eli-510 adding appropriate github oidc role permissions + permissions boundary

Author: eddalmond1

infrastructure/stacks/iams-developer-roles/github_actions_policies.tf

@@ -115,7 +115,7 @@ resource "aws_iam_policy" "dynamodb_management" {
         }
       ],
       # to create test users in preprod
-        var.environment == "preprod" ? [
+      var.environment == "preprod" ? [
         {
           Effect = "Allow",
           Action = [
@@ -249,7 +249,11 @@ resource "aws_iam_policy" "api_infrastructure" {
           # CloudWatch Logs creation and management
           "logs:CreateLogGroup",
           "logs:CreateLogStream",
-          "logs:PutLogEvents"
+          "logs:PutLogEvents",
+          # CloudWatch Logs subscription filters for CSOC forwarding
+          "logs:PutSubscriptionFilter",
+          "logs:DeleteSubscriptionFilter",
+          "logs:DescribeSubscriptionFilters"
         ],
         Resource = [
           # VPC Flow Logs
@@ -279,7 +283,9 @@ resource "aws_iam_policy" "api_infrastructure" {
           "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/eventbridge-firehose-role*",
           # Kinesis Firehose S3 backup roles
           "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/*firehose*role*",
-          "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/splunk-firehose-assume-role*"
+          "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/splunk-firehose-assume-role*",
+          # CSOC CloudWatch Logs subscription role
+          "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/*-CWLogsSubscriptionRole"
         ],
         Condition = {
           StringEquals = {
@@ -288,7 +294,8 @@ resource "aws_iam_policy" "api_infrastructure" {
               "apigateway.amazonaws.com",
               "vpc-flow-logs.amazonaws.com",
               "events.amazonaws.com",
-              "firehose.amazonaws.com"
+              "firehose.amazonaws.com",
+              "logs.amazonaws.com"
             ]
           }
         }
@@ -477,9 +484,12 @@ resource "aws_iam_policy" "iam_management" {
           "arn:aws:iam::*:role/*-api-gateway-*-role",
           # External write role
           "arn:aws:iam::*:role/eligibility-signposting-api-*-external-write-role",
+          # CSOC CloudWatch Logs subscription role
+          "arn:aws:iam::*:role/*-CWLogsSubscriptionRole",
           # Project policies
           "arn:aws:iam::*:policy/*api-gateway-logging-policy",
           "arn:aws:iam::*:policy/*PermissionsBoundary",
+          "arn:aws:iam::*:policy/*PutSubscriptionFilterPolicy",
           # VPC flow logs role
           "arn:aws:iam::*:role/vpc-flow-logs-role",
           # API role
@@ -500,8 +510,8 @@ resource "aws_iam_policy" "iam_management" {
 # Assume role policy document for GitHub Actions
 data "aws_iam_policy_document" "github_actions_assume_role" {
   statement {
-    sid    = "OidcAssumeRoleWithWebIdentity"
-    effect = "Allow"
+    sid     = "OidcAssumeRoleWithWebIdentity"
+    effect  = "Allow"
     actions = ["sts:AssumeRoleWithWebIdentity"]
 
     principals {
@@ -514,13 +524,13 @@ data "aws_iam_policy_document" "github_actions_assume_role" {
     condition {
       test     = "StringLike"
       variable = "token.actions.githubusercontent.com:sub"
-      values = ["repo:${var.github_org}/${var.github_repo}:*"]
+      values   = ["repo:${var.github_org}/${var.github_repo}:*"]
     }
 
     condition {
       test     = "StringEquals"
       variable = "token.actions.githubusercontent.com:aud"
-      values = ["sts.amazonaws.com"]
+      values   = ["sts.amazonaws.com"]
     }
   }
 }

infrastructure/stacks/iams-developer-roles/iams_permissions_boundary.tf

@@ -177,6 +177,9 @@ data "aws_iam_policy_document" "permissions_boundary" {
       "logs:PutRetentionPolicy",
       "logs:AssociateKmsKey",
       "logs:PutMetricFilter",
+      "logs:PutSubscriptionFilter",
+      "logs:DeleteSubscriptionFilter",
+      "logs:DescribeSubscriptionFilters",
 
       # S3 - bucket and object management
       "s3:GetLifecycleConfiguration",