Permissions and naming

Author: robertnovac1

infra/roles.tf

@@ -59,6 +59,14 @@ resource "aws_iam_role" "auto_ops" {
           AWS = "arn:aws:iam::${var.build_agent_account_id}:role/build-agent"
         },
         Action = "sts:AssumeRole"
+      },
+      {
+        Sid    = ""
+        Effect = "Allow",
+        Principal = {
+          AWS = "arn:aws:iam::${var.imms_account_id}:role/DevOps"
+        },
+        Action = "sts:AssumeRole"
       }
     ]
   })

infra_old_prod/kms_dynamo.tf

@@ -50,7 +50,17 @@ resource "aws_kms_key" "dynamodb_encryption" {
       ],
       "Resource": "*"
     },
-        {
+    {
+      "Sid": "KMS KeyUser access for Admin",
+      "Effect": "Allow",
+      "Principal": { "AWS": ["arn:aws:iam::084828561157:role/aws-reserved/sso.amazonaws.com/eu-west-2/AWSReservedSSO_PREPROD-IMMS-Admin_acce656dcacf6f4c"] },
+      "Action": [
+        "kms:Encrypt",
+        "kms:GenerateDataKey*"
+      ],
+      "Resource": "*"
+    },
+    {
       "Sid": "AllowAccountA",
       "Effect": "Allow",
       "Principal": {

infra_old_prod/kms_kinesis.tf

@@ -49,6 +49,16 @@ resource "aws_kms_key" "kinesis_stream_encryption" {
         "kms:GenerateDataKey*"
         ],
     "Resource": "*"
+    },
+    {
+      "Sid": "KMS KeyUser access for Admin",
+      "Effect": "Allow",
+      "Principal": { "AWS": ["arn:aws:iam::084828561157:role/aws-reserved/sso.amazonaws.com/eu-west-2/AWSReservedSSO_PREPROD-IMMS-Admin_acce656dcacf6f4c"] },
+      "Action": [
+        "kms:Encrypt",
+        "kms:GenerateDataKey*"
+      ],
+      "Resource": "*"
     }
  ]
 }

infra_old_prod/kms_lambda.tf

@@ -49,6 +49,16 @@ resource "aws_kms_key" "lambda_env_encryption" {
         "kms:GenerateDataKey*"
         ],
     "Resource": "*"
+    },
+    {
+      "Sid": "KMS KeyUser access for Admin",
+      "Effect": "Allow",
+      "Principal": { "AWS": ["arn:aws:iam::084828561157:role/aws-reserved/sso.amazonaws.com/eu-west-2/AWSReservedSSO_PREPROD-IMMS-Admin_acce656dcacf6f4c"] },
+      "Action": [
+        "kms:Encrypt",
+        "kms:GenerateDataKey*"
+      ],
+      "Resource": "*"
     }
  ]
 }

infra_old_prod/kms_s3.tf

@@ -41,7 +41,17 @@ resource "aws_kms_key" "s3_shared_key" {
        "kms:GenerateDataKey*"
      ],
      "Resource": "*"
-   }
+   },
+   {
+      "Sid": "KMS KeyUser access for Admin",
+      "Effect": "Allow",
+      "Principal": { "AWS": ["arn:aws:iam::084828561157:role/aws-reserved/sso.amazonaws.com/eu-west-2/AWSReservedSSO_PREPROD-IMMS-Admin_acce656dcacf6f4c"] },
+      "Action": [
+        "kms:Encrypt",
+        "kms:GenerateDataKey*"
+      ],
+      "Resource": "*"
+    }
  ]
 }
 POLICY

infra_old_prod/roles.tf

@@ -59,6 +59,14 @@ resource "aws_iam_role" "auto_ops" {
           AWS = "arn:aws:iam::${var.build_agent_account_id}:role/build-agent"
         },
         Action = "sts:AssumeRole"
+      },
+      {
+        Sid    = ""
+        Effect = "Allow",
+        Principal = {
+          AWS = "arn:aws:iam::${var.imms_account_id}:role/DevOps"
+        },
+        Action = "sts:AssumeRole"
       }
     ]
   })

terraform_old/variables.tf

@@ -2,10 +2,10 @@ variable "profile" {
   default = "apim-dev"
 }
 variable "aws_account_name" {
-  default = "non-prod"
+  default = "int"
 }
 variable "project_name" {
-  default = "immunisations"
+  default = "immunisation"
 }
 
 variable "project_short_name" {
@@ -19,7 +19,7 @@ variable "service" {
 data "aws_vpc" "default" {
   filter {
     name   = "tag:Name"
-    values = [local.vpc_name]
+    values = ["imms-${var.aws_account_name}-fhir-api-vpc"]
   }
 }
 
@@ -38,18 +38,19 @@ locals {
   project_domain_name = data.aws_route53_zone.project_zone.name
 }
 
+
 locals {
+  local_config            = "int"
   environment             = var.aws_account_name
   env                     = terraform.workspace
-  prefix                  = "${var.project_name}-${var.service}-${local.env}"
-  short_prefix            = "${var.project_short_name}-${local.env}"
-  batch_prefix            = "immunisation-batch-${local.env}"
-  service_domain_name     = "${local.env}.${local.project_domain_name}"
   config_env              = local.environment
-  vpc_name                = "imms-${local.config_env}-fhir-api-vpc"
+  prefix                  = "${var.project_name}-${var.service}-${local.env}-${local.local_config}"
+  short_prefix            = "${var.project_short_name}-${local.env}-${local.local_config}"
+  batch_prefix            = "immunisation-batch-${local.env}-${local.local_config}"
+  service_domain_name     = "${local.env}.${local.project_domain_name}"
   immunisation_account_id = "084828561157"
   dspp_core_account_id    = "603871901111"
-  local_config            = "int"
+
   tags = {
     Project     = var.project_name
     Environment = local.environment