Skip to content

Commit c2d75ab

Browse files
robertnovac1robertnovac1
committed
Refactoring and re-enabled policies
1 parent c031bae commit c2d75ab

File tree

13 files changed

+379
-113
lines changed

13 files changed

+379
-113
lines changed

‎infra/Makefile‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ workspace:
1919
init:
2020
$(tf_cmd) init $(tf_state) -upgrade $(tf_vars)
2121

22+
init-reconfigure:
23+
$(tf_cmd) init $(tf_state) -upgrade $(tf_vars) -reconfigure
24+
2225
plan: workspace
2326
$(tf_cmd) plan $(tf_vars)
2427

@@ -39,5 +42,8 @@ ifndef name
3942
endif
4043
$(tf_cmd) output -raw $(name)
4144

45+
import:
46+
$(tf_cmd) import $(tf_vars) $(to) $(id)
47+
4248
tf-%:
4349
$(tf_cmd) $*

‎infra/auto_ops_policy.json‎

Lines changed: 222 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,222 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Sid": "VisualEditor0",
6+
"Effect": "Allow",
7+
"Action": [
8+
"iam:CreateServiceSpecificCredential",
9+
"firehose:*",
10+
"iam:TagMFADevice",
11+
"iam:ListServiceSpecificCredentials",
12+
"iam:PutRolePolicy",
13+
"iam:ListSigningCertificates",
14+
"iam:AddRoleToInstanceProfile",
15+
"ses:SendEmail",
16+
"iam:SimulateCustomPolicy",
17+
"iam:ListRolePolicies",
18+
"iam:DeleteOpenIDConnectProvider",
19+
"iam:PutGroupPolicy",
20+
"iam:ListPolicies",
21+
"sns:*",
22+
"iam:GetRole",
23+
"iam:ListSAMLProviders",
24+
"apigateway:*",
25+
"iam:TagPolicy",
26+
"iam:UpdateServerCertificate",
27+
"cloudwatch:*",
28+
"pipes:*",
29+
"ecs:*",
30+
"ec2:*",
31+
"iam:GetOpenIDConnectProvider",
32+
"iam:UntagRole",
33+
"iam:PutRolePermissionsBoundary",
34+
"iam:TagRole",
35+
"cloudtrail:*",
36+
"iam:ResetServiceSpecificCredential",
37+
"iam:DeleteRolePermissionsBoundary",
38+
"iam:ListInstanceProfilesForRole",
39+
"iam:PassRole",
40+
"iam:DeleteRolePolicy",
41+
"kms:*",
42+
"iam:EnableMFADevice",
43+
"iam:ResyncMFADevice",
44+
"iam:ListCloudFrontPublicKeys",
45+
"guardduty:*",
46+
"iam:ListRoles",
47+
"iam:DeleteUser",
48+
"iam:GetContextKeysForCustomPolicy",
49+
"iam:CreatePolicy",
50+
"iam:CreateServiceLinkedRole",
51+
"iam:AttachGroupPolicy",
52+
"iam:DeleteVirtualMFADevice",
53+
"ecr:*",
54+
"iam:UpdateRole",
55+
"iam:UntagOpenIDConnectProvider",
56+
"iam:ListGroups",
57+
"iam:UntagInstanceProfile",
58+
"iam:DeleteServiceSpecificCredential",
59+
"iam:TagOpenIDConnectProvider",
60+
"iam:DeleteSAMLProvider",
61+
"iam:UpdateAssumeRolePolicy",
62+
"iam:GetPolicyVersion",
63+
"application-autoscaling:*",
64+
"iam:DeleteGroup",
65+
"iam:GetMFADevice",
66+
"iam:ListServerCertificates",
67+
"iam:RemoveRoleFromInstanceProfile",
68+
"iam:UpdateGroup",
69+
"dynamodb:*",
70+
"iam:ListVirtualMFADevices",
71+
"servicediscovery:*",
72+
"cloudfront:*",
73+
"iam:ListSSHPublicKeys",
74+
"iam:GetAccountEmailAddress",
75+
"iam:ListOpenIDConnectProviderTags",
76+
"config:*",
77+
"ebs:*",
78+
"iam:DeleteCloudFrontPublicKey",
79+
"events:*",
80+
"iam:ChangePassword",
81+
"iam:UpdateLoginProfile",
82+
"iam:GetServerCertificate",
83+
"iam:GetAccessKeyLastUsed",
84+
"iam:UpdateSSHPublicKey",
85+
"iam:UpdateAccountPasswordPolicy",
86+
"iam:DeleteServiceLinkedRole",
87+
"iam:ListSTSRegionalEndpointsStatus",
88+
"iam:GetAccountSummary",
89+
"iam:DeletePolicy",
90+
"iam:CreateVirtualMFADevice",
91+
"iam:ListMFADevices",
92+
"iam:AddUserToGroup",
93+
"tag:*",
94+
"iam:CreatePolicyVersion",
95+
"iam:GetInstanceProfile",
96+
"elasticloadbalancing:*",
97+
"iam:UntagServerCertificate",
98+
"iam:ListUserPolicies",
99+
"iam:TagUser",
100+
"iam:ListPolicyVersions",
101+
"iam:ListOpenIDConnectProviders",
102+
"lambda:*",
103+
"iam:ListUsers",
104+
"iam:UpdateSigningCertificate",
105+
"iam:ListUserTags",
106+
"iam:GetAccountPasswordPolicy",
107+
"iam:DeactivateMFADevice",
108+
"iam:DeleteAccessKey",
109+
"rds:*",
110+
"iam:ListRoleTags",
111+
"iam:UpdateCloudFrontPublicKey",
112+
"iam:GenerateServiceLastAccessedDetails",
113+
"iam:UpdateOpenIDConnectProviderThumbprint",
114+
"iam:SetSecurityTokenServicePreferences",
115+
"iam:DeleteServerCertificate",
116+
"quicksight:*",
117+
"iam:UploadSSHPublicKey",
118+
"iam:DetachGroupPolicy",
119+
"iam:GetCredentialReport",
120+
"iam:UpdateServiceSpecificCredential",
121+
"iam:GetPolicy",
122+
"iam:RemoveClientIDFromOpenIDConnectProvider",
123+
"iam:ListEntitiesForPolicy",
124+
"iam:DeleteRole",
125+
"iam:UpdateRoleDescription",
126+
"iam:UploadCloudFrontPublicKey",
127+
"iam:GetRolePolicy",
128+
"iam:CreateInstanceProfile",
129+
"iam:GenerateCredentialReport",
130+
"sqs:*",
131+
"iam:GetServiceLastAccessedDetails",
132+
"athena:*",
133+
"iam:GetServiceLinkedRoleDeletionStatus",
134+
"iam:ListAttachedGroupPolicies",
135+
"iam:ListPolicyTags",
136+
"iam:DeleteAccountAlias",
137+
"iam:UpdateSAMLProvider",
138+
"iam:ListAccessKeys",
139+
"iam:DeleteInstanceProfile",
140+
"elasticfilesystem:*",
141+
"cognito-identity:*",
142+
"s3:*",
143+
"iam:ListGroupPolicies",
144+
"ses:SendRawEmail",
145+
"iam:GetSSHPublicKey",
146+
"iam:PutUserPermissionsBoundary",
147+
"iam:DeleteUserPermissionsBoundary",
148+
"ssm:*",
149+
"iam:ListServerCertificateTags",
150+
"iam:PutUserPolicy",
151+
"iam:TagServerCertificate",
152+
"iam:ListAccountAliases",
153+
"iam:UntagPolicy",
154+
"iam:GetUser",
155+
"iam:GetLoginProfile",
156+
"acm:*",
157+
"iam:TagInstanceProfile",
158+
"iam:SetDefaultPolicyVersion",
159+
"logs:*",
160+
"iam:CreateRole",
161+
"iam:AttachRolePolicy",
162+
"iam:SetSTSRegionalEndpointStatus",
163+
"iam:TagSAMLProvider",
164+
"autoscaling:*",
165+
"iam:CreateLoginProfile",
166+
"iam:DetachRolePolicy",
167+
"iam:SimulatePrincipalPolicy",
168+
"secretsmanager:*",
169+
"iam:ListAttachedRolePolicies",
170+
"iam:CreateAccountAlias",
171+
"iam:ListSAMLProviderTags",
172+
"kinesis:*",
173+
"iam:DetachUserPolicy",
174+
"iam:GetAccountAuthorizationDetails",
175+
"iam:CreateGroup",
176+
"iam:UntagSAMLProvider",
177+
"iam:UpdateUser",
178+
"iam:DeleteUserPolicy",
179+
"iam:AttachUserPolicy",
180+
"iam:UpdateAccessKey",
181+
"iam:DeleteSigningCertificate",
182+
"iam:GetUserPolicy",
183+
"waf:*",
184+
"iam:ListGroupsForUser",
185+
"iam:GetAccountName",
186+
"cognito-idp:*",
187+
"iam:GetGroupPolicy",
188+
"iam:GetServiceLastAccessedDetailsWithEntities",
189+
"iam:ListPoliciesGrantingServiceAccess",
190+
"iam:DeleteSSHPublicKey",
191+
"iam:ListInstanceProfileTags",
192+
"iam:CreateUser",
193+
"iam:GetGroup",
194+
"glue:*",
195+
"iam:GetOrganizationsAccessReport",
196+
"iam:CreateAccessKey",
197+
"iam:GetContextKeysForPrincipalPolicy",
198+
"iam:UpdateAccountName",
199+
"iam:RemoveUserFromGroup",
200+
"wafv2:*",
201+
"iam:GetCloudFrontPublicKey",
202+
"iam:ListAttachedUserPolicies",
203+
"iam:UpdateAccountEmailAddress",
204+
"iam:GetSAMLProvider",
205+
"iam:DeleteLoginProfile",
206+
"iam:UploadSigningCertificate",
207+
"iam:DeleteAccountPasswordPolicy",
208+
"iam:ListInstanceProfiles",
209+
"iam:CreateOpenIDConnectProvider",
210+
"iam:UploadServerCertificate",
211+
"iam:UntagUser",
212+
"iam:UntagMFADevice",
213+
"route53:*",
214+
"iam:DeleteGroupPolicy",
215+
"iam:ListMFADeviceTags",
216+
"elasticache:*",
217+
"iam:DeletePolicyVersion"
218+
],
219+
"Resource": "*"
220+
}
221+
]
222+
}

‎infra/endpoints.tf‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -216,8 +216,7 @@ resource "aws_vpc_endpoint" "kinesis_stream_endpoint" {
216216

217217
# TODO - remove and use the key we manage in this Terraform workspace
218218
data "aws_kms_key" "existing_lambda_env_encryption" {
219-
count = local.account == "non-prod" ? 1 : 0
220-
219+
count = var.environment == "non-prod" ? 1 : 0
221220
key_id = "648c8c6f-54bf-4b79-ad72-0be6e8d72423"
222221
}
223222

@@ -243,14 +242,15 @@ resource "aws_vpc_endpoint" "kms_endpoint" {
243242
"kms:Encrypt",
244243
"kms:GenerateDataKey*"
245244
],
246-
Resource = local.account == "non-prod" ? [
245+
Resource = var.environment == "prod" ? [
247246
aws_kms_key.lambda_env_encryption.arn,
248-
#aws_kms_key.s3_shared_key.arn,
249-
data.aws_kms_key.existing_lambda_env_encryption[0].arn
250-
] : [
251-
aws_kms_key.lambda_env_encryption.arn
252-
#aws_kms_key.s3_shared_key.arn
253-
]
247+
aws_kms_key.s3_shared_key.arn
248+
] : concat([
249+
aws_kms_key.lambda_env_encryption.arn,
250+
aws_kms_key.s3_shared_key.arn
251+
], length(data.aws_kms_key.existing_lambda_env_encryption) > 0 ? [
252+
data.aws_kms_key.existing_lambda_env_encryption[0].arn
253+
] : [])
254254
}
255255
]
256256
})

‎infra/environments/int/variables.tfvars‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
1-
imms_account_id = 084828561157
2-
dspp_account_id = 603871901111
1+
imms_account_id = "084828561157"
2+
dspp_account_id = "603871901111"
33
admin_role = "aws-reserved/sso.amazonaws.com/eu-west-2/AWSReservedSSO_PREPROD-IMMS-Admin_acce656dcacf6f4c"
4-
dev_ops_role = "DevOps"
4+
dev_ops_role = "aws-reserved/sso.amazonaws.com/eu-west-2/AWSReservedSSO_PREPROD-IMMS-Devops_1d28e4f37b940bcd"
55
auto_ops_role = "auto-ops"
6+
dspp_admin_role = "root"
7+
environment = "int"

infra/environments/dev/variables.tfvars renamed to infra/environments/non-prod/variables.tfvars

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
1-
imms_account_id = 345594581768
2-
dspp_account_id = 603871901111
1+
imms_account_id = "345594581768"
2+
dspp_account_id = "603871901111"
33
admin_role = "root" # We shouldn't be using the root account. There should be an Admin role
44
dev_ops_role = "DevOps"
55
auto_ops_role = "auto-ops"
6+
dspp_admin_role = "root"
7+
environment = "non-prod"

‎infra/environments/prod/variables.tfvars‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
1-
imms_account_id = 664418956997
2-
dspp_account_id = 232116723729
1+
imms_account_id = "664418956997"
2+
dspp_account_id = "232116723729"
33
# TODO: Fill in the values below
4-
admin_role = ""
5-
dev_ops_role = ""
6-
auto_ops_role = ""
4+
admin_role = "" # We shouldn't be using the root account. There should be an Admin role
5+
dev_ops_role = ""
6+
auto_ops_role = "auto-ops"
7+
dspp_admin_role = "root"
8+
environment = "prod"

‎infra/kinesis_role.tf‎

Lines changed: 0 additions & 39 deletions
This file was deleted.

0 commit comments

Comments
 (0)