mirror of
https://github.com/Sea-Haven-Industries/meal-order-manager.git
synced 2026-09-30 20:33:13 +00:00
f7957436bd
* fix(iam): drop githubdeploy workflow_ref OIDC condition AWS STS does not evaluate GitHub workflow_ref, so that trust condition fail-closes AssumeRoleWithWebIdentity. * chore(security): retarget githubdeploy Checkov suppression Dropping the workflow_ref trust condition shifted CKV_AWS_111 from line 49 to 42. Permissions are unchanged. * style: apply formatter --------- Co-authored-by: sea-haven-auto-fix[bot] <5037331+sea-haven-auto-fix[bot]@users.noreply.github.com>
131 lines
3.5 KiB
HCL
131 lines
3.5 KiB
HCL
# GitHub Actions OIDC role for the thin deploy-api.yaml caller of
|
|
# org reusable cd-hcp-fargate.yaml.
|
|
|
|
data "aws_iam_policy_document" "github_deploy_assume" {
|
|
statement {
|
|
sid = "GithubDeployOidc"
|
|
effect = "Allow"
|
|
actions = ["sts:AssumeRoleWithWebIdentity"]
|
|
|
|
principals {
|
|
type = "Federated"
|
|
identifiers = [local.github_oidc_provider_arn]
|
|
}
|
|
|
|
condition {
|
|
test = "StringEquals"
|
|
variable = "token.actions.githubusercontent.com:aud"
|
|
values = ["sts.amazonaws.com"]
|
|
}
|
|
|
|
condition {
|
|
test = "StringEquals"
|
|
variable = "token.actions.githubusercontent.com:sub"
|
|
values = [
|
|
"repo:Sea-Haven-Industries/meal-order-manager:environment:dev",
|
|
"repo:Sea-Haven-Industries/meal-order-manager:environment:prod",
|
|
]
|
|
}
|
|
|
|
# AWS STS GitHub condition keys include job_workflow_ref, not workflow_ref.
|
|
# A workflow_ref condition fail-closes AssumeRoleWithWebIdentity.
|
|
condition {
|
|
test = "StringLike"
|
|
variable = "token.actions.githubusercontent.com:job_workflow_ref"
|
|
values = [
|
|
"Sea-Haven-Industries/.github/.github/workflows/cd-hcp-fargate.yaml@*",
|
|
]
|
|
}
|
|
}
|
|
}
|
|
|
|
data "aws_iam_policy_document" "github_deploy" {
|
|
statement {
|
|
sid = "EcrAuth"
|
|
effect = "Allow"
|
|
actions = [
|
|
"ecr:GetAuthorizationToken",
|
|
]
|
|
resources = ["*"]
|
|
}
|
|
|
|
statement {
|
|
sid = "EcrPush"
|
|
effect = "Allow"
|
|
actions = [
|
|
"ecr:BatchCheckLayerAvailability",
|
|
"ecr:BatchGetImage",
|
|
"ecr:CompleteLayerUpload",
|
|
"ecr:GetDownloadUrlForLayer",
|
|
"ecr:InitiateLayerUpload",
|
|
"ecr:PutImage",
|
|
"ecr:UploadLayerPart",
|
|
"ecr:DescribeRepositories",
|
|
"ecr:DescribeImages",
|
|
]
|
|
resources = [aws_ecr_repository.api.arn]
|
|
}
|
|
|
|
statement {
|
|
sid = "EcsDeploy"
|
|
effect = "Allow"
|
|
actions = [
|
|
"ecs:DescribeServices",
|
|
"ecs:DescribeTaskDefinition",
|
|
"ecs:DescribeTasks",
|
|
"ecs:ListTasks",
|
|
"ecs:RegisterTaskDefinition",
|
|
"ecs:UpdateService",
|
|
]
|
|
resources = ["*"]
|
|
}
|
|
|
|
statement {
|
|
sid = "PassTaskRoles"
|
|
effect = "Allow"
|
|
actions = ["iam:PassRole"]
|
|
resources = [
|
|
aws_iam_role.ecs_task.arn,
|
|
aws_iam_role.ecs_execution.arn,
|
|
]
|
|
}
|
|
|
|
statement {
|
|
sid = "DeployParams"
|
|
effect = "Allow"
|
|
actions = [
|
|
"ssm:GetParameter",
|
|
]
|
|
resources = [
|
|
aws_ssm_parameter.deploy_cluster.arn,
|
|
aws_ssm_parameter.deploy_service.arn,
|
|
aws_ssm_parameter.deploy_task_family.arn,
|
|
aws_ssm_parameter.deploy_ecr_repository.arn,
|
|
aws_ssm_parameter.deploy_container_name.arn,
|
|
aws_ssm_parameter.deploy_form_url.arn,
|
|
aws_ssm_parameter.deploy_api_url.arn,
|
|
]
|
|
}
|
|
}
|
|
|
|
resource "aws_iam_policy" "github_deploy_boundary" {
|
|
name = "${local.project}-githubdeploy-boundary"
|
|
path = "/tf-managed/"
|
|
description = "Permissions boundary for githubdeploy-meal-order-manager"
|
|
policy = data.aws_iam_policy_document.github_deploy.json
|
|
}
|
|
|
|
resource "aws_iam_role" "github_deploy" {
|
|
name = "githubdeploy-meal-order-manager"
|
|
path = "/tf-managed/"
|
|
description = "GitHub Actions API image deploy for meal-order-manager"
|
|
assume_role_policy = data.aws_iam_policy_document.github_deploy_assume.json
|
|
permissions_boundary = aws_iam_policy.github_deploy_boundary.arn
|
|
max_session_duration = 3600
|
|
}
|
|
|
|
resource "aws_iam_role_policy" "github_deploy" {
|
|
name = "api-image-deploy"
|
|
role = aws_iam_role.github_deploy.id
|
|
policy = data.aws_iam_policy_document.github_deploy.json
|
|
}
|