mirror of
https://github.com/Sea-Haven-Industries/payments-dashboard.git
synced 2026-09-30 15:53:12 +00:00
0e3e95c240
Some checks are pending
Deploy / Deploy to prod (push) Waiting to run
* feat(infra): migrate payments-dashboard to HCP Terraform (PLAT-79) Replace the mgmt SAM stack with a prod-only HCP workspace using the afterhours stub-plus-zip-CD seam so GitHub Actions owns function code and Terraform owns infrastructure. * fix(infra): pin secret and CMK ARNs for bootstrap-plan hcptf-bootstrap-plan cannot ssm:GetParameter or DescribeSecret, so the first plan must not data-source those values. * fix(infra): add EIP describe and DynamoDB CMK grants for first apply Scoped apply missed ec2:DescribeAddressesAttribute and kms Encrypt/Decrypt/GenerateDataKey on the table CMK.
103 lines
2.8 KiB
HCL
103 lines
2.8 KiB
HCL
# GitHub Actions OIDC role for .github/workflows/deploy.yaml.
|
|
#
|
|
# Trust is pinned three ways: aud, sub to Environment prod (immutable and
|
|
# classic subject forms), and job_workflow_ref to deploy.yaml at
|
|
# refs/heads/main only. No v* tags until a later release ticket.
|
|
#
|
|
# Not a Lambda execution role: no permissions_boundary. Path /tf-managed/ so
|
|
# seahaven-hcptf-iam-management DenySelfMutation (role/githubdeploy-*) does not
|
|
# match.
|
|
|
|
data "aws_iam_policy_document" "github_deploy_assume" {
|
|
statement {
|
|
sid = "GithubDeployOidc"
|
|
effect = "Allow"
|
|
actions = ["sts:AssumeRoleWithWebIdentity"]
|
|
|
|
principals {
|
|
type = "Federated"
|
|
identifiers = [local.github_oidc_provider_arn]
|
|
}
|
|
|
|
condition {
|
|
test = "StringEquals"
|
|
variable = "token.actions.githubusercontent.com:aud"
|
|
values = ["sts.amazonaws.com"]
|
|
}
|
|
|
|
condition {
|
|
test = "StringEquals"
|
|
variable = "token.actions.githubusercontent.com:sub"
|
|
values = [
|
|
local.github_oidc_sub,
|
|
"repo:${var.github_repo}:environment:prod",
|
|
]
|
|
}
|
|
|
|
condition {
|
|
test = "StringEquals"
|
|
variable = "token.actions.githubusercontent.com:job_workflow_ref"
|
|
values = [
|
|
"${var.github_repo}/.github/workflows/deploy.yaml@refs/heads/${var.github_deploy_branch}",
|
|
]
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "aws_iam_role" "github_deploy" {
|
|
name = local.deploy_role
|
|
path = "/tf-managed/"
|
|
description = "GitHub Actions Lambda deploy role for ${var.github_repo} Environment prod"
|
|
assume_role_policy = data.aws_iam_policy_document.github_deploy_assume.json
|
|
max_session_duration = 3600
|
|
}
|
|
|
|
data "aws_iam_policy_document" "github_deploy" {
|
|
statement {
|
|
sid = "ListArtifactsBucket"
|
|
effect = "Allow"
|
|
actions = [
|
|
"s3:GetBucketLocation",
|
|
"s3:ListBucket",
|
|
]
|
|
resources = [aws_s3_bucket.artifacts.arn]
|
|
}
|
|
|
|
statement {
|
|
sid = "UploadFunctionArtifacts"
|
|
effect = "Allow"
|
|
actions = [
|
|
"s3:GetObject",
|
|
"s3:PutObject",
|
|
]
|
|
resources = ["${aws_s3_bucket.artifacts.arn}/functions/*"]
|
|
}
|
|
|
|
statement {
|
|
sid = "UpdateFunctionCode"
|
|
effect = "Allow"
|
|
actions = [
|
|
"lambda:GetFunction",
|
|
"lambda:GetFunctionConfiguration",
|
|
"lambda:UpdateFunctionCode",
|
|
]
|
|
resources = [for fn in local.functions : "arn:aws:lambda:${var.aws_region}:${local.account_id}:function:${fn.function_name}"]
|
|
}
|
|
|
|
statement {
|
|
sid = "DeployParams"
|
|
effect = "Allow"
|
|
actions = [
|
|
"ssm:GetParameter",
|
|
]
|
|
resources = [
|
|
"arn:aws:ssm:${var.aws_region}:${local.account_id}:parameter${local.ssm_prefix}/deploy/*",
|
|
]
|
|
}
|
|
}
|
|
|
|
resource "aws_iam_role_policy" "github_deploy" {
|
|
name = "payments-dashboard-deploy"
|
|
role = aws_iam_role.github_deploy.id
|
|
policy = data.aws_iam_policy_document.github_deploy.json
|
|
}
|