Merge branch 'main' into feature/ELI-707-enforce-codeowners

Author: TOEL2

.github/workflows/cicd-3-test-deploy.yaml

@@ -66,6 +66,17 @@ jobs:
         with:
           terraform_version: ${{ needs.metadata.outputs.terraform_version }}
 
+      - name: "Configure AWS Credentials (IAM Bootstrap Role)"
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-iam-bootstrap-role
+          aws-region: eu-west-2
+
+      - name: "Deploy IAM roles (iams-developer-roles stack)"
+        working-directory: ./infrastructure
+        run: |
+          make terraform env=test stack=iams-developer-roles tf-command=apply workspace=default
+
       - name: "Configure AWS Credentials"
         uses: aws-actions/configure-aws-credentials@v6
         with:

infrastructure/stacks/api-layer/s3_buckets.tf

@@ -60,7 +60,7 @@ module "s3_dq_metrics_bucket" {
 
 module "s3_cloudtrail_bucket" {
   source       = "../../modules/s3"
-  bucket_name  = "eli-cloudwatch-logs"
+  bucket_name  = "eli-cloudwatch"
   environment  = var.environment
   project_name = var.project_name
   stack_name   = local.stack_name

infrastructure/stacks/iams-developer-roles/github_actions_policies.tf

@@ -235,10 +235,10 @@ resource "aws_iam_policy" "s3_management" {
           "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-dq-metrics/*",
           "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-dq-metrics-access-logs",
           "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-dq-metrics-access-logs/*",
-          "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-cloudwatch-logs",
-          "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-cloudwatch-logs/*",
-          "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-cloudwatch-logs-access-logs",
-          "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-cloudwatch-logs-access-logs/*",
+          "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-cloudwatch",
+          "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-cloudwatch/*",
+          "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-cloudwatch-access-logs",
+          "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-cloudwatch-access-logs/*",
         ]
       }
     ]