seahaven-org-baseline/lib/seahaven-site-hcptf-stack.ts

import * as cdk from "aws-cdk-lib";
import * as iam from "aws-cdk-lib/aws-iam";
import { Construct } from "constructs";

/**
 * Prod exec roles for the seahaven-site HCP workspace (PLAT-225).
 *
 * These roles already exist and were imported into this stack. Do not
 * create them. A plain create fails because the roles already exist.
 * The stack is on the prod deploy job.
 *
 * Import identifiers were the role names `hcptf-seahaven-site` and
 * `hcptf-seahaven-site-plan`.
 */
export class SeahavenSiteHcptfStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: cdk.StackProps) {
    super(scope, id, props);

    const account = this.account;
    const deployRole = `arn:aws:iam::${account}:role/tf-managed/githubdeploy-seahaven-site`;
    const boundary = `arn:aws:iam::${account}:policy/tf-managed/seahaven-site-githubdeploy-boundary`;
    const bucket = "arn:aws:s3:::seahaven-site-prod";
    const functionArn = `arn:aws:cloudfront::${account}:function/seahaven-site-prod-directory-index`;
    const deployParams = `arn:aws:ssm:us-east-1:${account}:parameter/seahaven-site/deploy/*`;
    const wafParam = `arn:aws:ssm:us-east-1:${account}:parameter/seahaven/waf/app-web-acl-arn`;
    const githubOidc = `arn:aws:iam::${account}:oidc-provider/token.actions.githubusercontent.com`;
    const hcpOidc = `arn:aws:iam::${account}:oidc-provider/app.terraform.io`;

    const apply = new iam.CfnRole(this, "ApplyRole", {
      roleName: "hcptf-seahaven-site",
      maxSessionDuration: 3600,
      assumeRolePolicyDocument: trust(hcpOidc, "apply"),
      managedPolicyArns: [],
      policies: [
        {
          policyName: "seahaven-site-services",
          policyDocument: servicesPolicy(bucket, deployParams, wafParam, githubOidc),
        },
        {
          policyName: "scoped-iam-management",
          policyDocument: scopedIamPolicy(account, deployRole, boundary),
        },
      ],
      tags: roleTags(),
    });
    retain(apply);

    const plan = new iam.CfnRole(this, "PlanRole", {
      roleName: "hcptf-seahaven-site-plan",
      maxSessionDuration: 3600,
      assumeRolePolicyDocument: trust(hcpOidc, "plan"),
      managedPolicyArns: ["arn:aws:iam::aws:policy/job-function/ViewOnlyAccess"],
      policies: [
        {
          policyName: "seahaven-site-plan-refresh",
          policyDocument: planPolicy(
            account,
            bucket,
            functionArn,
            deployParams,
            wafParam,
            githubOidc,
            deployRole,
            boundary,
          ),
        },
      ],
      tags: roleTags(),
    });
    retain(plan);

    cdk.Tags.of(this).add("Project", "seahaven-site");
    cdk.Tags.of(this).add("Owner", "adam@seahavenind.com");
    cdk.Tags.of(this).add("ManagedBy", "cdk");
  }
}

function retain(role: iam.CfnRole): void {
  role.cfnOptions.deletionPolicy = cdk.CfnDeletionPolicy.RETAIN;
  role.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
}

function roleTags(): cdk.CfnTag[] {
  return [
    { key: "Project", value: "seahaven-site" },
    { key: "Owner", value: "adam@seahavenind.com" },
    { key: "ManagedBy", value: "cdk" },
  ];
}

function trust(providerArn: string, phase: "apply" | "plan"): iam.PolicyDocument {
  return iam.PolicyDocument.fromJson({
    Version: "2012-10-17",
    Statement: [
      {
        Sid: phase === "apply" ? "HcpApply" : "HcpPlan",
        Effect: "Allow",
        Action: "sts:AssumeRoleWithWebIdentity",
        Principal: { Federated: providerArn },
        Condition: {
          StringEquals: {
            "app.terraform.io:aud": "aws.workload.identity",
            "app.terraform.io:sub":
              `organization:seahaven:project:seahaven-prod:workspace:seahaven-site-prod:run_phase:${phase}`,
          },
        },
      },
    ],
  });
}

function servicesPolicy(
  bucket: string,
  deployParams: string,
  wafParam: string,
  githubOidc: string,
): iam.PolicyDocument {
  return iam.PolicyDocument.fromJson({
    Version: "2012-10-17",
    Statement: [
      {
        Sid: "OriginBucket",
        Effect: "Allow",
        Action: "s3:*",
        Resource: [bucket, `${bucket}/*`],
      },
      {
        Sid: "ReadGithubOidcProvider",
        Effect: "Allow",
        Action: "iam:GetOpenIDConnectProvider",
        Resource: githubOidc,
      },
      {
        Sid: "CloudFrontManage",
        Effect: "Allow",
        Action: "cloudfront:*",
        Resource: "*",
      },
      {
        Sid: "AcmCreate",
        Effect: "Allow",
        Action: "acm:RequestCertificate",
        Resource: "*",
        Condition: { StringEquals: { "aws:RequestTag/Project": "seahaven-site" } },
      },
      {
        Sid: "AcmList",
        Effect: "Allow",
        Action: ["acm:ListCertificates", "acm:ListTagsForCertificate"],
        Resource: "*",
      },
      {
        Sid: "AcmManageTagged",
        Effect: "Allow",
        Action: [
          "acm:AddTagsToCertificate",
          "acm:DeleteCertificate",
          "acm:DescribeCertificate",
          "acm:GetCertificate",
          "acm:RemoveTagsFromCertificate",
          "acm:RenewCertificate",
        ],
        Resource: "*",
        Condition: { StringEquals: { "aws:ResourceTag/Project": "seahaven-site" } },
      },
      {
        Sid: "ReadAppWebAclSsm",
        Effect: "Allow",
        Action: ["ssm:GetParameter", "ssm:GetParameters"],
        Resource: wafParam,
      },
      {
        Sid: "WriteDeployContract",
        Effect: "Allow",
        Action: [
          "ssm:AddTagsToResource",
          "ssm:DeleteParameter",
          "ssm:GetParameter",
          "ssm:GetParameters",
          "ssm:ListTagsForResource",
          "ssm:PutParameter",
          "ssm:RemoveTagsFromResource",
        ],
        Resource: deployParams,
      },
      {
        Sid: "DescribeParameters",
        Effect: "Allow",
        Action: "ssm:DescribeParameters",
        Resource: "*",
      },
      {
        Sid: "ReadWafWebAcl",
        Effect: "Allow",
        Action: [
          "wafv2:GetWebACL",
          "wafv2:GetWebACLForResource",
          "wafv2:ListResourcesForWebACL",
          "wafv2:ListWebACLs",
        ],
        Resource: "*",
      },
    ],
  });
}

function scopedIamPolicy(account: string, deployRole: string, boundary: string): iam.PolicyDocument {
  return iam.PolicyDocument.fromJson({
    Version: "2012-10-17",
    Statement: [
      {
        Sid: "DenyUntaggedCreatePolicy",
        Effect: "Deny",
        Action: "iam:CreatePolicy",
        Resource: "*",
        Condition: { Null: { "aws:RequestTag/BoundaryFor": "true" } },
      },
      {
        Sid: "DenyOtherCreatePolicy",
        Effect: "Deny",
        Action: "iam:CreatePolicy",
        Resource: "*",
        Condition: {
          StringNotEquals: { "aws:RequestTag/BoundaryFor": "githubdeploy-seahaven-site" },
        },
      },
      {
        Sid: "DenyOtherPolicyVersions",
        Effect: "Deny",
        Action: [
          "iam:CreatePolicyVersion",
          "iam:DeletePolicy",
          "iam:DeletePolicyVersion",
          "iam:SetDefaultPolicyVersion",
        ],
        NotResource: boundary,
      },
      {
        Sid: "CreateDeployBoundary",
        Effect: "Allow",
        Action: "iam:CreatePolicy",
        Resource: "*",
        Condition: {
          StringEquals: { "aws:RequestTag/BoundaryFor": "githubdeploy-seahaven-site" },
        },
      },
      {
        Sid: "ManageDeployBoundary",
        Effect: "Allow",
        Action: [
          "iam:CreatePolicyVersion",
          "iam:DeletePolicy",
          "iam:DeletePolicyVersion",
          "iam:GetPolicy",
          "iam:GetPolicyVersion",
          "iam:ListPolicyTags",
          "iam:SetDefaultPolicyVersion",
          "iam:TagPolicy",
          "iam:UntagPolicy",
        ],
        Resource: boundary,
      },
      {
        Sid: "WriteDeployRoles",
        Effect: "Allow",
        Action: [
          "iam:AttachRolePolicy",
          "iam:DeleteRolePolicy",
          "iam:DetachRolePolicy",
          "iam:PutRolePolicy",
          "iam:TagRole",
          "iam:UntagRole",
          "iam:UpdateAssumeRolePolicy",
          "iam:UpdateRole",
          "iam:UpdateRoleDescription",
        ],
        Resource: deployRole,
      },
      {
        Sid: "PutDeployRoleBoundary",
        Effect: "Allow",
        Action: "iam:PutRolePermissionsBoundary",
        Resource: deployRole,
        Condition: { StringEquals: { "iam:PermissionsBoundary": boundary } },
      },
      {
        Sid: "IamReadOnly",
        Effect: "Allow",
        Action: [
          "iam:GetPolicy",
          "iam:GetPolicyVersion",
          "iam:GetRole",
          "iam:GetRolePolicy",
          "iam:ListAttachedRolePolicies",
          "iam:ListInstanceProfilesForRole",
          "iam:ListPolicies",
          "iam:ListPolicyVersions",
          "iam:ListRolePolicies",
          "iam:ListRoleTags",
          "iam:ListRoles",
        ],
        Resource: "*",
      },
      {
        Sid: "DenySelfMutation",
        Effect: "Deny",
        Action: [
          "iam:AttachRolePolicy",
          "iam:DeleteRole",
          "iam:DeleteRolePolicy",
          "iam:DeleteRolePermissionsBoundary",
          "iam:DetachRolePolicy",
          "iam:PutRolePolicy",
          "iam:PutRolePermissionsBoundary",
          "iam:UpdateAssumeRolePolicy",
          "iam:UpdateRole",
          "iam:UpdateRoleDescription",
        ],
        Resource: [
          `arn:aws:iam::${account}:role/hcptf-*`,
          `arn:aws:iam::${account}:role/github-cfn-execution-role`,
          `arn:aws:iam::${account}:role/githubdeploy-*`,
          `arn:aws:iam::${account}:role/cdk-hnb659fds-*`,
          `arn:aws:iam::${account}:role/OrganizationAccountAccessRole`,
          `arn:aws:iam::${account}:role/seahaven-*`,
        ],
      },
      {
        Sid: "DenyBoundaryTampering",
        Effect: "Deny",
        Action: ["iam:DeleteRolePermissionsBoundary", "iam:DeleteUserPermissionsBoundary"],
        Resource: [`arn:aws:iam::${account}:role/*`, `arn:aws:iam::${account}:user/*`],
      },
      {
        Sid: "DenyBoundaryPolicyEdit",
        Effect: "Deny",
        Action: [
          "iam:CreatePolicyVersion",
          "iam:DeletePolicy",
          "iam:DeletePolicyVersion",
          "iam:SetDefaultPolicyVersion",
        ],
        Resource: `arn:aws:iam::${account}:policy/seahaven-*`,
      },
    ],
  });
}

function planPolicy(
  account: string,
  bucket: string,
  functionArn: string,
  deployParams: string,
  wafParam: string,
  githubOidc: string,
  deployRole: string,
  boundary: string,
): iam.PolicyDocument {
  return iam.PolicyDocument.fromJson({
    Version: "2012-10-17",
    Statement: [
      {
        Sid: "RefreshDeployRole",
        Effect: "Allow",
        Action: [
          "iam:GetRole",
          "iam:GetRolePolicy",
          "iam:ListAttachedRolePolicies",
          "iam:ListRolePolicies",
          "iam:ListRoleTags",
        ],
        Resource: [
          deployRole,
          `arn:aws:iam::${account}:role/hcptf-seahaven-site`,
          `arn:aws:iam::${account}:role/hcptf-seahaven-site-plan`,
        ],
      },
      {
        Sid: "RefreshGithubOidcProvider",
        Effect: "Allow",
        Action: "iam:GetOpenIDConnectProvider",
        Resource: githubOidc,
      },
      {
        Sid: "RefreshManagedPolicies",
        Effect: "Allow",
        Action: ["iam:GetPolicy", "iam:GetPolicyVersion"],
        Resource: "*",
      },
      {
        Sid: "RefreshDeployBoundaryTags",
        Effect: "Allow",
        Action: "iam:ListPolicyTags",
        Resource: boundary,
      },
      {
        Sid: "RefreshOriginBucket",
        Effect: "Allow",
        Action: [
          "s3:GetAccelerateConfiguration",
          "s3:GetBucketAcl",
          "s3:GetBucketCORS",
          "s3:GetBucketLocation",
          "s3:GetBucketLogging",
          "s3:GetBucketObjectLockConfiguration",
          "s3:GetBucketOwnershipControls",
          "s3:GetBucketPolicy",
          "s3:GetBucketPolicyStatus",
          "s3:GetBucketPublicAccessBlock",
          "s3:GetBucketRequestPayment",
          "s3:GetBucketTagging",
          "s3:GetBucketVersioning",
          "s3:GetBucketWebsite",
          "s3:GetEncryptionConfiguration",
          "s3:GetLifecycleConfiguration",
          "s3:GetReplicationConfiguration",
          "s3:ListBucket",
        ],
        Resource: [bucket, `${bucket}/*`],
      },
      {
        Sid: "RefreshCloudFront",
        Effect: "Allow",
        Action: [
          "cloudfront:GetDistribution",
          "cloudfront:GetDistributionConfig",
          "cloudfront:GetOriginAccessControl",
          "cloudfront:ListTagsForResource",
        ],
        Resource: "*",
      },
      {
        Sid: "RefreshCloudFrontFunction",
        Effect: "Allow",
        Action: ["cloudfront:DescribeFunction", "cloudfront:GetFunction"],
        Resource: functionArn,
      },
      {
        Sid: "RefreshAcm",
        Effect: "Allow",
        Action: [
          "acm:DescribeCertificate",
          "acm:GetCertificate",
          "acm:ListCertificates",
          "acm:ListTagsForCertificate",
        ],
        Resource: "*",
      },
      {
        Sid: "RefreshAppWebAclSsm",
        Effect: "Allow",
        Action: ["ssm:GetParameter", "ssm:GetParameters", "ssm:ListTagsForResource"],
        Resource: [wafParam, deployParams],
      },
      {
        // DescribeParameters accepts only Resource "*". The AWS provider
        // calls it while refreshing aws_ssm_parameter.
        Sid: "DescribeParameters",
        Effect: "Allow",
        Action: "ssm:DescribeParameters",
        Resource: "*",
      },
      {
        Sid: "RefreshWafWebAcl",
        Effect: "Allow",
        Action: ["wafv2:GetWebACL", "wafv2:ListWebACLs"],
        Resource: "*",
      },
    ],
  });
}