Skip to content

Commit ad6623a

Browse files
shweta-nhsshweta-nhs
authored
ELI-597: Refines permissions for preprod & adds metadata to rotation email (#546)
* ELI-577: Refines permissions for preprod to address policy size * ELI-597: Adding metadata to emails for rotation
1 parent 86beebd commit ad6623a

2 files changed

Lines changed: 34 additions & 72 deletions

File tree

‎infrastructure/stacks/api-layer/step_functions.tf‎

Lines changed: 15 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ resource "aws_sfn_state_machine" "rotation_machine" {
2424
Resource = "arn:aws:states:::sns:publish.waitForTaskToken",
2525
TimeoutSeconds = 86400,
2626
Parameters = {
27+
Subject = "Action required: AWSPENDING secret created (Environment: ${var.environment})",
2728
TopicArn = aws_sns_topic.secret_rotation.arn,
2829
"Message.$" = local.add_jobs_message
2930
},
@@ -44,6 +45,7 @@ resource "aws_sfn_state_machine" "rotation_machine" {
4445
Resource = "arn:aws:states:::sns:publish.waitForTaskToken",
4546
TimeoutSeconds = 86400,
4647
Parameters = {
48+
Subject = "Action required: Secret AWSPENDING promoted to AWSCURRENT (Environment: ${var.environment})",
4749
TopicArn = aws_sns_topic.secret_rotation.arn,
4850
"Message.$" = local.delete_jobs_message
4951
},
@@ -59,7 +61,7 @@ resource "aws_sfn_state_machine" "rotation_machine" {
5961
Resource = "arn:aws:states:::sns:publish",
6062
Parameters = {
6163
TopicArn = aws_sns_topic.secret_rotation.arn,
62-
Subject = "WARNING: Secret Rotation Timed Out",
64+
Subject = "Warning: Secret rotation timed out (Environment: ${var.environment})",
6365
"Message.$" = local.timeout_message
6466
},
6567
Next = "Fail_Timeout"
@@ -75,7 +77,7 @@ resource "aws_sfn_state_machine" "rotation_machine" {
7577
Resource = "arn:aws:states:::sns:publish",
7678
Parameters = {
7779
TopicArn = aws_sns_topic.secret_rotation.arn,
78-
Subject = "CRITICAL: Secret Rotation Failed",
80+
Subject = "Critical: Secret Rotation Failed (Environment: ${var.environment})",
7981
"Message.$" = local.failure_message
8082
},
8183
Next = "Fail_Generic"
@@ -91,7 +93,7 @@ locals {
9193
add_jobs_message = <<EOT
9294
States.Format('
9395
======================================================
94-
ACTION REQUIRED: PENDING SECRET CREATED
96+
Action required: AWSPENDING secret created (Environment: ${var.environment})
9597
======================================================
9698
9799
A manual action is required to proceed.
@@ -100,20 +102,19 @@ CONTEXT:
100102
Secret Name: ${module.secrets_manager.aws_hashing_secret_name}
101103
102104
INSTRUCTIONS:
103-
1. Run the "Add New Hashes" job.
105+
1. Run the "Add New Hashes (elid_add_new_salt)" job.
104106
2. Ensure the new hashes are working as expected.
105107
3. Run the command below to approve and resume the workflow:
106108
107-
aws stepfunctions send-task-success --task-token {}
109+
aws stepfunctions send-task-success --task-token $$.Task.Token --task-output {{}}
108110
109111
======================================================
110-
', $$.Task.Token)
111112
EOT
112113

113114
delete_jobs_message = <<EOT
114115
States.Format('
115116
======================================================
116-
ACTION REQUIRED: SECRET AWSPENDING PROMOTED TO AWSCURRENT
117+
Action required: Secret AWSPENDING promoted to AWSCURRENT (Environment: ${var.environment})
117118
======================================================
118119
119120
A manual action is required to proceed.
@@ -122,24 +123,26 @@ CONTEXT:
122123
Secret Name: ${module.secrets_manager.aws_hashing_secret_name}
123124
124125
INSTRUCTIONS:
125-
1. Run the "Delete Old Hashes" job.
126+
1. Run the "Delete Old Hashes (elid_delete_old_salt)" job.
126127
2. Ensure the old hashes have been removed successfully.
127128
3. Run the command below to approve and resume the workflow:
128129
129-
aws stepfunctions send-task-success --task-token {}
130+
aws stepfunctions send-task-success --task-token $$.Task.Token --task-output {{}}
130131
131132
======================================================
132-
', $$.Task.Token)
133133
EOT
134134

135135
failure_message = <<EOT
136136
States.Format('
137137
======================================================
138-
CRITICAL: ROTATION FAILED
138+
Critical: Rotation failed (Environment: ${var.environment})
139139
======================================================
140140
141141
The workflow encountered an error and could not complete.
142142
143+
CONTEXT:
144+
Secret Name: ${module.secrets_manager.aws_hashing_secret_name}
145+
143146
ERROR DETAILS:
144147
{}
145148
@@ -162,7 +165,7 @@ EOT
162165
timeout_message = <<EOT
163166
States.Format('
164167
======================================================
165-
WARNING: ROTATION TIMED OUT
168+
Warning: Rotation timed out (Environment: ${var.environment})
166169
======================================================
167170
168171
The manual verification step was not completed within the 24-hour limit.

‎infrastructure/stacks/iams-developer-roles/iams_permissions_boundary.tf‎

Lines changed: 19 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -21,18 +21,15 @@ data "aws_iam_policy_document" "permissions_boundary" {
2121
# CloudWatch - monitoring and alarms
2222
"cloudwatch:PutMetricAlarm",
2323
"cloudwatch:DeleteAlarms",
24-
"cloudwatch:DescribeAlarms",
25-
"cloudwatch:DescribeAlarmsForMetric",
24+
"cloudwatch:DescribeAlarms*",
2625
"cloudwatch:ListTagsForResource",
2726
"cloudwatch:TagResource",
2827
"cloudwatch:UntagResource",
2928
"cloudwatch:GetDashboard",
3029
"cloudwatch:GetMetricWidgetImage",
3130

3231
# DynamoDB - table management
33-
"dynamodb:DescribeTimeToLive",
34-
"dynamodb:DescribeTable",
35-
"dynamodb:DescribeContinuousBackups",
32+
"dynamodb:Describe*",
3633
"dynamodb:ListTables",
3734
"dynamodb:DeleteTable",
3835
"dynamodb:CreateTable",
@@ -47,12 +44,10 @@ data "aws_iam_policy_document" "permissions_boundary" {
4744
"ec2:ModifyVpcBlockPublicAccessOptions",
4845
"ec2:CreateTags",
4946
"ec2:DeleteTags",
50-
"ec2:CreateNetworkAclEntry",
51-
"ec2:DeleteNetworkAclEntry",
52-
"ec2:CreateNetworkAcl",
53-
"ec2:DeleteNetworkAcl",
47+
"ec2:CreateNetworkAcl*",
48+
"ec2:DeleteNetworkAcl*",
5449
"ec2:AssociateRouteTable",
55-
"ec2:CreateVpc",
50+
"ec2:CreateVpc*",
5651
"ec2:ModifyVpcAttribute",
5752
"ec2:DeleteVpc",
5853
"ec2:CreateRouteTable",
@@ -62,7 +57,6 @@ data "aws_iam_policy_document" "permissions_boundary" {
6257
"ec2:RevokeSecurityGroupEgress",
6358
"ec2:AuthorizeSecurityGroupIngress",
6459
"ec2:AuthorizeSecurityGroupEgress",
65-
"ec2:CreateVpcEndpoint",
6660
"ec2:CreateFlowLogs",
6761
"ec2:ReplaceNetworkAclAssociation",
6862
"ec2:DeleteSecurityGroup",
@@ -93,13 +87,10 @@ data "aws_iam_policy_document" "permissions_boundary" {
9387
"firehose:StopDeliveryStreamEncryption",
9488

9589
# IAM - specific role and policy management
96-
"iam:GetRole",
97-
"iam:GetRolePolicy",
98-
"iam:GetPolicy",
99-
"iam:GetPolicyVersion",
100-
"iam:ListRoles",
90+
"iam:GetRole*",
91+
"iam:GetPolicy*",
92+
"iam:ListRole*",
10193
"iam:ListPolicies",
102-
"iam:ListRolePolicies",
10394
"iam:ListAttachedRolePolicies",
10495
"iam:ListPolicyVersions",
10596
"iam:CreateRole",
@@ -110,10 +101,8 @@ data "aws_iam_policy_document" "permissions_boundary" {
110101
"iam:PutRolePermissionsBoundary",
111102
"iam:AttachRolePolicy",
112103
"iam:DetachRolePolicy",
113-
"iam:CreatePolicy",
114-
"iam:CreatePolicyVersion",
115-
"iam:DeletePolicy",
116-
"iam:DeletePolicyVersion",
104+
"iam:CreatePolicy*",
105+
"iam:DeletePolicy*",
117106
"iam:TagRole",
118107
"iam:UntagPolicy",
119108
"iam:PassRole",
@@ -122,13 +111,9 @@ data "aws_iam_policy_document" "permissions_boundary" {
122111

123112
# KMS - encryption key management
124113
"kms:CreateKey",
125-
"kms:DescribeKey",
126114
"kms:Describe*",
127115
"kms:CreateAlias",
128-
"kms:ListKeys",
129116
"kms:List*",
130-
"kms:ListAliases",
131-
"kms:GetKeyPolicy",
132117
"kms:GetKeyPolicy*",
133118
"kms:GetKeyRotationStatus",
134119
"kms:DeleteAlias",
@@ -140,19 +125,15 @@ data "aws_iam_policy_document" "permissions_boundary" {
140125
"kms:ScheduleKeyDeletion",
141126
"kms:PutKeyPolicy",
142127
"kms:Encrypt",
143-
"kms:Decrypt",
144128
"kms:Decrypt*",
145129
"kms:ReEncrypt*",
146130
"kms:GenerateDataKey",
147131

148132
# Lambda - function management
149133
"lambda:CreateFunction",
150-
"lambda:UpdateFunctionCode",
151-
"lambda:UpdateFunctionConfiguration",
134+
"lambda:UpdateFunction*",
152135
"lambda:DeleteFunction",
153-
"lambda:GetFunction",
154-
"lambda:GetFunctionConfiguration",
155-
"lambda:GetFunctionCodeSigningConfig",
136+
"lambda:GetFunction*",
156137
"lambda:ListVersionsByFunction",
157138
"lambda:TagResource",
158139
"lambda:UntagResource",
@@ -179,37 +160,18 @@ data "aws_iam_policy_document" "permissions_boundary" {
179160
# S3 - bucket and object management
180161
"s3:GetLifecycleConfiguration",
181162
"s3:PutLifecycleConfiguration",
182-
"s3:GetBucketVersioning",
183163
"s3:GetEncryptionConfiguration",
184164
"s3:PutEncryptionConfiguration",
185-
"s3:GetBucketPolicy",
186-
"s3:GetBucketObjectLockConfiguration",
187-
"s3:GetBucketLogging",
188165
"s3:GetReplicationConfiguration",
189-
"s3:GetBucketWebsite",
190-
"s3:GetBucketRequestPayment",
191-
"s3:GetBucketCORS",
192-
"s3:GetBucketAcl",
193-
"s3:PutBucketAcl",
194166
"s3:GetAccelerateConfiguration",
195167
"s3:ListBucket",
196-
"s3:GetObject",
197-
"s3:PutObject",
168+
"s3:GetObject*",
169+
"s3:PutObject*",
198170
"s3:DeleteObject",
199-
"s3:GetBucketLocation",
200-
"s3:GetBucketPublicAccessBlock",
201-
"s3:PutBucketCORS",
171+
"s3:GetBucket*",
202172
"s3:CreateBucket",
203173
"s3:DeleteBucket",
204-
"s3:GetBucketTagging",
205-
"s3:PutBucketPolicy",
206-
"s3:PutBucketVersioning",
207-
"s3:PutBucketPublicAccessBlock",
208-
"s3:PutBucketLogging",
209-
"s3:GetObjectTagging",
210-
"s3:PutObjectTagging",
211-
"s3:GetObjectVersion",
212-
"s3:PutBucketTagging",
174+
"s3:PutBucket*",
213175

214176
# SNS - notification management
215177
"sns:CreateTopic",
@@ -222,23 +184,20 @@ data "aws_iam_policy_document" "permissions_boundary" {
222184
"sns:UntagResource",
223185
"sns:Subscribe",
224186
"sns:Unsubscribe",
225-
"sns:ListSubscriptions",
226-
"sns:ListSubscriptionsByTopic",
187+
"sns:ListSubscriptions*",
227188
"sns:GetSubscriptionAttributes",
228189

229190
# SSM - parameter management
230191
"ssm:DescribeParameters",
231-
"ssm:GetParameter",
232-
"ssm:GetParameters",
192+
"ssm:GetParameter*",
233193
"ssm:ListTagsForResource",
234194
"ssm:PutParameter",
235195
"ssm:AddTagsToResource",
236196

237197
# WAFv2 - web application firewall management
238198
"wafv2:CreateWebACL",
239199
"wafv2:DeleteWebACL",
240-
"wafv2:GetWebACL",
241-
"wafv2:GetWebACLForResource",
200+
"wafv2:GetWebACL*",
242201
"wafv2:UpdateWebACL",
243202
"wafv2:ListWebACLs",
244203
"wafv2:TagResource",

0 commit comments

Comments
 (0)