Skip to content

Commit 7951554

Browse files
TOEL2TOEL2
authored
Merge pull request #642 from NHSDigital/feature/ELI-731-add-regression-role-to-tf
Feature/eli 731 add regression role to tf
2 parents 924b7af + a301141 commit 7951554

3 files changed

Lines changed: 232 additions & 45 deletions

File tree

‎infrastructure/stacks/iams-developer-roles/github_actions_policies.tf‎

Lines changed: 209 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -181,7 +181,7 @@ resource "aws_iam_policy" "dynamodb_management" {
181181
"dynamodb:UpdateTable",
182182
],
183183
Resource = [
184-
"arn:aws:dynamodb:*:${data.aws_caller_identity.current.account_id}:table/*eligibility-signposting-api-${var.environment}-eligibility_datastore"
184+
"arn:aws:dynamodb:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:table/*eligibility-signposting-api-${var.environment}-eligibility_datastore"
185185
]
186186
},
187187

@@ -218,7 +218,7 @@ resource "aws_iam_policy" "dynamodb_management" {
218218
"dynamodb:Query"
219219
],
220220
Resource = [
221-
"arn:aws:dynamodb:*:${data.aws_caller_identity.current.account_id}:table/*eligibility-signposting-api-${var.environment}-eligibility_datastore"
221+
"arn:aws:dynamodb:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:table/*eligibility-signposting-api-${var.environment}-eligibility_datastore"
222222
]
223223
}
224224
] : []
@@ -678,49 +678,6 @@ resource "aws_iam_policy" "iam_management" {
678678
tags = merge(local.tags, { Name = "iam-management" })
679679
}
680680

681-
# Assume role policy document for GitHub Actions
682-
data "aws_iam_policy_document" "github_actions_assume_role" {
683-
statement {
684-
sid = "OidcAssumeRoleWithWebIdentity"
685-
effect = "Allow"
686-
actions = ["sts:AssumeRoleWithWebIdentity"]
687-
688-
principals {
689-
type = "Federated"
690-
identifiers = [
691-
aws_iam_openid_connect_provider.github.arn
692-
]
693-
}
694-
695-
condition {
696-
test = "StringLike"
697-
variable = "token.actions.githubusercontent.com:sub"
698-
values = ["repo:${var.github_org}/${var.github_repo}:*"]
699-
}
700-
701-
condition {
702-
test = "StringEquals"
703-
variable = "token.actions.githubusercontent.com:aud"
704-
values = ["sts.amazonaws.com"]
705-
}
706-
}
707-
dynamic "statement" {
708-
for_each = var.environment == "dev" ? [1] : []
709-
content {
710-
sid = "AllowDevSSORoleToAssumeIamBootstrap"
711-
effect = "Allow"
712-
actions = ["sts:AssumeRole"]
713-
714-
principals {
715-
type = "AWS"
716-
identifiers = [
717-
local.dev_role_arn
718-
]
719-
}
720-
}
721-
}
722-
}
723-
724681
resource "aws_iam_policy" "stream_management" {
725682
name = "stream-management"
726683
description = "Allow GitHub Actions to manage project Firehose delivery streams and Kinesis streams"
@@ -845,6 +802,203 @@ resource "aws_iam_policy" "cloudwatch_management" {
845802
tags = merge(local.tags, { Name = "cloudwatch-management" })
846803
}
847804

805+
data "aws_iam_policy_document" "regression_test_permissions" {
806+
#checkov:skip=CKV_AWS_356: Wildcard resource is required to list all dynamodb tables
807+
#checkov:skip=CKV_AWS_111: Wildcard resource is required for cloudwatch and xray read permissions
808+
statement {
809+
sid = "S3Access"
810+
effect = "Allow"
811+
actions = [
812+
"s3:ListBucket",
813+
"s3:GetObject",
814+
"s3:PutObject",
815+
"s3:DeleteObject",
816+
"s3:GetBucketTagging",
817+
"s3:GetObjectTagging",
818+
"s3:PutObjectTagging",
819+
"s3:GetObjectVersion"
820+
]
821+
resources = [
822+
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-rules",
823+
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-rules/*",
824+
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-consumer-map",
825+
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-consumer-map/*"
826+
]
827+
}
828+
829+
statement {
830+
sid = "DynamoAccess"
831+
effect = "Allow"
832+
actions = [
833+
"dynamodb:GetItem",
834+
"dynamodb:PutItem",
835+
"dynamodb:Query",
836+
"dynamodb:Scan",
837+
"dynamodb:UpdateItem",
838+
"dynamodb:DeleteItem",
839+
"dynamodb:DescribeTable",
840+
"dynamodb:DeleteTable",
841+
"dynamodb:TagResource",
842+
"dynamodb:UntagResource",
843+
"dynamodb:ListTagsOfResource"
844+
]
845+
resources = [
846+
"arn:aws:dynamodb:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:table/*eligibility-signposting-api-${var.environment}-eligibility_datastore"
847+
]
848+
}
849+
850+
statement {
851+
sid = "DynamoGlobal"
852+
effect = "Allow"
853+
actions = [
854+
"dynamodb:ListTables",
855+
"dynamodb:CreateTable"
856+
]
857+
resources = ["*"]
858+
}
859+
860+
statement {
861+
sid = "SecretsManagerAccess"
862+
effect = "Allow"
863+
actions = [
864+
"secretsmanager:GetSecretValue",
865+
"secretsmanager:DescribeSecret"
866+
]
867+
resources = ["arn:aws:secretsmanager:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:secret:eligibility-signposting-api-*"]
868+
}
869+
870+
statement {
871+
sid = "CloudWatchLogsRead"
872+
effect = "Allow"
873+
actions = [
874+
"logs:DescribeLogGroups",
875+
"logs:DescribeLogStreams",
876+
"logs:GetLogEvents",
877+
"logs:FilterLogEvents",
878+
"logs:StartQuery",
879+
"logs:GetQueryResults",
880+
"logs:StopQuery"
881+
]
882+
resources = ["*"]
883+
}
884+
885+
statement {
886+
sid = "XRayRead"
887+
effect = "Allow"
888+
actions = [
889+
"xray:GetTraceSummaries",
890+
"xray:BatchGetTraces",
891+
"xray:GetServiceGraph",
892+
"xray:GetGroups",
893+
"xray:GetGroup",
894+
"xray:GetSamplingRules",
895+
"xray:GetSamplingTargets",
896+
"xray:GetSamplingStatisticSummaries",
897+
"xray:UpdateSamplingRule"
898+
]
899+
resources = ["*"]
900+
}
901+
902+
statement {
903+
sid = "SSMRead"
904+
effect = "Allow"
905+
actions = [
906+
"ssm:GetParameter",
907+
"ssm:GetParameters",
908+
"ssm:GetParametersByPath"
909+
]
910+
resources = [
911+
"arn:aws:ssm:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:parameter/${var.environment}/*"
912+
]
913+
}
914+
}
915+
916+
resource "aws_iam_policy" "regression_test_permissions" {
917+
name = "regression-test-permissions"
918+
description = "Permissions for the regression test GitHub Actions role"
919+
path = "/service-policies/"
920+
policy = data.aws_iam_policy_document.regression_test_permissions.json
921+
}
922+
923+
# Assume role policy document for GitHub Actions
924+
data "aws_iam_policy_document" "github_actions_assume_role" {
925+
statement {
926+
sid = "OidcAssumeRoleWithWebIdentity"
927+
effect = "Allow"
928+
actions = ["sts:AssumeRoleWithWebIdentity"]
929+
930+
principals {
931+
type = "Federated"
932+
identifiers = [
933+
aws_iam_openid_connect_provider.github.arn
934+
]
935+
}
936+
937+
condition {
938+
test = "StringLike"
939+
variable = "token.actions.githubusercontent.com:sub"
940+
values = ["repo:${var.github_org}/${var.github_repo}:*"]
941+
}
942+
943+
condition {
944+
test = "StringEquals"
945+
variable = "token.actions.githubusercontent.com:aud"
946+
values = ["sts.amazonaws.com"]
947+
}
948+
}
949+
dynamic "statement" {
950+
for_each = var.environment == "dev" ? [1] : []
951+
content {
952+
sid = "AllowDevSSORoleToAssumeIamBootstrap"
953+
effect = "Allow"
954+
actions = ["sts:AssumeRole"]
955+
956+
principals {
957+
type = "AWS"
958+
identifiers = [
959+
local.dev_role_arn
960+
]
961+
}
962+
}
963+
}
964+
}
965+
966+
# Assume role policy document for GitHub Actions
967+
data "aws_iam_policy_document" "regression_repo_assume_role" {
968+
statement {
969+
sid = "OidcAssumeRoleWithWebIdentity"
970+
effect = "Allow"
971+
actions = ["sts:AssumeRoleWithWebIdentity"]
972+
973+
principals {
974+
type = "Federated"
975+
identifiers = [
976+
aws_iam_openid_connect_provider.github.arn
977+
]
978+
}
979+
980+
condition {
981+
test = "StringLike"
982+
variable = "token.actions.githubusercontent.com:sub"
983+
values = ["repo:${var.github_org}/${var.regression_repo}:*"]
984+
}
985+
986+
condition {
987+
test = "StringLike"
988+
variable = "token.actions.githubusercontent.com:job_workflow_ref"
989+
values = [
990+
"${var.github_org}/${var.regression_repo}/.github/workflows/regression_tests.yml@*"
991+
]
992+
}
993+
994+
condition {
995+
test = "StringEquals"
996+
variable = "token.actions.githubusercontent.com:aud"
997+
values = ["sts.amazonaws.com"]
998+
}
999+
}
1000+
}
1001+
8481002
# Attach the policies to the role
8491003
resource "aws_iam_role_policy_attachment" "api_infrastructure" {
8501004
role = aws_iam_role.github_actions.name
@@ -885,3 +1039,13 @@ resource "aws_iam_role_policy_attachment" "cloudwatch_management" {
8851039
role = aws_iam_role.github_actions.name
8861040
policy_arn = aws_iam_policy.cloudwatch_management.arn
8871041
}
1042+
1043+
resource "aws_iam_role_policy_attachment" "regression_test_permissions" {
1044+
role = aws_iam_role.regression_test_role.name
1045+
policy_arn = aws_iam_policy.regression_test_permissions.arn
1046+
}
1047+
1048+
resource "aws_iam_role_policy_attachment" "regression_security_management" {
1049+
role = aws_iam_role.regression_test_role.name
1050+
policy_arn = aws_iam_policy.security_management.arn
1051+
}

‎infrastructure/stacks/iams-developer-roles/github_actions_role.tf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,3 +107,20 @@ data "aws_iam_policy_document" "github_actions_iam_bootstrap_assume_role" {
107107
}
108108
}
109109
}
110+
111+
resource "aws_iam_role" "regression_test_role" {
112+
name = "Eligibility-API-E2E-Regression-Tests"
113+
description = "Role for regression testing"
114+
permissions_boundary = aws_iam_policy.permissions_boundary.arn
115+
path = "/service-roles/"
116+
117+
# Trust policy allowing GitHub Actions to assume the role
118+
assume_role_policy = data.aws_iam_policy_document.regression_repo_assume_role.json
119+
120+
tags = merge(
121+
local.tags,
122+
{
123+
Name = "Eligibility-API-E2E-Regression-Tests"
124+
}
125+
)
126+
}

‎infrastructure/stacks/iams-developer-roles/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,9 @@ variable "github_repo" {
99
description = "GitHub repository"
1010
type = string
1111
}
12+
13+
variable "regression_repo" {
14+
default = "eligibility-signposting-api-regression-tests"
15+
description = "GitHub repository"
16+
type = string
17+
}

0 commit comments

Comments
 (0)