-
Notifications
You must be signed in to change notification settings - Fork 2
/
Copy pathiam.tf
189 lines (147 loc) · 8.44 KB
/
iam.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: Apache-2.0
############################################################################################################
# Generate customer-managed versions of AWSLambdaBasicExecutionRole, AWSLambdaVPCAccessExecutionRole
############################################################################################################
resource "aws_iam_policy" "aws_lambda_basic_execution" {
name = substr("${module.label.id}-aws-lambda-basic-execution", 0, 127)
path = "/"
description = "Customer managed version of AWSLambdaBasicExecutionRole"
policy = data.aws_iam_policy.AWSLambdaBasicExecutionRole.policy
tags = var.tags
}
resource "aws_iam_policy" "aws_lambda_vpc_access_execution" {
name = substr("${module.label.id}-aws-lambda-vpc-access-execution", 0, 127)
path = "/"
description = "Customer managed version of AWSLambdaVPCAccessExecutionRole"
policy = data.aws_iam_policy.AWSLambdaVPCAccessExecutionRole.policy
tags = var.tags
}
resource "aws_iam_policy" "aws_lambda_xray_write_only_access" {
name = substr("${module.label.id}-aws-lambda-xray-write-only-access", 0, 127)
path = "/"
description = "Customer managed version of AWSXrayWriteOnlyAccess"
policy = data.aws_iam_policy.AWSXrayWriteOnlyAccess.policy
tags = var.tags
}
###################################################################
# CodeBuild
###################################################################
# sce_runner
resource "aws_iam_role" "sce_codebuild_runner" {
name = substr("${local.codebuild.sce_runner.role_name_prefix}-codebuild-runner", 0, 63)
assume_role_policy = templatefile("${path.module}/iam/trust-policies/trust.json.tftpl", {
service_principals = "\"codebuild.amazonaws.com\""
})
}
resource "aws_iam_role_policy" "sce_codebuild_runner" {
name = substr("${module.label.id}-codebuild-runner", 0, 63)
role = aws_iam_role.sce_codebuild_runner.name
policy = templatefile("${path.module}/iam/role-policies/codebuild/sce-runner.json.tftpl", {
aws_kms_alias_sce_target_key_arn = aws_kms_alias.tfc.target_key_arn
aws_s3_bucket_sce_logging_arn = aws_s3_bucket.sce_logging.arn
aws_s3_bucket_sce_terraform_state_arn = aws_s3_bucket.sce_terraform_state.arn
data_aws_partition_current_partition = data.aws_partition.current.partition
data_aws_region_current_name = data.aws_region.current.name
data_aws_caller_identity_current_account_id = data.aws_caller_identity.current.account_id
ssm_parameter_name = substr(var.ssh_key_ssm_parameter_path, 1, -1)
})
}
###################################################################
# Lambda
###################################################################
# sce_lambda_provisioning_handler
resource "aws_iam_role" "sce_lambda_provisioning_handler" {
name = substr("${module.label.id}-lambda-provisioning-handler", 0, 63)
assume_role_policy = templatefile("${path.module}/iam/trust-policies/trust.json.tftpl", {
service_principals = "\"lambda.amazonaws.com\""
})
tags = var.tags
}
resource "aws_iam_role_policy" "sce_lambda_provisioning_handler" {
name = substr("${module.label.id}-lambda-provisioning-handler", 0, 127)
role = aws_iam_role.sce_lambda_provisioning_handler.id
policy = templatefile("${path.module}/iam/role-policies/lambda/sce_provisioning_handler.json.tftpl", {
aws_kms_alias_sce_target_key_arn = module.core.kms_key_arn
aws_sqs_queue_sce_provision_queue_arn = module.core.sqs_provision_queue_arn
aws_sqs_queue_sce_termination_queue_arn = module.core.sqs_termination_queue_arn
aws_sqs_queue_sce_update_queue_arn = module.core.sqs_update_queue_arn
aws_sfn_state_machine_sce_manage_provisioned_product_arn = aws_sfn_state_machine.sce_manage_provisioned_product.arn
})
}
resource "aws_iam_role_policy_attachment" "sce_lambda_provisioning_handler" {
count = length(local.lambda.lambda_managed_policies)
role = aws_iam_role.sce_lambda_provisioning_handler.name
policy_arn = local.lambda.lambda_managed_policies[count.index]
}
# sce_lambda_get_state_file_outputs
resource "aws_iam_role" "sce_lambda_get_state_file_outputs" {
name = substr("${module.label.id}-lambda-get-state-file-outputs", 0, 63)
assume_role_policy = templatefile("${path.module}/iam/trust-policies/trust.json.tftpl", {
service_principals = "\"lambda.amazonaws.com\""
})
tags = var.tags
}
resource "aws_iam_role_policy" "sce_lambda_get_state_file_outputs" {
name = substr("${module.label.id}-lambda-get-state-file-outputs", 0, 127)
role = aws_iam_role.sce_lambda_get_state_file_outputs.id
policy = templatefile("${path.module}/iam/role-policies/lambda/sce_get_state_file_outputs.json.tftpl", {
aws_kms_alias_sce_target_key_arn = aws_kms_alias.tfc.target_key_arn
aws_s3_bucket_sce_terraform_state_arn = aws_s3_bucket.sce_terraform_state.arn
data_aws_partition_current_partition = data.aws_partition.current.partition
data_aws_region_current_name = data.aws_region.current.name
data_aws_caller_identity_current_account_id = data.aws_caller_identity.current.account_id
})
}
resource "aws_iam_role_policy_attachment" "sce_lambda_get_state_file_outputs" {
count = length(local.lambda.lambda_managed_policies)
role = aws_iam_role.sce_lambda_get_state_file_outputs.name
policy_arn = local.lambda.lambda_managed_policies[count.index]
}
# sce_lambda_notify_provision_update_result
resource "aws_iam_role" "sce_lambda_notify_provision_update_result" {
name = substr("${module.label.id}-lambda-notify-provision-update-result", 0, 63)
assume_role_policy = templatefile("${path.module}/iam/trust-policies/trust.json.tftpl", {
service_principals = "\"lambda.amazonaws.com\""
})
tags = var.tags
}
resource "aws_iam_role_policy" "sce_lambda_notify_provision_update_result" {
name = substr("${module.label.id}-lambda-notify-provision-update-result", 0, 127)
role = aws_iam_role.sce_lambda_notify_provision_update_result.id
policy = templatefile("${path.module}/iam/role-policies/lambda/sce_notify_provision_update_result.json.tftpl", {
data_aws_partition_current_partition = data.aws_partition.current.partition
data_aws_region_current_name = data.aws_region.current.name
data_aws_caller_identity_current_account_id = data.aws_caller_identity.current.account_id
})
}
resource "aws_iam_role_policy_attachment" "sce_lambda_notify_provision_update_result" {
count = length(local.lambda.lambda_managed_policies)
role = aws_iam_role.sce_lambda_notify_provision_update_result.name
policy_arn = local.lambda.lambda_managed_policies[count.index]
}
###################################################################
# Step Functions
###################################################################
# sce_sfn_manage_provisioned_product
resource "aws_iam_role" "sce_sfn_manage_provisioned_product" {
name = substr("${module.label.id}-sfn-manage-provisioned-product", 0, 63)
assume_role_policy = templatefile("${path.module}/iam/trust-policies/trust.json.tftpl", {
service_principals = "\"states.amazonaws.com\""
})
tags = var.tags
}
resource "aws_iam_role_policy" "sce_sfn_manage_provisioned_product" {
name = substr("${module.label.id}-sfn-manage-provisioned-product", 0, 127)
role = aws_iam_role.sce_sfn_manage_provisioned_product.id
policy = templatefile("${path.module}/iam/role-policies/states/sce_manage_provisioned_product.json.tftpl", {
aws_kms_alias_sce_target_key_arn = aws_kms_alias.tfc.target_key_arn
aws_lambda_function_sce_get_state_file_outputs_arn = aws_lambda_function.sce_get_state_file_outputs.arn
aws_lambda_function_sce_notify_provision_update_result_arn = aws_lambda_function.sce_notify_provision_update_result.arn
aws_sns_topic_codebuild_result_notify_arn = aws_sns_topic.sns_codebuild_result_notify_topic.arn
data_aws_region_current_name = data.aws_region.current.name
data_aws_partition_current_partition = data.aws_partition.current.partition
data_aws_caller_identity_current_account_id = data.aws_caller_identity.current.account_id
aws_codebuild_project_sce_runner_arn = aws_codebuild_project.sce_runner.arn
})
}