iam.tf

data "aws_iam_policy_document" "policy_doc" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "policy_permissions_doc" {
  statement {
    effect = "Allow"
    actions = [
      "autoscaling:DescribeAutoScalingInstances",
      "ec2:DescribeInstances"
    ]
    resources = [
      "*"
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "ecr:GetAuthorizationToken",
      "ecr:ListImages",
      "ecr:BatchCheckLayerAvailability",
      "ecr:BatchGetImage",
      "ecr:DescribeImages",
      "ecr:DescribeRepositories",
      "ecr:GetDownloadUrlForLayer",
      "ecr:GetRepositoryPolicy"
    ]
    resources = [
      "*"
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "ssm:GetParameter"
    ]
    resources = [
      aws_ssm_parameter.datadog_api_key.arn,
      aws_ssm_parameter.datadog_user_password.arn,
      aws_ssm_parameter.rabbit_admin_password.arn,
      aws_ssm_parameter.rabbit_password.arn,
      aws_ssm_parameter.secret_cookie.arn,
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "kms:Decrypt"
    ]
    resources = [
      var.kms_key_arn
    ]
  }

  dynamic "statement" {
    for_each = var.enable_password_rotation ? [true] : []
    content {
      effect = "Allow"
      actions = [
        "ssm:GetParameter"
      ]
      resources = [
        aws_ssm_parameter.secondary_rabbit_password[0].arn,
        aws_ssm_parameter.secondary_rabbit_admin_password[0].arn,
        aws_ssm_parameter.secondary_datadog_user_password[0].arn,
      ]
    }
  }
}

resource "aws_iam_role_policy" "iam_policy" {
  name = "${var.name}-${data.aws_region.current.name}"
  role = aws_iam_role.iam_role.id

  policy = data.aws_iam_policy_document.policy_permissions_doc.json
}

resource "aws_iam_instance_profile" "iam_profile" {
  name_prefix = "${var.name}-${data.aws_region.current.name}-"
  role        = aws_iam_role.iam_role.name
}

resource "aws_iam_role" "iam_role" {
  name               = "${var.name}-${data.aws_region.current.name}"
  assume_role_policy = data.aws_iam_policy_document.policy_doc.json
  tags               = var.tags
}

resource "aws_iam_role_policy_attachment" "inspector2_managed_cis_policy" {
  count      = var.inspector2_cis_scanning_enabled ? 1 : 0
  policy_arn = "arn:aws:iam::aws:policy/AmazonInspector2ManagedCisPolicy"
  role       = aws_iam_role.iam_role.name
}