mirror of
https://github.com/Sea-Haven-Industries/procurement-ingest.git
synced 2026-09-30 07:13:13 +00:00
feat(iam): import hcptf roles into app Terraform (PLAT-146)
Move the existing hcptf pair into this repo so app Terraform owns prod IAM after the substrate handoff.
This commit is contained in:
parent
decfdea723
commit
e72873409e
1 changed files with 858 additions and 0 deletions
858
terraform/hcp_iam.tf
Normal file
858
terraform/hcp_iam.tf
Normal file
|
|
@ -0,0 +1,858 @@
|
|||
# HCP plan/apply roles imported from seahaven-terraform-substrate (PLAT-146).
|
||||
# Import, do not recreate. Role names stay hcptf-procurement-ingest / hcptf-procurement-ingest-plan.
|
||||
#
|
||||
# Live seahaven-hcptf-iam-management DenySelfMutation blocks DetachRolePolicy
|
||||
# and PutRolePolicy on hcptf-* (including this role). Import apply sequence:
|
||||
# 1. seahaven-org-baseline scripts/create-hcptf-bootstrap-roles.sh
|
||||
# --account prod --allow-workspace procurement-ingest-prod
|
||||
# 2. Point this workspace's TFC_AWS_* at hcptf-bootstrap /
|
||||
# hcptf-bootstrap-plan (workspace vars, never a project set).
|
||||
# 3. One Manual apply (import + detach seahaven-hcptf-iam-management +
|
||||
# put scoped inline).
|
||||
# 4. Point TFC_AWS_* back at hcptf-procurement-ingest / hcptf-procurement-ingest-plan.
|
||||
# 5. Re-run the script without --allow-workspace to pin trust back to
|
||||
# iam-bootstrap-prod only.
|
||||
# seahaven-lambda-execution-boundary remains seahaven-lambda-execution-boundary-procurement-ingest.
|
||||
|
||||
import {
|
||||
to = aws_iam_role.hcptf_apply
|
||||
id = "hcptf-procurement-ingest"
|
||||
}
|
||||
|
||||
import {
|
||||
to = aws_iam_role.hcptf_plan
|
||||
id = "hcptf-procurement-ingest-plan"
|
||||
}
|
||||
|
||||
import {
|
||||
to = aws_iam_role_policy.hcptf_apply_services
|
||||
id = "hcptf-procurement-ingest:procurement-ingest-services"
|
||||
}
|
||||
|
||||
import {
|
||||
to = aws_iam_role_policy.hcptf_plan_refresh
|
||||
id = "hcptf-procurement-ingest-plan:procurement-ingest-plan-refresh"
|
||||
}
|
||||
|
||||
import {
|
||||
to = aws_iam_role_policy_attachments_exclusive.hcptf_apply
|
||||
id = "hcptf-procurement-ingest"
|
||||
}
|
||||
|
||||
import {
|
||||
to = aws_iam_role_policy_attachment.hcptf_plan_viewonly
|
||||
id = "hcptf-procurement-ingest-plan/arn:aws:iam::aws:policy/job-function/ViewOnlyAccess"
|
||||
}
|
||||
|
||||
import {
|
||||
to = aws_iam_role_policy_attachments_exclusive.hcptf_plan
|
||||
id = "hcptf-procurement-ingest-plan"
|
||||
}
|
||||
|
||||
data "aws_iam_policy_document" "hcptf_apply_trust" {
|
||||
statement {
|
||||
sid = "HcpApply"
|
||||
effect = "Allow"
|
||||
actions = ["sts:AssumeRoleWithWebIdentity"]
|
||||
|
||||
principals {
|
||||
type = "Federated"
|
||||
identifiers = ["arn:aws:iam::${local.account_id}:oidc-provider/app.terraform.io"]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "app.terraform.io:aud"
|
||||
values = ["aws.workload.identity"]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "app.terraform.io:sub"
|
||||
values = [
|
||||
"organization:seahaven:project:seahaven-prod:workspace:procurement-ingest-prod:run_phase:apply",
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
data "aws_iam_policy_document" "hcptf_plan_trust" {
|
||||
statement {
|
||||
sid = "HcpPlan"
|
||||
effect = "Allow"
|
||||
actions = ["sts:AssumeRoleWithWebIdentity"]
|
||||
|
||||
principals {
|
||||
type = "Federated"
|
||||
identifiers = ["arn:aws:iam::${local.account_id}:oidc-provider/app.terraform.io"]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "app.terraform.io:aud"
|
||||
values = ["aws.workload.identity"]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "app.terraform.io:sub"
|
||||
values = [
|
||||
"organization:seahaven:project:seahaven-prod:workspace:procurement-ingest-prod:run_phase:plan",
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
data "aws_iam_policy_document" "hcptf_scoped_iam" {
|
||||
statement {
|
||||
sid = "DenyCreatePolicy"
|
||||
effect = "Deny"
|
||||
actions = ["iam:CreatePolicy", "iam:CreatePolicyVersion"]
|
||||
resources = ["*"]
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "CreateExecRoleWithBoundary"
|
||||
effect = "Allow"
|
||||
actions = ["iam:CreateRole"]
|
||||
resources = ["arn:aws:iam::${local.account_id}:role/tf-managed/po-*",
|
||||
"arn:aws:iam::${local.account_id}:role/tf-managed/workorder-*",
|
||||
"arn:aws:iam::${local.account_id}:role/tf-managed/procurement-api"]
|
||||
|
||||
condition {
|
||||
test = "StringLike"
|
||||
variable = "iam:PermissionsBoundary"
|
||||
values = [
|
||||
"arn:aws:iam::${local.account_id}:policy/tf-managed/po-*",
|
||||
"arn:aws:iam::${local.account_id}:policy/tf-managed/workorder-*",
|
||||
"arn:aws:iam::${local.account_id}:policy/tf-managed/procurement-api",
|
||||
"arn:aws:iam::${local.account_id}:policy/seahaven-lambda-execution-boundary-procurement-ingest"
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "MutateExecRoleWithBoundary"
|
||||
effect = "Allow"
|
||||
actions = [
|
||||
"iam:AttachRolePolicy",
|
||||
"iam:PutRolePolicy",
|
||||
"iam:PutRolePermissionsBoundary",
|
||||
]
|
||||
resources = ["arn:aws:iam::${local.account_id}:role/tf-managed/po-*",
|
||||
"arn:aws:iam::${local.account_id}:role/tf-managed/workorder-*",
|
||||
"arn:aws:iam::${local.account_id}:role/tf-managed/procurement-api"]
|
||||
|
||||
condition {
|
||||
test = "StringLike"
|
||||
variable = "iam:PermissionsBoundary"
|
||||
values = [
|
||||
"arn:aws:iam::${local.account_id}:policy/tf-managed/po-*",
|
||||
"arn:aws:iam::${local.account_id}:policy/tf-managed/workorder-*",
|
||||
"arn:aws:iam::${local.account_id}:policy/tf-managed/procurement-api",
|
||||
"arn:aws:iam::${local.account_id}:policy/seahaven-lambda-execution-boundary-procurement-ingest"
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "WriteExecRoles"
|
||||
effect = "Allow"
|
||||
actions = [
|
||||
"iam:DeleteRole",
|
||||
"iam:DeleteRolePolicy",
|
||||
"iam:DetachRolePolicy",
|
||||
"iam:TagRole",
|
||||
"iam:UntagRole",
|
||||
"iam:UpdateAssumeRolePolicy",
|
||||
"iam:UpdateRole",
|
||||
"iam:UpdateRoleDescription",
|
||||
]
|
||||
resources = ["arn:aws:iam::${local.account_id}:role/tf-managed/po-*",
|
||||
"arn:aws:iam::${local.account_id}:role/tf-managed/workorder-*",
|
||||
"arn:aws:iam::${local.account_id}:role/tf-managed/procurement-api"]
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "PassExecRolesToLambda"
|
||||
effect = "Allow"
|
||||
actions = ["iam:PassRole"]
|
||||
resources = ["arn:aws:iam::${local.account_id}:role/tf-managed/po-*",
|
||||
"arn:aws:iam::${local.account_id}:role/tf-managed/workorder-*",
|
||||
"arn:aws:iam::${local.account_id}:role/tf-managed/procurement-api"]
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "iam:PassedToService"
|
||||
values = ["lambda.amazonaws.com"]
|
||||
}
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "IamReadOnly"
|
||||
effect = "Allow"
|
||||
actions = [
|
||||
"iam:GetPolicy",
|
||||
"iam:GetPolicyVersion",
|
||||
"iam:GetRole",
|
||||
"iam:GetRolePolicy",
|
||||
"iam:ListAttachedRolePolicies",
|
||||
"iam:ListPolicies",
|
||||
"iam:ListPolicyVersions",
|
||||
"iam:ListRolePolicies",
|
||||
"iam:ListRoles",
|
||||
]
|
||||
resources = ["*"]
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "DenySelfMutation"
|
||||
effect = "Deny"
|
||||
actions = [
|
||||
"iam:AttachRolePolicy",
|
||||
"iam:DeleteRole",
|
||||
"iam:DeleteRolePolicy",
|
||||
"iam:DeleteRolePermissionsBoundary",
|
||||
"iam:DetachRolePolicy",
|
||||
"iam:PutRolePolicy",
|
||||
"iam:PutRolePermissionsBoundary",
|
||||
"iam:UpdateAssumeRolePolicy",
|
||||
"iam:UpdateRole",
|
||||
"iam:UpdateRoleDescription",
|
||||
]
|
||||
resources = [
|
||||
"arn:aws:iam::${local.account_id}:role/hcptf-*",
|
||||
"arn:aws:iam::${local.account_id}:role/github-cfn-execution-role",
|
||||
"arn:aws:iam::${local.account_id}:role/githubdeploy-*",
|
||||
"arn:aws:iam::${local.account_id}:role/cdk-hnb659fds-*",
|
||||
"arn:aws:iam::${local.account_id}:role/OrganizationAccountAccessRole",
|
||||
"arn:aws:iam::${local.account_id}:role/seahaven-*",
|
||||
]
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "DenyBoundaryTampering"
|
||||
effect = "Deny"
|
||||
actions = [
|
||||
"iam:DeleteRolePermissionsBoundary",
|
||||
"iam:DeleteUserPermissionsBoundary",
|
||||
]
|
||||
resources = [
|
||||
"arn:aws:iam::${local.account_id}:role/*",
|
||||
"arn:aws:iam::${local.account_id}:user/*",
|
||||
]
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "DenyBoundaryPolicyEdit"
|
||||
effect = "Deny"
|
||||
actions = [
|
||||
"iam:CreatePolicyVersion",
|
||||
"iam:DeletePolicy",
|
||||
"iam:DeletePolicyVersion",
|
||||
"iam:SetDefaultPolicyVersion",
|
||||
]
|
||||
resources = ["arn:aws:iam::${local.account_id}:policy/seahaven-*"]
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy" "hcptf_apply_services" {
|
||||
name = "procurement-ingest-services"
|
||||
role = aws_iam_role.hcptf_apply.id
|
||||
policy = jsonencode({
|
||||
Version = "2012-10-17"
|
||||
Statement = [
|
||||
{
|
||||
Action = [
|
||||
"lambda:*",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:lambda:us-east-1:${local.account_id}:function:po-*",
|
||||
"arn:aws:lambda:us-east-1:${local.account_id}:function:workorder-*",
|
||||
"arn:aws:lambda:us-east-1:${local.account_id}:function:procurement-api",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "LambdaAll"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"lambda:GetEventSourceMapping",
|
||||
"lambda:ListTags",
|
||||
"lambda:TagResource",
|
||||
"lambda:UntagResource",
|
||||
]
|
||||
Resource = "*"
|
||||
Effect = "Allow"
|
||||
Sid = "LambdaEventSourceMappingRead"
|
||||
},
|
||||
{
|
||||
Condition = {
|
||||
"ForAnyValue:StringLike" = {
|
||||
"lambda:FunctionArn" = [
|
||||
"arn:aws:lambda:us-east-1:${local.account_id}:function:po-*",
|
||||
"arn:aws:lambda:us-east-1:${local.account_id}:function:workorder-*",
|
||||
"arn:aws:lambda:us-east-1:${local.account_id}:function:procurement-api",
|
||||
]
|
||||
}
|
||||
}
|
||||
Action = [
|
||||
"lambda:CreateEventSourceMapping",
|
||||
"lambda:DeleteEventSourceMapping",
|
||||
"lambda:UpdateEventSourceMapping",
|
||||
]
|
||||
Resource = "*"
|
||||
Effect = "Allow"
|
||||
Sid = "LambdaEventSourceMappings"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"lambda:ListFunctions",
|
||||
"lambda:ListEventSourceMappings",
|
||||
"lambda:GetAccountSettings",
|
||||
]
|
||||
Resource = "*"
|
||||
Effect = "Allow"
|
||||
Sid = "LambdaList"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"ssm:GetParameter",
|
||||
"ssm:GetParameters",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:ssm:us-east-1:${local.account_id}:parameter/seahaven/dynamodb/cmk-arn",
|
||||
"arn:aws:ssm:us-east-1:${local.account_id}:parameter/procurement-api/custom-domain/certificate-arn",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "SsmRead"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"logs:CreateLogGroup",
|
||||
"logs:DeleteLogGroup",
|
||||
"logs:PutRetentionPolicy",
|
||||
"logs:DeleteRetentionPolicy",
|
||||
"logs:TagResource",
|
||||
"logs:UntagResource",
|
||||
"logs:ListTagsForResource",
|
||||
"logs:PutMetricFilter",
|
||||
"logs:DeleteMetricFilter",
|
||||
"logs:DescribeMetricFilters",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:logs:us-east-1:${local.account_id}:log-group:/aws/lambda/po-*",
|
||||
"arn:aws:logs:us-east-1:${local.account_id}:log-group:/aws/lambda/workorder-*",
|
||||
"arn:aws:logs:us-east-1:${local.account_id}:log-group:/aws/lambda/procurement-api*",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "CloudWatchLogs"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"logs:DescribeLogGroups",
|
||||
]
|
||||
Resource = "*"
|
||||
Effect = "Allow"
|
||||
Sid = "CloudWatchLogsDescribe"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"s3:*",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:s3:::procurement-ingest-artifacts-${local.account_id}",
|
||||
"arn:aws:s3:::procurement-ingest-artifacts-${local.account_id}/*",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "ArtifactsBucket"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"s3:*",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:s3:::po-ingest-emails-${local.account_id}",
|
||||
"arn:aws:s3:::po-ingest-emails-${local.account_id}/*",
|
||||
"arn:aws:s3:::workorder-ingest-emails-${local.account_id}",
|
||||
"arn:aws:s3:::workorder-ingest-emails-${local.account_id}/*",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "EmailBuckets"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"dynamodb:*",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:dynamodb:us-east-1:${local.account_id}:table/purchase-orders",
|
||||
"arn:aws:dynamodb:us-east-1:${local.account_id}:table/purchase-orders/*",
|
||||
"arn:aws:dynamodb:us-east-1:${local.account_id}:table/verified-sites",
|
||||
"arn:aws:dynamodb:us-east-1:${local.account_id}:table/verified-sites/*",
|
||||
"arn:aws:dynamodb:us-east-1:${local.account_id}:table/pending-site-review",
|
||||
"arn:aws:dynamodb:us-east-1:${local.account_id}:table/pending-site-review/*",
|
||||
"arn:aws:dynamodb:us-east-1:${local.account_id}:table/work-orders",
|
||||
"arn:aws:dynamodb:us-east-1:${local.account_id}:table/work-orders/*",
|
||||
"arn:aws:dynamodb:us-east-1:${local.account_id}:table/work-order-comments",
|
||||
"arn:aws:dynamodb:us-east-1:${local.account_id}:table/work-order-comments/*",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "DynamoDBTables"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"dynamodb:ListTables",
|
||||
"dynamodb:ListStreams",
|
||||
]
|
||||
Resource = "*"
|
||||
Effect = "Allow"
|
||||
Sid = "DynamoDBList"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"sqs:*",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:sqs:us-east-1:${local.account_id}:po-ingest-*",
|
||||
"arn:aws:sqs:us-east-1:${local.account_id}:WorkorderIngestStack-*",
|
||||
"arn:aws:sqs:us-east-1:${local.account_id}:workorder-shoc-emitter-*",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "SqsQueues"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"cloudwatch:*",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:cloudwatch:us-east-1:${local.account_id}:alarm:po-*",
|
||||
"arn:aws:cloudwatch:us-east-1:${local.account_id}:alarm:workorder-*",
|
||||
"arn:aws:cloudwatch:us-east-1:${local.account_id}:alarm:procurement-api-*",
|
||||
"arn:aws:cloudwatch:us-east-1:${local.account_id}:alarm:purchase-orders-*",
|
||||
"arn:aws:cloudwatch:us-east-1:${local.account_id}:alarm:verified-sites-*",
|
||||
"arn:aws:cloudwatch:us-east-1:${local.account_id}:alarm:pending-site-review-*",
|
||||
"arn:aws:cloudwatch:us-east-1:${local.account_id}:alarm:work-orders-*",
|
||||
"arn:aws:cloudwatch:us-east-1:${local.account_id}:alarm:work-order-comments-*",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "CloudWatchAlarms"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"sns:Publish",
|
||||
"sns:GetTopicAttributes",
|
||||
"sns:ListTagsForResource",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:sns:us-east-1:${local.account_id}:site-alerts",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "SiteAlertsSns"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"apigateway:*",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:apigateway:us-east-1::/restapis/mvul1efda2",
|
||||
"arn:aws:apigateway:us-east-1::/restapis/mvul1efda2/*",
|
||||
"arn:aws:apigateway:us-east-1::/domainnames/procurement-api.seahaven.com",
|
||||
"arn:aws:apigateway:us-east-1::/domainnames/procurement-api.seahaven.com/*",
|
||||
"arn:aws:apigateway:us-east-1::/tags/*",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "ApiGateway"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"ses:CreateReceiptRule",
|
||||
"ses:UpdateReceiptRule",
|
||||
"ses:DeleteReceiptRule",
|
||||
"ses:DescribeReceiptRule",
|
||||
"ses:SetReceiptRulePosition",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:ses:us-east-1:${local.account_id}:receipt-rule-set/INBOUND_MAIL:receipt-rule/ExistingRuleSetPoEmailRuleAC8E9C87-qwGDj9lBoL1G",
|
||||
"arn:aws:ses:us-east-1:${local.account_id}:receipt-rule-set/INBOUND_MAIL:receipt-rule/ExistingRuleSetWorkorderEmailRuleEA29F845-PKtaDBvIg61a",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "SesReceiptRules"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"ses:DescribeReceiptRuleSet",
|
||||
]
|
||||
Resource = "*"
|
||||
Effect = "Allow"
|
||||
Sid = "SesDescribeRuleSet"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"kms:DescribeKey",
|
||||
"kms:GetKeyPolicy",
|
||||
"kms:GetKeyRotationStatus",
|
||||
"kms:ListResourceTags",
|
||||
"kms:PutKeyPolicy",
|
||||
"kms:EnableKeyRotation",
|
||||
"kms:DisableKeyRotation",
|
||||
"kms:ScheduleKeyDeletion",
|
||||
"kms:CancelKeyDeletion",
|
||||
"kms:TagResource",
|
||||
"kms:UntagResource",
|
||||
"kms:EnableKey",
|
||||
"kms:DisableKey",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:kms:us-east-1:${local.account_id}:key/d10fd1f0-a61a-4405-8568-85e9fd11ba18",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "ShocKms"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"kms:ListAliases",
|
||||
"kms:ListKeys",
|
||||
]
|
||||
Resource = "*"
|
||||
Effect = "Allow"
|
||||
Sid = "KmsList"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"kms:CreateAlias",
|
||||
"kms:DeleteAlias",
|
||||
"kms:UpdateAlias",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:kms:us-east-1:${local.account_id}:alias/workorder-ingest-shoc-webhook-kms",
|
||||
"arn:aws:kms:us-east-1:${local.account_id}:key/d10fd1f0-a61a-4405-8568-85e9fd11ba18",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "ShocKmsAlias"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"secretsmanager:DeleteSecret",
|
||||
"secretsmanager:DescribeSecret",
|
||||
"secretsmanager:GetResourcePolicy",
|
||||
"secretsmanager:PutResourcePolicy",
|
||||
"secretsmanager:DeleteResourcePolicy",
|
||||
"secretsmanager:TagResource",
|
||||
"secretsmanager:UntagResource",
|
||||
"secretsmanager:RotateSecret",
|
||||
"secretsmanager:CancelRotateSecret",
|
||||
"secretsmanager:UpdateSecretVersionStage",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:secretsmanager:us-east-1:${local.account_id}:secret:workorder-ingest/shoc-webhook-hmac-*",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "ShocSecretShell"
|
||||
},
|
||||
{
|
||||
Condition = {
|
||||
StringEquals = {
|
||||
"secretsmanager:Name" = "workorder-ingest/shoc-webhook-hmac"
|
||||
}
|
||||
}
|
||||
Action = [
|
||||
"secretsmanager:CreateSecret",
|
||||
]
|
||||
Resource = "*"
|
||||
Effect = "Allow"
|
||||
Sid = "ShocSecretCreate"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"secretsmanager:DescribeSecret",
|
||||
"secretsmanager:GetResourcePolicy",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:secretsmanager:us-east-1:${local.account_id}:secret:procurement-ingest/web-ui-auth-token-*",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "WebUiSecretDescribe"
|
||||
},
|
||||
]
|
||||
})
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy" "hcptf_plan_refresh" {
|
||||
name = "procurement-ingest-plan-refresh"
|
||||
role = aws_iam_role.hcptf_plan.id
|
||||
policy = jsonencode({
|
||||
Version = "2012-10-17"
|
||||
Statement = [
|
||||
{
|
||||
Action = [
|
||||
"iam:GetRole",
|
||||
"iam:GetRolePolicy",
|
||||
"iam:ListRolePolicies",
|
||||
"iam:ListAttachedRolePolicies",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:iam::${local.account_id}:role/tf-managed/po-*",
|
||||
"arn:aws:iam::${local.account_id}:role/tf-managed/workorder-*",
|
||||
"arn:aws:iam::${local.account_id}:role/tf-managed/procurement-api",
|
||||
"arn:aws:iam::${local.account_id}:role/hcptf-procurement-ingest",
|
||||
"arn:aws:iam::${local.account_id}:role/hcptf-procurement-ingest-plan",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "RefreshIamRoles"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"iam:GetPolicy",
|
||||
"iam:GetPolicyVersion",
|
||||
]
|
||||
Resource = "*"
|
||||
Effect = "Allow"
|
||||
Sid = "RefreshManagedPolicies"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"lambda:Get*",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:lambda:us-east-1:${local.account_id}:function:po-*",
|
||||
"arn:aws:lambda:us-east-1:${local.account_id}:function:workorder-*",
|
||||
"arn:aws:lambda:us-east-1:${local.account_id}:function:procurement-api",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "RefreshLambda"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"lambda:ListFunctions",
|
||||
"lambda:ListEventSourceMappings",
|
||||
"lambda:GetEventSourceMapping",
|
||||
"lambda:GetAccountSettings",
|
||||
]
|
||||
Resource = "*"
|
||||
Effect = "Allow"
|
||||
Sid = "RefreshLambdaList"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"s3:Get*",
|
||||
"s3:ListBucket",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:s3:::procurement-ingest-artifacts-${local.account_id}",
|
||||
"arn:aws:s3:::procurement-ingest-artifacts-${local.account_id}/*",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "RefreshArtifactsBucket"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"s3:Get*",
|
||||
"s3:ListBucket",
|
||||
"s3:GetBucketNotification",
|
||||
"s3:GetBucketPolicy",
|
||||
"s3:GetEncryptionConfiguration",
|
||||
"s3:GetBucketTagging",
|
||||
"s3:GetBucketVersioning",
|
||||
"s3:GetBucketPublicAccessBlock",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:s3:::po-ingest-emails-${local.account_id}",
|
||||
"arn:aws:s3:::po-ingest-emails-${local.account_id}/*",
|
||||
"arn:aws:s3:::workorder-ingest-emails-${local.account_id}",
|
||||
"arn:aws:s3:::workorder-ingest-emails-${local.account_id}/*",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "RefreshEmailBuckets"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"dynamodb:DescribeTable",
|
||||
"dynamodb:DescribeTimeToLive",
|
||||
"dynamodb:DescribeContinuousBackups",
|
||||
"dynamodb:DescribeStream",
|
||||
"dynamodb:ListTagsOfResource",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:dynamodb:us-east-1:${local.account_id}:table/purchase-orders",
|
||||
"arn:aws:dynamodb:us-east-1:${local.account_id}:table/purchase-orders/*",
|
||||
"arn:aws:dynamodb:us-east-1:${local.account_id}:table/verified-sites",
|
||||
"arn:aws:dynamodb:us-east-1:${local.account_id}:table/pending-site-review",
|
||||
"arn:aws:dynamodb:us-east-1:${local.account_id}:table/work-orders",
|
||||
"arn:aws:dynamodb:us-east-1:${local.account_id}:table/work-orders/*",
|
||||
"arn:aws:dynamodb:us-east-1:${local.account_id}:table/work-order-comments",
|
||||
"arn:aws:dynamodb:us-east-1:${local.account_id}:table/work-order-comments/*",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "RefreshDynamoDB"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"dynamodb:ListStreams",
|
||||
"dynamodb:ListTables",
|
||||
]
|
||||
Resource = "*"
|
||||
Effect = "Allow"
|
||||
Sid = "RefreshDynamoDBList"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"sqs:GetQueueAttributes",
|
||||
"sqs:GetQueueUrl",
|
||||
"sqs:ListQueueTags",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:sqs:us-east-1:${local.account_id}:po-ingest-*",
|
||||
"arn:aws:sqs:us-east-1:${local.account_id}:WorkorderIngestStack-*",
|
||||
"arn:aws:sqs:us-east-1:${local.account_id}:workorder-shoc-emitter-*",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "RefreshSqs"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"cloudwatch:DescribeAlarms",
|
||||
"cloudwatch:ListTagsForResource",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:cloudwatch:us-east-1:${local.account_id}:alarm:po-*",
|
||||
"arn:aws:cloudwatch:us-east-1:${local.account_id}:alarm:workorder-*",
|
||||
"arn:aws:cloudwatch:us-east-1:${local.account_id}:alarm:procurement-api-*",
|
||||
"arn:aws:cloudwatch:us-east-1:${local.account_id}:alarm:purchase-orders-*",
|
||||
"arn:aws:cloudwatch:us-east-1:${local.account_id}:alarm:verified-sites-*",
|
||||
"arn:aws:cloudwatch:us-east-1:${local.account_id}:alarm:pending-site-review-*",
|
||||
"arn:aws:cloudwatch:us-east-1:${local.account_id}:alarm:work-orders-*",
|
||||
"arn:aws:cloudwatch:us-east-1:${local.account_id}:alarm:work-order-comments-*",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "RefreshCloudWatchAlarms"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"apigateway:GET",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:apigateway:us-east-1::/restapis/mvul1efda2",
|
||||
"arn:aws:apigateway:us-east-1::/restapis/mvul1efda2/*",
|
||||
"arn:aws:apigateway:us-east-1::/domainnames/procurement-api.seahaven.com",
|
||||
"arn:aws:apigateway:us-east-1::/domainnames/procurement-api.seahaven.com/*",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "RefreshApiGateway"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"kms:DescribeKey",
|
||||
"kms:GetKeyPolicy",
|
||||
"kms:GetKeyRotationStatus",
|
||||
"kms:ListResourceTags",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:kms:us-east-1:${local.account_id}:key/*",
|
||||
"arn:aws:kms:us-east-1:${local.account_id}:alias/workorder-ingest-shoc-webhook-kms",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "RefreshKms"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"kms:ListAliases",
|
||||
"kms:ListKeys",
|
||||
]
|
||||
Resource = "*"
|
||||
Effect = "Allow"
|
||||
Sid = "RefreshKmsList"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"secretsmanager:DescribeSecret",
|
||||
"secretsmanager:GetResourcePolicy",
|
||||
"secretsmanager:ListSecretVersionIds",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:secretsmanager:us-east-1:${local.account_id}:secret:workorder-ingest/shoc-webhook-hmac-*",
|
||||
"arn:aws:secretsmanager:us-east-1:${local.account_id}:secret:procurement-ingest/web-ui-auth-token-*",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "RefreshSecrets"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"ssm:GetParameter",
|
||||
"ssm:GetParameters",
|
||||
]
|
||||
Resource = [
|
||||
"arn:aws:ssm:us-east-1:${local.account_id}:parameter/seahaven/dynamodb/cmk-arn",
|
||||
"arn:aws:ssm:us-east-1:${local.account_id}:parameter/procurement-api/custom-domain/certificate-arn",
|
||||
]
|
||||
Effect = "Allow"
|
||||
Sid = "RefreshSsm"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"ses:DescribeReceiptRule",
|
||||
"ses:DescribeReceiptRuleSet",
|
||||
]
|
||||
Resource = "*"
|
||||
Effect = "Allow"
|
||||
Sid = "RefreshSes"
|
||||
},
|
||||
{
|
||||
Action = [
|
||||
"logs:DescribeLogGroups",
|
||||
"logs:DescribeMetricFilters",
|
||||
"logs:ListTagsForResource",
|
||||
]
|
||||
Resource = "*"
|
||||
Effect = "Allow"
|
||||
Sid = "RefreshLogs"
|
||||
},
|
||||
]
|
||||
})
|
||||
}
|
||||
|
||||
resource "aws_iam_role" "hcptf_apply" {
|
||||
name = "hcptf-procurement-ingest"
|
||||
assume_role_policy = data.aws_iam_policy_document.hcptf_apply_trust.json
|
||||
max_session_duration = 3600
|
||||
|
||||
tags = {
|
||||
Project = "procurement-ingest"
|
||||
Owner = "adam@seahavenind.com"
|
||||
ManagedBy = "terraform"
|
||||
}
|
||||
}
|
||||
|
||||
# Empty exclusive set keeps seahaven-hcptf-iam-management detached.
|
||||
resource "aws_iam_role_policy_attachments_exclusive" "hcptf_apply" {
|
||||
role_name = aws_iam_role.hcptf_apply.name
|
||||
policy_arns = []
|
||||
}
|
||||
|
||||
resource "aws_iam_role" "hcptf_plan" {
|
||||
name = "hcptf-procurement-ingest-plan"
|
||||
assume_role_policy = data.aws_iam_policy_document.hcptf_plan_trust.json
|
||||
max_session_duration = 3600
|
||||
|
||||
tags = {
|
||||
Project = "procurement-ingest"
|
||||
Owner = "adam@seahavenind.com"
|
||||
ManagedBy = "terraform"
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy_attachment" "hcptf_plan_viewonly" {
|
||||
role = aws_iam_role.hcptf_plan.name
|
||||
policy_arn = "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess"
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy_attachments_exclusive" "hcptf_plan" {
|
||||
role_name = aws_iam_role.hcptf_plan.name
|
||||
policy_arns = [
|
||||
aws_iam_role_policy_attachment.hcptf_plan_viewonly.policy_arn,
|
||||
]
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy" "hcptf_scoped_iam" {
|
||||
name = "scoped-iam-management"
|
||||
role = aws_iam_role.hcptf_apply.id
|
||||
policy = data.aws_iam_policy_document.hcptf_scoped_iam.json
|
||||
}
|
||||
Loading…
Add table
Reference in a new issue