eli-204 adding more base permissions

Author: eddalmond1

…cks/_shared/iams_permissions_boundary.tf …yer/assumed_role_permissions_boundary.tfinfrastructure/stacks/_shared/iams_permissions_boundary.tf renamed to infrastructure/stacks/api-layer/assumed_role_permissions_boundary.tf infrastructure/stacks/_shared/iams_permissions_boundary.tf renamed to infrastructure/stacks/api-layer/assumed_role_permissions_boundary.tf

@@ -1,5 +1,5 @@
 # Policy document for Permissions boundary
-data "aws_iam_policy_document" "permissions_boundary" {
+data "aws_iam_policy_document" "assumed_role_permissions_boundary" {
   #checkov:skip=CKV2_AWS_40: Ensure AWS IAM policy does not allow full IAM privileges
   statement {
     sid    = "RestrictRegion"
@@ -66,10 +66,10 @@ data "aws_iam_policy_document" "permissions_boundary" {
 }
 
 # Permissions Boundary policy
-resource "aws_iam_policy" "permissions_boundary" {
+resource "aws_iam_policy" "assumed_role_permissions_boundary" {
   name        = "${local.stack_name}-${upper(var.project_name)}-PermissionsBoundary"
   description = "Allows access to AWS services in the regions the client uses only"
-  policy      = data.aws_iam_policy_document.permissions_boundary.json
+  policy      = data.aws_iam_policy_document.assumed_role_permissions_boundary.json
 
   tags = merge(
     local.tags,

infrastructure/stacks/api-layer/iams_permissions_boundary.tf

@@ -55,13 +55,35 @@ resource "aws_iam_policy" "api_infrastructure" {
           # S3 permissions
           "s3:*",
 
+          # KMS permissions
+          "kms:List*",
+          "kms:Describe*",
+          "kms:GetKeyPolicy*",
+
+          # Cloudwatch permissions
+          "logs:Describe*",
+
+          #EC2 permissions
+          "ec2:Describe*",
+
           # IAM permissions (scoped to resources with specific path prefix)
           "iam:Get*",
+          "iam:GetPolicy*",
+          "iam:GetRole*",
           "iam:List*",
           "iam:Create*",
           "iam:Update*",
           "iam:Delete*",
+
+          # ssm
+          "ssm:GetParameter",
+          "ssm:GetParameters",
+
+          # acm
+          "acm:ListCertificates",
         ],
+
+
         Resource = "*"
       }
     ]

infrastructure/stacks/iams-developer-roles/github_actions_policies.tf

@@ -0,0 +1,80 @@
+# Policy document for Permissions boundary
+data "aws_iam_policy_document" "permissions_boundary" {
+  #checkov:skip=CKV2_AWS_40: Ensure AWS IAM policy does not allow full IAM privileges
+  statement {
+    sid    = "RestrictRegion"
+    effect = "Allow"
+
+    actions = [
+      "acm:*",
+      "application-autoscaling:*",
+      "apigateway:*",
+      "cloudtrail:*",
+      "cloudwatch:*",
+      "config:*",
+      "dynamodb:*",
+      "ec2:*",
+      "events:*",
+      "firehose:*",
+      "glue:*",
+      "health:*",
+      "iam:*",
+      "kms:*",
+      "lambda:*",
+      "logs:*",
+      "network-firewall:*",
+      "pipes:*",
+      "s3:*",
+      "schemas:*",
+      "sns:*",
+      "servicequotas:*",
+      "ssm:*",
+      "states:*",
+      "support:*",
+      "sqs:*",
+      "tag:*",
+      "trustedadvisor:*"
+    ]
+
+    resources = ["*"]
+
+    condition {
+      test     = "StringEquals"
+      variable = "aws:RequestedRegion"
+      values   = [var.default_aws_region]
+    }
+  }
+
+  statement {
+    sid       = "DenyPrivEsculationViaIamRoles"
+    effect    = "Deny"
+    actions   = ["iam:*"]
+    resources = ["*"]
+    condition {
+      test     = "ArnLike"
+      variable = "iam:PolicyARN"
+      values   = ["arn:aws:iam::*:policy/${upper(var.project_name)}-*"]
+    }
+  }
+
+  statement {
+    sid       = "DenyPrivEsculationViaIamProfiles"
+    effect    = "Deny"
+    actions   = ["iam:*"]
+    resources = ["arn:aws:iam::*:role/${upper(var.project_name)}-*"]
+  }
+}
+
+# Permissions Boundary policy
+resource "aws_iam_policy" "permissions_boundary" {
+  name        = "${local.stack_name}-${upper(var.project_name)}-PermissionsBoundary"
+  description = "Allows access to AWS services in the regions the client uses only"
+  policy      = data.aws_iam_policy_document.permissions_boundary.json
+
+  tags = merge(
+    local.tags,
+    {
+      Stack = "api-layer"
+    }
+  )
+}

infrastructure/stacks/iams-developer-roles/iams_permissions_boundary.tf

@@ -0,0 +1,3 @@
+locals {
+  stack_name = "iams-developer-roles"
+}