Skip to content

Commit 018e742

Browse files
timburke-hackittimburke-hackit
authored
Dl 42/nec migration resources (#2263)
* add housing_nec_migration catalog database * add nec housing data bucket * config for allowing additional s3 dept access * grant housing dept access to nec migration bucket * remove experimental optional * update s3 compliance rules
1 parent 7b965d0 commit 018e742

File tree

6 files changed

+123
-1
lines changed

6 files changed

+123
-1
lines changed

‎terraform/compliance/s3.feature‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,14 @@
1+
# buckets should only be excluded from one of these two rules
12
Feature: S3
23

34
@exclude_aws_s3_bucket.ssl_connection_resources\[0\]
45
@exclude_module.qlik_server\[0\].aws_s3_bucket.qlik_alb_logs\[0\]
56
@exclude_module.airflow.aws_s3_bucket.bucket
67
@exclude_aws_s3_bucket.mwaa_bucket
78
@exclude_aws_s3_bucket.mwaa_etl_scripts_bucket
9+
@exclude_module.housing_nec_migration_storage.aws_s3_bucket.bucket
10+
11+
# This rule is in place for legacy buckets created with the deprecated block within the aws_s3_bucket resource
812
Scenario: Data must be encrypted at rest for buckets created using server_side_encryption_configuration property within bucket resource
913
Given I have aws_s3_bucket defined
1014
Then it must have server_side_encryption_configuration
@@ -27,6 +31,7 @@ Feature: S3
2731
@exclude_module.db_snapshot_to_s3\[0\].module.rds_export_storage.aws_s3_bucket.bucket
2832
@exclude_module.liberator_dump_to_rds_snapshot\[0\].aws_s3_bucket.cloudtrail
2933
@exclude_module.liberator_db_snapshot_to_s3\[0\].module.rds_export_storage.aws_s3_bucket.bucket
34+
# This rule checks for a separate sse block as supported by the s3 bucket module
3035
Scenario: Data must be encrypted at rest for buckets created using separate server side configuration resource
3136
Given I have aws_s3_bucket defined
3237
Then it must have aws_s3_bucket_server_side_encryption_configuration

‎terraform/core/05-departments.tf‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -405,6 +405,14 @@ module "department_housing" {
405405
departmental_airflow_user = true
406406
mwaa_etl_scripts_bucket_arn = aws_s3_bucket.mwaa_etl_scripts_bucket.arn
407407
mwaa_key_arn = aws_kms_key.mwaa_key.arn
408+
additional_s3_access = [
409+
{
410+
bucket_arn = module.housing_nec_migration_storage.bucket_arn
411+
kms_key_arn = module.housing_nec_migration_storage.kms_key_arn
412+
paths = []
413+
actions = ["s3:Get*", "s3:List*", "s3:Put*", "s3:Delete*"]
414+
}
415+
]
408416
}
409417

410418
module "department_children_and_education" {
@@ -572,4 +580,4 @@ module "department_children_family_services" {
572580
departmental_airflow_user = true
573581
mwaa_etl_scripts_bucket_arn = aws_s3_bucket.mwaa_etl_scripts_bucket.arn
574582
mwaa_key_arn = aws_kms_key.mwaa_key.arn
575-
}
583+
}

‎terraform/core/10-aws-s3-buckets.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -548,3 +548,15 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "addresses_api_rds
548548

549549
provider = aws.aws_api_account
550550
}
551+
552+
module "housing_nec_migration_storage" {
553+
source = "../modules/s3-bucket"
554+
555+
tags = module.tags.values
556+
project = var.project
557+
environment = var.environment
558+
identifier_prefix = local.identifier_prefix
559+
bucket_name = "Housing NEC Migration Storage"
560+
bucket_identifier = "housing-nec-migration-storage"
561+
include_backup_policy_tags = false
562+
}

‎terraform/etl/61-aws-glue-catalog-database.tf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,3 +13,11 @@ resource "aws_glue_catalog_database" "hackney_casemanagement_live" {
1313
prevent_destroy = true
1414
}
1515
}
16+
17+
resource "aws_glue_catalog_database" "housing_nec_migration_database" {
18+
name = "housing_nec_migration"
19+
20+
lifecycle {
21+
prevent_destroy = true
22+
}
23+
}

‎terraform/modules/department/02-inputs-optional.tf‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,3 +42,19 @@ variable "region" {
4242
type = string
4343
default = "eu-west-2"
4444
}
45+
46+
variable "additional_s3_access" {
47+
description = <<EOF
48+
Additional s3 access to grant to the department.
49+
To grant access to specific paths, provide a list of strings for 'paths'.
50+
If 'paths' is null or an empty list, access will be granted to the entire bucket.
51+
EOF
52+
type = list(object({
53+
bucket_arn = string
54+
kms_key_arn = string
55+
actions = list(string)
56+
paths = list(string)
57+
}))
58+
default = []
59+
}
60+

‎terraform/modules/department/50-aws-iam-policies.tf‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,21 @@ data "aws_iam_policy_document" "read_only_s3_department_access" {
3232
]
3333
}
3434

35+
dynamic "statement" {
36+
for_each = var.additional_s3_access
37+
iterator = additional_access_item
38+
content {
39+
sid = "AdditionalKmsReadOnlyAccess${replace(additional_access_item.value.bucket_arn, "/[^a-zA-Z0-9]/", "")}"
40+
effect = "Allow"
41+
actions = [
42+
"kms:Decrypt",
43+
"kms:GenerateDataKey*",
44+
"kms:DescribeKey",
45+
]
46+
resources = [additional_access_item.value.kms_key_arn]
47+
}
48+
}
49+
3550
statement {
3651
sid = "S3ReadAllDepartmentAreasInBuckets"
3752
effect = "Allow"
@@ -75,6 +90,27 @@ data "aws_iam_policy_document" "read_only_s3_department_access" {
7590
]
7691
}
7792

93+
dynamic "statement" {
94+
for_each = var.additional_s3_access
95+
iterator = additional_access_item
96+
content {
97+
sid = "AdditionalS3ReadOnlyAccess${replace(additional_access_item.value.bucket_arn, "/[^a-zA-Z0-9]/", "")}"
98+
effect = "Allow"
99+
actions = [
100+
"s3:Get*",
101+
"s3:List*",
102+
]
103+
resources = concat(
104+
[additional_access_item.value.bucket_arn],
105+
additional_access_item.value.paths == null ? [
106+
"${additional_access_item.value.bucket_arn}/*"
107+
] : [
108+
for path in additional_access_item.value.paths : "${additional_access_item.value.bucket_arn}/${path}/*"
109+
]
110+
)
111+
}
112+
}
113+
78114
statement {
79115
sid = "S3WriteToManualFolder"
80116
effect = "Allow"
@@ -179,6 +215,25 @@ data "aws_iam_policy_document" "s3_department_access" {
179215
]
180216
}
181217

218+
dynamic "statement" {
219+
for_each = var.additional_s3_access
220+
iterator = additional_access_item
221+
content {
222+
sid = "AdditionalKmsFullAccess${replace(additional_access_item.value.bucket_arn, "/[^a-zA-Z0-9]/", "")}"
223+
effect = "Allow"
224+
actions = [
225+
"kms:Encrypt",
226+
"kms:Decrypt",
227+
"kms:ReEncrypt*",
228+
"kms:GenerateDataKey*",
229+
"kms:DescribeKey",
230+
"kms:CreateGrant",
231+
"kms:RetireGrant"
232+
]
233+
resources = [additional_access_item.value.kms_key_arn]
234+
}
235+
}
236+
182237
statement {
183238
sid = "S3ReadAndWrite"
184239
effect = "Allow"
@@ -226,6 +281,24 @@ data "aws_iam_policy_document" "s3_department_access" {
226281
]
227282
}
228283

284+
dynamic "statement" {
285+
for_each = var.additional_s3_access
286+
iterator = additional_access_item
287+
content {
288+
sid = "AdditionalS3FullAccess${replace(additional_access_item.value.bucket_arn, "/[^a-zA-Z0-9]/", "")}"
289+
effect = "Allow"
290+
actions = additional_access_item.value.actions
291+
resources = concat(
292+
[additional_access_item.value.bucket_arn],
293+
additional_access_item.value.paths == null ? [
294+
"${additional_access_item.value.bucket_arn}/*"
295+
] : [
296+
for path in additional_access_item.value.paths : "${additional_access_item.value.bucket_arn}/${path}/*"
297+
]
298+
)
299+
}
300+
}
301+
229302
statement {
230303
sid = "ReadAllScripts"
231304
effect = "Allow"

0 commit comments

Comments
 (0)