Skip to content

Commit 4213d25

Browse files
Fix/tr/nops 195/sqs sender role assumption (#134)
1 parent 1cc7b8c commit 4213d25

File tree

2 files changed

+31
-8
lines changed

2 files changed

+31
-8
lines changed

modules/stac-server/ingest.tf

Lines changed: 30 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,13 @@
1+
locals {
2+
role_arns = [for item in var.additional_ingest_sqs_senders_arns : item if length(regexall("^arn:[a-z-]+:iam::\\d{12}:role", item)) > 0]
3+
4+
non_role_arns = concat(
5+
[aws_sns_topic.stac_server_ingest_sns_topic.arn],
6+
var.ingest_sns_topic_arns,
7+
[for item in var.additional_ingest_sqs_senders_arns : item if !contains(local.role_arns, item)]
8+
)
9+
}
10+
111
resource "aws_lambda_function" "stac_server_ingest" {
212
filename = local.resolved_ingest_lambda_zip_filepath
313
function_name = "${local.name_prefix}-stac-server-ingest"
@@ -72,6 +82,8 @@ resource "aws_sqs_queue_policy" "stac_server_ingest_sqs_queue_policy" {
7282
}
7383

7484
data "aws_iam_policy_document" "stac_server_ingest_sqs_policy" {
85+
86+
# SNS + non-roles
7587
statement {
7688
effect = "Allow"
7789

@@ -80,19 +92,29 @@ data "aws_iam_policy_document" "stac_server_ingest_sqs_policy" {
8092
identifiers = ["*"]
8193
}
8294

83-
actions = [
84-
"sqs:SendMessage"
85-
]
86-
87-
resources = [
88-
aws_sqs_queue.stac_server_ingest_sqs_queue.arn,
89-
]
95+
actions = ["sqs:SendMessage"]
96+
resources = [aws_sqs_queue.stac_server_ingest_sqs_queue.arn]
9097

9198
condition {
9299
test = "ArnEquals"
93100
variable = "aws:SourceArn"
101+
values = local.non_role_arns
102+
}
103+
}
104+
105+
# handle roles - both directly used or assumed by STS
106+
dynamic "statement" {
107+
for_each = length(local.role_arns) > 0 ? [1] : []
108+
content {
109+
effect = "Allow"
110+
111+
principals {
112+
type = "AWS"
113+
identifiers = local.role_arns
114+
}
94115

95-
values = concat([aws_sns_topic.stac_server_ingest_sns_topic.arn], var.ingest_sns_topic_arns, var.additional_ingest_sqs_senders_arns)
116+
actions = ["sqs:SendMessage"]
117+
resources = [aws_sqs_queue.stac_server_ingest_sqs_queue.arn]
96118
}
97119
}
98120
}

modules/stac-server/inputs.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -380,6 +380,7 @@ variable "additional_ingest_sqs_senders_arns" {
380380
description = "List of additional principals to grant access to send to the Ingest SQS. This is required to allow STAC API SNS notifications (e.g. earth search's ingest SNS topic) to be able to publish SQS ingest messages to our stac-server for indexing."
381381
type = list(string)
382382
default = []
383+
nullable = false
383384
}
384385

385386
variable "project_name" {

0 commit comments

Comments
 (0)