for ${var.github_repo}"
|
|
assume_role_policy = data.aws_iam_policy_document.github_deploy_assume.json
|
|
max_session_duration = 3600
|
|
}
|
|
|
|
data "aws_iam_policy_document" "github_deploy" {
|
|
statement {
|
|
sid = "EcrAuth"
|
|
effect = "Allow"
|
|
actions = [
|
|
"ecr:GetAuthorizationToken",
|
|
]
|
|
resources = ["*"]
|
|
}
|
|
|
|
statement {
|
|
sid = "EcrPush"
|
|
effect = "Allow"
|
|
actions = [
|
|
"ecr:BatchCheckLayerAvailability",
|
|
"ecr:BatchGetImage",
|
|
"ecr:CompleteLayerUpload",
|
|
"ecr:GetDownloadUrlForLayer",
|
|
"ecr:InitiateLayerUpload",
|
|
"ecr:PutImage",
|
|
"ecr:UploadLayerPart",
|
|
"ecr:DescribeRepositories",
|
|
"ecr:DescribeImages",
|
|
]
|
|
resources = [aws_ecr_repository.api.arn]
|
|
}
|
|
|
|
statement {
|
|
sid = "EcsDeploy"
|
|
effect = "Allow"
|
|
actions = [
|
|
"ecs:DescribeServices",
|
|
"ecs:DescribeTaskDefinition",
|
|
"ecs:DescribeTasks",
|
|
"ecs:ListTasks",
|
|
"ecs:RegisterTaskDefinition",
|
|
"ecs:UpdateService",
|
|
]
|
|
resources = ["*"]
|
|
}
|
|
|
|
statement {
|
|
sid = "PassTaskRoles"
|
|
effect = "Allow"
|
|
actions = ["iam:PassRole"]
|
|
resources = [
|
|
aws_iam_role.ecs_task.arn,
|
|
aws_iam_role.ecs_execution.arn,
|
|
]
|
|
}
|
|
|
|
statement {
|
|
sid = "DeployParams"
|
|
effect = "Allow"
|
|
actions = [
|
|
"ssm:GetParameter",
|
|
]
|
|
resources = [
|
|
"arn:aws:ssm:${var.aws_region}:${local.account_id}:parameter${local.ssm_prefix}/deploy/*",
|
|
]
|
|
}
|
|
}
|
|
|
|
resource "aws_iam_role_policy" "github_deploy" {
|
|
name = "afterhours-shift-manager-deploy"
|
|
role = aws_iam_role.github_deploy.id
|
|
policy = data.aws_iam_policy_document.github_deploy.json
|
|
}
|