[ELI] addressing comments

Author: TOEL2

infrastructure/stacks/iams-developer-roles/github_actions_policies.tf

@@ -704,16 +704,19 @@ data "aws_iam_policy_document" "github_actions_assume_role" {
       values   = ["sts.amazonaws.com"]
     }
   }
-  statement {
-    sid     = "AllowDevSSORoleToAssumeIamBootstrap"
-    effect  = "Allow"
-    actions = ["sts:AssumeRole"]
-
-    principals {
-      type = "AWS"
-      identifiers = [
-        local.dev_role_arn
-      ]
+  dynamic "statement" {
+    for_each = var.environment == "dev" ? [1] : []
+    content {
+      sid    = "AllowDevSSORoleToAssumeIamBootstrap"
+      effect = "Allow"
+      actions = ["sts:AssumeRole"]
+
+      principals {
+        type = "AWS"
+        identifiers = [
+          local.dev_role_arn
+        ]
+      }
     }
   }
 }

infrastructure/stacks/iams-developer-roles/github_actions_role.tf

@@ -91,16 +91,19 @@ data "aws_iam_policy_document" "github_actions_iam_bootstrap_assume_role" {
       ]
     }
   }
-  statement {
-    sid     = "AllowDevSSORoleToAssumeIamBootstrap"
-    effect  = "Allow"
-    actions = ["sts:AssumeRole"]
+  dynamic "statement" {
+    for_each = var.environment == "dev" ? [1] : []
+    content {
+      sid    = "AllowDevSSORoleToAssumeIamBootstrap"
+      effect = "Allow"
+      actions = ["sts:AssumeRole"]
 
-    principals {
-      type = "AWS"
-      identifiers = [
-        local.dev_role_arn
-      ]
+      principals {
+        type = "AWS"
+        identifiers = [
+          local.dev_role_arn
+        ]
+      }
     }
   }
 }

infrastructure/stacks/iams-developer-roles/iams_permissions_boundary.tf

@@ -416,6 +416,7 @@ data "aws_iam_policy_document" "iam_bootstrap_permissions_boundary" {
       "iam:DetachRolePolicy",
       "iam:PutRolePolicy",
       "iam:DeleteRolePolicy",
+      "iam:UpdateAssumeRolePolicy",
       "iam:PutRolePermissionsBoundary",
       "iam:DeleteRolePermissionsBoundary",
     ]
@@ -429,6 +430,7 @@ data "aws_iam_policy_document" "iam_bootstrap_permissions_boundary" {
     sid    = "DenyBootstrapBoundaryModification"
     effect = "Deny"
     actions = [
+      "iam:CreatePolicyVersion",
       "iam:DeletePolicy",
       "iam:DeletePolicyVersion",
       "iam:SetDefaultPolicyVersion",

infrastructure/stacks/iams-developer-roles/locals.tf

@@ -1,6 +1,6 @@
 locals {
   stack_name = "iams-developer-roles"
-  dev_role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-reserved/sso.amazonaws.com/${var.default_aws_region}/AWSReservedSSO_vdselid_dev_d92ae328ac8d84c7"
+  dev_role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-reserved/sso.amazonaws.com/${var.default_aws_region}/AWSReservedSSO_vdselid_${var.environment}_d92ae328ac8d84c7"
   lambda_signing_profile_name = "${terraform.workspace == "default" ? "" : "${terraform.workspace}"}EligibilityApiLambdaSigningProfile"
   lambda_signing_profile_arn  = "arn:aws:signer:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:/signing-profiles/${local.lambda_signing_profile_name}"
 }