Merge pull request #638 from NHSDigital/feature/make-tf-with-assumed-role

Adds a command to run tf as github

Author: TOEL2

infrastructure/Makefile

@@ -42,6 +42,25 @@ terraform: guard-env guard-stack guard-tf-command terraform-init terraform-works
 	mkdir -p ./build
 	terraform -chdir=./stacks/$(stack) output -json > ./build/terraform_outputs_$(stack).json
 
+terraform-as-github: SHELL=/bin/bash
+terraform-as-github: guard-env guard-stack guard-tf-command
+	@role=$$( [ "$(stack)" = "iams-developer-roles" ] && \
+		echo arn:aws:iam::448049830832:role/service-roles/github-actions-iam-bootstrap-role || \
+		echo arn:aws:iam::448049830832:role/service-roles/github-actions-api-deployment-role ); \
+	read AK SK ST <<< $$(aws sts assume-role --role-arn $$role --role-session-name local \
+		--query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' --output text); \
+	export AWS_ACCESS_KEY_ID=$$AK AWS_SECRET_ACCESS_KEY=$$SK AWS_SESSION_TOKEN=$$ST; \
+	echo "Caller identity after assume-role:"; \
+	aws sts get-caller-identity; \
+	d=./stacks/$(stack); \
+	terraform -chdir=$$d init -backend-config=backends/$(env).$(stack).tfbackend -upgrade; \
+	terraform -chdir=$$d get -update; \
+	terraform -chdir=$$d $(tf-command) $(args) -var="environment=$(env)" \
+		$$( [ "$(tf-command)" != "init" ] && echo --parallelism=30 ) \
+		$$( [ "$(tf-command)" = "apply" ] && echo -auto-approve ); \
+	mkdir -p build; \
+	terraform -chdir=$$d output -json > build/terraform_outputs_$(stack).json
+
 ###################
 #### Bootstrap ####
 ###################

infrastructure/stacks/iams-developer-roles/github_actions_policies.tf

@@ -704,6 +704,21 @@ data "aws_iam_policy_document" "github_actions_assume_role" {
       values   = ["sts.amazonaws.com"]
     }
   }
+  dynamic "statement" {
+    for_each = var.environment == "dev" ? [1] : []
+    content {
+      sid    = "AllowDevSSORoleToAssumeIamBootstrap"
+      effect = "Allow"
+      actions = ["sts:AssumeRole"]
+
+      principals {
+        type = "AWS"
+        identifiers = [
+          local.dev_role_arn
+        ]
+      }
+    }
+  }
 }
 
 resource "aws_iam_policy" "stream_management" {

infrastructure/stacks/iams-developer-roles/github_actions_role.tf

@@ -91,4 +91,19 @@ data "aws_iam_policy_document" "github_actions_iam_bootstrap_assume_role" {
       ]
     }
   }
+  dynamic "statement" {
+    for_each = var.environment == "dev" ? [1] : []
+    content {
+      sid    = "AllowDevSSORoleToAssumeIamBootstrap"
+      effect = "Allow"
+      actions = ["sts:AssumeRole"]
+
+      principals {
+        type = "AWS"
+        identifiers = [
+          local.dev_role_arn
+        ]
+      }
+    }
+  }
 }

infrastructure/stacks/iams-developer-roles/locals.tf

@@ -1,5 +1,6 @@
 locals {
   stack_name = "iams-developer-roles"
+  dev_role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-reserved/sso.amazonaws.com/${var.default_aws_region}/AWSReservedSSO_vdselid_${var.environment}_d92ae328ac8d84c7"
   lambda_signing_profile_name = "${terraform.workspace == "default" ? "" : "${terraform.workspace}"}EligibilityApiLambdaSigningProfile"
   lambda_signing_profile_arn  = "arn:aws:signer:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:/signing-profiles/${local.lambda_signing_profile_name}"
 }