Fix policy length (#2499)

* break up large inline policy to multiple managed policies

* add notebook conditions

Author: timburke-hackit

terraform/modules/department/50-aws-iam-roles.tf

@@ -1,27 +1,25 @@
-// User Role for staging account - This role is a combination of policies ready to be applied to SSO
-data "aws_iam_policy_document" "sso_staging_user_policy" {
-  override_policy_documents = local.create_notebook ? [
-    data.aws_iam_policy_document.s3_department_access.json,
-    data.aws_iam_policy_document.glue_access.json,
-    data.aws_iam_policy_document.secrets_manager_read_only.json,
+data "aws_iam_policy_document" "sso_staging_additional_with_notebook" {
+  count = local.create_notebook ? 1 : 0
+
+  override_policy_documents = [
     data.aws_iam_policy_document.redshift_department_read_access.json,
     data.aws_iam_policy_document.notebook_access[0].json
-    ] : [
-    data.aws_iam_policy_document.s3_department_access.json,
-    data.aws_iam_policy_document.glue_access.json,
-    data.aws_iam_policy_document.secrets_manager_read_only.json,
+  ]
+}
+
+data "aws_iam_policy_document" "sso_staging_additional" {
+  count = local.create_notebook ? 0 : 1
+
+  override_policy_documents = [
     data.aws_iam_policy_document.redshift_department_read_access.json,
     data.aws_iam_policy_document.mwaa_department_web_server_access.json
   ]
 }
 
-// User Role for production account - This role is a combination of policies ready to be applied to SSO
-data "aws_iam_policy_document" "sso_production_user_policy" {
+data "aws_iam_policy_document" "sso_production_additional" {
   override_policy_documents = [
-    data.aws_iam_policy_document.read_only_s3_department_access.json,
-    data.aws_iam_policy_document.read_only_glue_access.json,
-    data.aws_iam_policy_document.secrets_manager_read_only.json,
-    data.aws_iam_policy_document.athena_can_write_to_s3.json
+    data.aws_iam_policy_document.athena_can_write_to_s3.json,
+    data.aws_iam_policy_document.redshift_department_read_access.json
   ]
 }
 

terraform/modules/department/60-aws-sso.tf

@@ -15,14 +15,59 @@ resource "aws_ssoadmin_permission_set" "department" {
   tags             = var.tags
 }
 
-resource "aws_ssoadmin_permission_set_inline_policy" "department" {
+resource "aws_ssoadmin_managed_policy_attachment" "department_s3" {
   count = local.deploy_sso ? 1 : 0
 
   provider = aws.aws_hackit_account
 
-  inline_policy      = var.environment == "stg" ? data.aws_iam_policy_document.sso_staging_user_policy.json : data.aws_iam_policy_document.sso_production_user_policy.json
   instance_arn       = var.sso_instance_arn
   permission_set_arn = aws_ssoadmin_permission_set.department[0].arn
+  managed_policy_arn = var.environment == "stg" ? aws_iam_policy.s3_access.arn : aws_iam_policy.read_only_s3_access.arn
+}
+
+resource "aws_ssoadmin_managed_policy_attachment" "department_glue" {
+  count = local.deploy_sso ? 1 : 0
+
+  provider = aws.aws_hackit_account
+
+  instance_arn       = var.sso_instance_arn
+  permission_set_arn = aws_ssoadmin_permission_set.department[0].arn
+  managed_policy_arn = var.environment == "stg" ? aws_iam_policy.glue_access.arn : aws_iam_policy.read_only_glue_access.arn
+}
+
+resource "aws_ssoadmin_managed_policy_attachment" "department_secrets" {
+  count = local.deploy_sso ? 1 : 0
+
+  provider = aws.aws_hackit_account
+
+  instance_arn       = var.sso_instance_arn
+  permission_set_arn = aws_ssoadmin_permission_set.department[0].arn
+  managed_policy_arn = aws_iam_policy.secrets_manager_read_only.arn
+}
+
+resource "aws_iam_policy" "sso_department_additional_policy" {
+  count = local.deploy_sso ? 1 : 0
+
+  name        = lower("${var.identifier_prefix}-${local.department_identifier}-sso-additional-policy")
+  description = "Additional SSO policy for ${local.department_identifier} department in ${var.environment} environment"
+  policy = var.environment == "stg" ? (
+    local.create_notebook ?
+    data.aws_iam_policy_document.sso_staging_additional_with_notebook[0].json :
+    data.aws_iam_policy_document.sso_staging_additional[0].json
+    ) : (
+    data.aws_iam_policy_document.sso_production_additional.json
+  )
+  tags = var.tags
+}
+
+resource "aws_ssoadmin_managed_policy_attachment" "department_additional" {
+  count = local.deploy_sso ? 1 : 0
+
+  provider = aws.aws_hackit_account
+
+  instance_arn       = var.sso_instance_arn
+  permission_set_arn = aws_ssoadmin_permission_set.department[0].arn
+  managed_policy_arn = aws_iam_policy.sso_department_additional_policy[0].arn
 }
 
 data "aws_identitystore_group" "department" {