[ELI] altering trust policy and adding make command

Author: TOEL2

infrastructure/Makefile

@@ -42,6 +42,25 @@ terraform: guard-env guard-stack guard-tf-command terraform-init terraform-works
 	mkdir -p ./build
 	terraform -chdir=./stacks/$(stack) output -json > ./build/terraform_outputs_$(stack).json
 
+terraform-as-github: SHELL=/bin/bash
+terraform-as-github: guard-env guard-stack guard-tf-command
+	@role=$$( [ "$(stack)" = "iams-developer-roles" ] && \
+		echo arn:aws:iam::448049830832:role/service-roles/github-actions-iam-bootstrap-role || \
+		echo arn:aws:iam::448049830832:role/service-roles/github-actions-api-deployment-role ); \
+	read AK SK ST <<< $$(aws sts assume-role --role-arn $$role --role-session-name local \
+		--query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' --output text); \
+	export AWS_ACCESS_KEY_ID=$$AK AWS_SECRET_ACCESS_KEY=$$SK AWS_SESSION_TOKEN=$$ST; \
+	echo "Caller identity after assume-role:"; \
+	aws sts get-caller-identity; \
+	d=./stacks/$(stack); \
+	terraform -chdir=$$d init -backend-config=backends/$(env).$(stack).tfbackend -upgrade; \
+	terraform -chdir=$$d get -update; \
+	terraform -chdir=$$d $(tf-command) $(args) -var="environment=$(env)" \
+		$$( [ "$(tf-command)" != "init" ] && echo --parallelism=30 ) \
+		$$( [ "$(tf-command)" = "apply" ] && echo -auto-approve ); \
+	mkdir -p build; \
+	terraform -chdir=$$d output -json > build/terraform_outputs_$(stack).json
+
 ###################
 #### Bootstrap ####
 ###################

infrastructure/stacks/iams-developer-roles/github_actions_policies.tf

@@ -704,6 +704,18 @@ data "aws_iam_policy_document" "github_actions_assume_role" {
       values   = ["sts.amazonaws.com"]
     }
   }
+  statement {
+    sid     = "AllowDevSSORoleToAssumeIamBootstrap"
+    effect  = "Allow"
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      type = "AWS"
+      identifiers = [
+        local.dev_role_arn
+      ]
+    }
+  }
 }
 
 resource "aws_iam_policy" "stream_management" {

infrastructure/stacks/iams-developer-roles/github_actions_role.tf

@@ -91,4 +91,16 @@ data "aws_iam_policy_document" "github_actions_iam_bootstrap_assume_role" {
       ]
     }
   }
+  statement {
+    sid     = "AllowDevSSORoleToAssumeIamBootstrap"
+    effect  = "Allow"
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      type = "AWS"
+      identifiers = [
+        local.dev_role_arn
+      ]
+    }
+  }
 }

infrastructure/stacks/iams-developer-roles/locals.tf

@@ -1,5 +1,6 @@
 locals {
   stack_name = "iams-developer-roles"
+  dev_role_arn = "arn:aws:iam::448049830832:role/aws-reserved/sso.amazonaws.com/eu-west-2/AWSReservedSSO_vdselid_dev_d92ae328ac8d84c7"
   lambda_signing_profile_name = "${terraform.workspace == "default" ? "" : "${terraform.workspace}"}EligibilityApiLambdaSigningProfile"
   lambda_signing_profile_arn  = "arn:aws:signer:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:/signing-profiles/${local.lambda_signing_profile_name}"
 }