mirror of
https://github.com/Sea-Haven-Industries/afterhours-shift-manager.git
synced 2026-09-30 05:33:12 +00:00
cbda46ba87
Origins already point at the Fargate hostnames. Drop the HTTP API, eight functions, zip CD, and Lambda/API Gateway alarms while keeping leftover Lambda IAM so Paychex can still name weekly-post.
116 lines
3 KiB
HCL
116 lines
3 KiB
HCL
# GitHub Actions OIDC role for .github/workflows/deploy-api.yaml.
|
|
#
|
|
# One role: GitHub Environments have a single DEPLOY_ROLE_ARN. Trust is pinned
|
|
# to Environments dev and prod (immutable and classic subject forms) and
|
|
# job_workflow_ref to deploy-api.yaml at main and v*.
|
|
|
|
data "aws_iam_policy_document" "github_deploy_assume" {
|
|
statement {
|
|
sid = "GithubDeployOidc"
|
|
effect = "Allow"
|
|
actions = ["sts:AssumeRoleWithWebIdentity"]
|
|
|
|
principals {
|
|
type = "Federated"
|
|
identifiers = [local.github_oidc_provider_arn]
|
|
}
|
|
|
|
condition {
|
|
test = "StringEquals"
|
|
variable = "token.actions.githubusercontent.com:aud"
|
|
values = ["sts.amazonaws.com"]
|
|
}
|
|
|
|
condition {
|
|
test = "StringEquals"
|
|
variable = "token.actions.githubusercontent.com:sub"
|
|
values = local.github_oidc_subs
|
|
}
|
|
|
|
condition {
|
|
test = "StringLike"
|
|
variable = "token.actions.githubusercontent.com:job_workflow_ref"
|
|
values = [
|
|
"${var.github_repo}/.github/workflows/deploy-api.yaml@refs/heads/${var.github_deploy_branch}",
|
|
"${var.github_repo}/.github/workflows/deploy-api.yaml@refs/tags/v*",
|
|
]
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "aws_iam_role" "github_deploy" {
|
|
name = local.deploy_role
|
|
path = "/tf-managed/"
|
|
description = "GitHub Actions image deploy role for ${var.github_repo}"
|
|
assume_role_policy = data.aws_iam_policy_document.github_deploy_assume.json
|
|
max_session_duration = 3600
|
|
}
|
|
|
|
data "aws_iam_policy_document" "github_deploy" {
|
|
statement {
|
|
sid = "EcrAuth"
|
|
effect = "Allow"
|
|
actions = [
|
|
"ecr:GetAuthorizationToken",
|
|
]
|
|
resources = ["*"]
|
|
}
|
|
|
|
statement {
|
|
sid = "EcrPush"
|
|
effect = "Allow"
|
|
actions = [
|
|
"ecr:BatchCheckLayerAvailability",
|
|
"ecr:BatchGetImage",
|
|
"ecr:CompleteLayerUpload",
|
|
"ecr:GetDownloadUrlForLayer",
|
|
"ecr:InitiateLayerUpload",
|
|
"ecr:PutImage",
|
|
"ecr:UploadLayerPart",
|
|
"ecr:DescribeRepositories",
|
|
"ecr:DescribeImages",
|
|
]
|
|
resources = [aws_ecr_repository.api.arn]
|
|
}
|
|
|
|
statement {
|
|
sid = "EcsDeploy"
|
|
effect = "Allow"
|
|
actions = [
|
|
"ecs:DescribeServices",
|
|
"ecs:DescribeTaskDefinition",
|
|
"ecs:DescribeTasks",
|
|
"ecs:ListTasks",
|
|
"ecs:RegisterTaskDefinition",
|
|
"ecs:UpdateService",
|
|
]
|
|
resources = ["*"]
|
|
}
|
|
|
|
statement {
|
|
sid = "PassTaskRoles"
|
|
effect = "Allow"
|
|
actions = ["iam:PassRole"]
|
|
resources = [
|
|
aws_iam_role.ecs_task.arn,
|
|
aws_iam_role.ecs_execution.arn,
|
|
]
|
|
}
|
|
|
|
statement {
|
|
sid = "DeployParams"
|
|
effect = "Allow"
|
|
actions = [
|
|
"ssm:GetParameter",
|
|
]
|
|
resources = [
|
|
"arn:aws:ssm:${var.aws_region}:${local.account_id}:parameter${local.ssm_prefix}/deploy/*",
|
|
]
|
|
}
|
|
}
|
|
|
|
resource "aws_iam_role_policy" "github_deploy" {
|
|
name = "afterhours-shift-manager-deploy"
|
|
role = aws_iam_role.github_deploy.id
|
|
policy = data.aws_iam_policy_document.github_deploy.json
|
|
}
|