Skip to content

Commit 665df11

Browse files
KarthikeyannhsKarthikeyannhs
authored
eli- 546 create hashing secrets (#479)
* ELI 546 - Create hashing secrets in aws secret manager * ELI 546 - added initial secrets, added kms encryptions * ELI 546 - adding string secret * ELI 546 - secret manager access to Lambda Role * ELI 546 - checkov suppressions * ELI 546 - checkov suppressions * ELI 546 - firehose checkov suppressions * ELI 546 -add more permissions in permission boundary * ELI 546 - ignore secret changes * ELI 546 - adding permissions to the role * ELI 546 - adding permissions to the role - fix * ELI 546 - adding permissions to the role - fix * ELI 546 - adding permissions to the role - fix * ELI 546 - adding permissions to the role - fix * ELI 546 - adding permissions to the role - fix * ELI 546 - adding permissions to the role - fix * ELI 546 - adding permissions to the role - fix
1 parent daf800a commit 665df11

File tree

10 files changed

+172
-2
lines changed

10 files changed

+172
-2
lines changed

‎infrastructure/modules/secrets_manager/data.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
data "aws_caller_identity" "current" {}

‎infrastructure/modules/secrets_manager/default_variables.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../_shared/default_variables.tf

‎infrastructure/modules/secrets_manager/kms.tf‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# KMS CMK to encrypt/decrypt secrets
2+
resource "aws_kms_key" "secrets_cmk" {
3+
#checkov:skip=CKV_AWS_111: Root user needs full KMS key management
4+
#checkov:skip=CKV_AWS_356: Root user needs full KMS key management
5+
#checkov:skip=CKV_AWS_109: Root user needs full KMS key management
6+
description = "CMK for Secrets Manager - ${var.project_name}-${var.environment}"
7+
enable_key_rotation = true
8+
deletion_window_in_days = 30
9+
policy = jsonencode({
10+
Version = "2012-10-17"
11+
Statement = [
12+
# Allow your account root full control
13+
{
14+
Sid = "AllowAccountAdminsFullAccess"
15+
Effect = "Allow"
16+
Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" }
17+
Action = "kms:*"
18+
Resource = "*"
19+
},
20+
# Allow Secrets Manager service to use the key
21+
{
22+
Sid = "AllowSecretsManagerServiceUse"
23+
Effect = "Allow"
24+
Principal = { Service = "secretsmanager.amazonaws.com" }
25+
Action = [
26+
"kms:Encrypt",
27+
"kms:Decrypt",
28+
"kms:GenerateDataKey",
29+
"kms:GenerateDataKeyWithoutPlaintext",
30+
"kms:DescribeKey"
31+
]
32+
Resource = "*"
33+
},
34+
# Allow external role to decrypt for reading the secret
35+
{
36+
Sid = "AllowExternalRoleDecrypt"
37+
Effect = "Allow"
38+
Principal = { AWS = var.external_write_access_role_arn }
39+
Action = [
40+
"kms:Decrypt",
41+
"kms:DescribeKey"
42+
]
43+
Resource = "*"
44+
},
45+
# Allow Lambda role to decrypt for reading the secret
46+
{
47+
Sid = "AllowLambdaRoleDecrypt"
48+
Effect = "Allow"
49+
Principal = { AWS = var.eligibility_lambda_role_arn }
50+
Action = [
51+
"kms:Decrypt",
52+
"kms:DescribeKey"
53+
]
54+
Resource = "*"
55+
}
56+
]
57+
})
58+
tags = var.tags
59+
}

‎infrastructure/modules/secrets_manager/secrets_manager.tf‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# Secret definition in your account
2+
resource "aws_secretsmanager_secret" "hashing_secret" {
3+
#checkov:skip=CKV2_AWS_57: Secret rotations are handled manually
4+
name = "${var.project_name}-${var.environment}/hashing_secret"
5+
description = "cross account hashing secrets"
6+
kms_key_id = aws_kms_key.secrets_cmk.arn
7+
tags = {
8+
Environment = var.environment
9+
ManagedBy = "terraform"
10+
}
11+
}
12+
13+
# Initial secrets
14+
resource "aws_secretsmanager_secret_version" "hashing_secrets_test" {
15+
secret_id = aws_secretsmanager_secret.hashing_secret.id
16+
secret_string = "initial_secret"
17+
lifecycle {
18+
ignore_changes = [secret_string]
19+
}
20+
}
21+
22+
# Resource-based policy attached to the secret
23+
resource "aws_secretsmanager_secret_policy" "hashing_secret_policy" {
24+
secret_arn = aws_secretsmanager_secret.hashing_secret.arn
25+
26+
policy = jsonencode({
27+
Version = "2012-10-17",
28+
Statement = [
29+
{
30+
Sid = "CrossAccountAccess",
31+
Effect = "Allow",
32+
Principal = { AWS = var.external_write_access_role_arn },
33+
Action = [
34+
"secretsmanager:GetSecretValue",
35+
"secretsmanager:DescribeSecret"
36+
],
37+
Resource = "*"
38+
},
39+
{
40+
Sid = "LambdaAccess",
41+
Effect = "Allow",
42+
Principal = { AWS = var.eligibility_lambda_role_arn },
43+
Action = [
44+
"secretsmanager:GetSecretValue",
45+
"secretsmanager:DescribeSecret"
46+
],
47+
Resource = "*"
48+
}
49+
]
50+
})
51+
}
52+

‎infrastructure/modules/secrets_manager/variables.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
variable "external_write_access_role_arn" {
2+
description = "Arn of the external write access role to provide secret manager access"
3+
type = string
4+
}
5+
6+
variable "eligibility_lambda_role_arn" {
7+
description = "Arn of the lambda role to provide secret manager access"
8+
type = string
9+
}

‎infrastructure/stacks/api-layer/assumed_role_permissions_boundary.tf‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,11 @@ data "aws_iam_policy_document" "assumed_role_permissions_boundary" {
5656

5757
# X-Ray - Lambda tracing
5858
"xray:PutTraceSegments",
59-
"xray:PutTelemetryRecords"
59+
"xray:PutTelemetryRecords",
60+
61+
# Secret Manager
62+
"secretsmanager:GetSecretValue",
63+
"secretsmanager:DescribeSecret"
6064
]
6165

6266
resources = ["*"]

‎infrastructure/stacks/api-layer/iam_policies.tf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -291,6 +291,8 @@ resource "aws_kms_key_policy" "s3_rules_kms_key" {
291291
}
292292

293293
resource "aws_iam_role_policy" "splunk_firehose_policy" {
294+
#checkov:skip=CKV_AWS_290: Firehose requires write access to dynamic log streams without static constraints
295+
#checkov:skip=CKV_AWS_355: Firehose logging requires wildcard resource for CloudWatch log groups/streams
294296
name = "splunk-firehose-policy"
295297
role = aws_iam_role.splunk_firehose_assume_role.id
296298

‎infrastructure/stacks/api-layer/secrets_manager.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
module "secrets_manager" {
2+
source = "../../modules/secrets_manager"
3+
count = length(aws_iam_role.write_access_role)
4+
external_write_access_role_arn = aws_iam_role.write_access_role[count.index].arn
5+
environment = var.environment
6+
stack_name = local.stack_name
7+
workspace = terraform.workspace
8+
eligibility_lambda_role_arn = aws_iam_role.eligibility_lambda_role.arn
9+
}

‎infrastructure/stacks/iams-developer-roles/github_actions_policies.tf‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,26 @@ resource "aws_iam_policy" "dynamodb_management" {
112112
Resource = [
113113
"arn:aws:dynamodb:*:${data.aws_caller_identity.current.account_id}:table/*eligibility-signposting-api-${var.environment}-eligibility_datastore"
114114
]
115+
},
116+
117+
{
118+
Effect = "Allow",
119+
Action = [
120+
"secretsmanager:CreateSecret",
121+
"secretsmanager:DeleteSecret",
122+
"secretsmanager:GetSecretValue",
123+
"secretsmanager:PutSecretValue",
124+
"secretsmanager:TagResource",
125+
"secretsmanager:UntagResource",
126+
"secretsmanager:ListTagsOfResource",
127+
"secretsmanager:DescribeSecret",
128+
"secretsmanager:GetResourcePolicy",
129+
"secretsmanager:PutResourcePolicy",
130+
"secretsmanager:DeleteResourcePolicy"
131+
],
132+
Resource = [
133+
"arn:aws:secretsmanager:*:${data.aws_caller_identity.current.account_id}:secret:eligibility-signposting-api-${var.environment}/*"
134+
]
115135
}
116136
],
117137
# to create test users in preprod

‎infrastructure/stacks/iams-developer-roles/iams_permissions_boundary.tf‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -244,7 +244,20 @@ data "aws_iam_policy_document" "permissions_boundary" {
244244
"wafv2:DisassociateWebACL",
245245
"wafv2:PutLoggingConfiguration",
246246
"wafv2:GetLoggingConfiguration",
247-
"wafv2:DeleteLoggingConfiguration"
247+
"wafv2:DeleteLoggingConfiguration",
248+
249+
# Secret Manager
250+
"secretsmanager:CreateSecret",
251+
"secretsmanager:DeleteSecret",
252+
"secretsmanager:GetSecretValue",
253+
"secretsmanager:PutSecretValue",
254+
"secretsmanager:TagResource",
255+
"secretsmanager:UntagResource",
256+
"secretsmanager:ListTagsOfResource",
257+
"secretsmanager:DescribeSecret",
258+
"secretsmanager:GetResourcePolicy",
259+
"secretsmanager:PutResourcePolicy",
260+
"secretsmanager:DeleteResourcePolicy"
248261
]
249262

250263
resources = ["*"]

0 commit comments

Comments
 (0)