Skip to content

Commit 56e520b

Browse files
tim-knight-nhstim-knight-nhs
committed
[ndr-297] relocated policy to avoid size limit
1 parent b90318e commit 56e520b

File tree

1 file changed

+114
-96
lines changed

1 file changed

+114
-96
lines changed

‎pre_core/iam_github_dev.tf‎

Lines changed: 114 additions & 96 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ resource "aws_iam_role" "github_role_dev" {
3838
managed_policy_arns = [
3939
# aws_iam_policy.config_policy_dev[0].arn,
4040
# aws_iam_policy.ecr_github_access_policy_dev[0].arn,
41-
# aws_iam_policy.github_actions_terraform_full_dev[0].arn,
41+
aws_iam_policy.github_actions_terraform_full_dev[0].arn,
4242
# aws_iam_policy.github_mtls_gateway_dev[0].arn,
4343
# aws_iam_policy.github_terraform_tagging_policy_dev[0].arn,
4444
# aws_iam_policy.lambda_github_access_policy_dev[0].arn,
@@ -267,6 +267,117 @@ resource "aws_iam_role" "github_role_dev" {
267267
}
268268
)
269269
}
270+
271+
272+
273+
274+
275+
inline_policy {
276+
name = "github_terraform_tagging_policy"
277+
policy = jsonencode(
278+
{
279+
Statement = [
280+
{
281+
Action = [
282+
"sns:TagResource",
283+
"backup:TagResource",
284+
"resource-groups:GetGroupQuery",
285+
"lambda:TagResource",
286+
"resource-groups:UpdateGroup",
287+
"iam:UntagRole",
288+
"iam:TagRole",
289+
"resource-groups:GetTags",
290+
"sns:UntagResource",
291+
"resource-groups:Untag",
292+
"lambda:UntagResource",
293+
"elasticloadbalancing:RemoveTags",
294+
"cognito-identity:UntagResource",
295+
"resource-groups:GetGroup",
296+
"resource-groups:GetGroupConfiguration",
297+
"backup:UntagResource",
298+
"cognito-identity:TagResource",
299+
"resource-groups:Tag",
300+
"resource-groups:UpdateGroupQuery",
301+
"iam:TagPolicy",
302+
"resource-groups:DeleteGroup",
303+
"events:TagResource",
304+
"elasticloadbalancing:AddTags",
305+
"iam:UntagPolicy",
306+
"resource-groups:ListGroupResources",
307+
"events:UntagResource",
308+
]
309+
Effect = "Allow"
310+
Resource = [
311+
"arn:aws:lambda:*:${data.aws_caller_identity.current.account_id}:event-source-mapping:*",
312+
"arn:aws:lambda:*:${data.aws_caller_identity.current.account_id}:function:*",
313+
"arn:aws:lambda:*:${data.aws_caller_identity.current.account_id}:code-signing-config:*",
314+
"arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/*",
315+
"arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/*",
316+
"arn:aws:sns:*:${data.aws_caller_identity.current.account_id}:*",
317+
"arn:aws:backup:*:${data.aws_caller_identity.current.account_id}:legal-hold:*",
318+
"arn:aws:backup:*:${data.aws_caller_identity.current.account_id}:framework:*-*",
319+
"arn:aws:backup:*:${data.aws_caller_identity.current.account_id}:backup-vault:*",
320+
"arn:aws:backup:*:${data.aws_caller_identity.current.account_id}:report-plan:*-*",
321+
"arn:aws:backup:*:${data.aws_caller_identity.current.account_id}:backup-plan:*",
322+
"arn:aws:backup:*:${data.aws_caller_identity.current.account_id}:restore-testing-plan:*-*",
323+
"arn:aws:cognito-identity:*:${data.aws_caller_identity.current.account_id}:identitypool/*",
324+
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:loadbalancer/gwy/*/*",
325+
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:loadbalancer/net/*/*",
326+
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:loadbalancer/app/*/*",
327+
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:truststore/*/*",
328+
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:listener/app/*/*/*",
329+
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:listener/gwy/*/*/*",
330+
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:listener-rule/net/*/*/*/*",
331+
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:listener/net/*/*/*",
332+
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:listener-rule/app/*/*/*/*",
333+
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:targetgroup/*/*",
334+
"arn:aws:resource-groups:*:${data.aws_caller_identity.current.account_id}:group/*",
335+
"arn:aws:events:*:${data.aws_caller_identity.current.account_id}:event-bus/*",
336+
"arn:aws:events:*:${data.aws_caller_identity.current.account_id}:rule/*/*",
337+
]
338+
Sid = "VisualEditor0"
339+
},
340+
{
341+
Action = [
342+
"events:TagResource",
343+
"elasticloadbalancing:RemoveTags",
344+
"elasticloadbalancing:AddTags",
345+
"events:UntagResource",
346+
]
347+
Effect = "Allow"
348+
Resource = [
349+
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:loadbalancer/gwy/*/*",
350+
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:truststore/*/*",
351+
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:listener/app/*/*/*",
352+
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:listener/gwy/*/*/*",
353+
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:listener/net/*/*/*",
354+
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:listener-rule/net/*/*/*/*",
355+
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:listener-rule/app/*/*/*/*",
356+
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:targetgroup/*/*",
357+
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:loadbalancer/net/*/*",
358+
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:loadbalancer/app/*/*",
359+
"arn:aws:events:*:${data.aws_caller_identity.current.account_id}:rule/*",
360+
]
361+
Sid = "VisualEditor1"
362+
},
363+
{
364+
Action = [
365+
"resource-groups:SearchResources",
366+
"resource-groups:CreateGroup",
367+
"resource-groups:ListGroups",
368+
]
369+
Effect = "Allow"
370+
Resource = "*"
371+
Sid = "VisualEditor2"
372+
},
373+
]
374+
Version = "2012-10-17"
375+
}
376+
)
377+
}
378+
379+
380+
270381
}
271382

272383

@@ -532,7 +643,7 @@ resource "aws_iam_policy" "github_actions_terraform_full_dev" {
532643
# config_policy
533644
# ecr_github_access_policy
534645
# github_mtls_gateway
535-
# github_terraform_tagging_policy
646+
# github_terraform_tagging_policy - Moved to inline
536647
# lambda_github_access_policy
537648
# repo_app_config
538649
# terraform_github_dynamodb_access_policy
@@ -635,99 +746,6 @@ resource "aws_iam_policy" "github_actions_extended" {
635746
},
636747

637748

638-
{
639-
Action = [
640-
"sns:TagResource",
641-
"backup:TagResource",
642-
"resource-groups:GetGroupQuery",
643-
"lambda:TagResource",
644-
"resource-groups:UpdateGroup",
645-
"iam:UntagRole",
646-
"iam:TagRole",
647-
"resource-groups:GetTags",
648-
"sns:UntagResource",
649-
"resource-groups:Untag",
650-
"lambda:UntagResource",
651-
"elasticloadbalancing:RemoveTags",
652-
"cognito-identity:UntagResource",
653-
"resource-groups:GetGroup",
654-
"resource-groups:GetGroupConfiguration",
655-
"backup:UntagResource",
656-
"cognito-identity:TagResource",
657-
"resource-groups:Tag",
658-
"resource-groups:UpdateGroupQuery",
659-
"iam:TagPolicy",
660-
"resource-groups:DeleteGroup",
661-
"events:TagResource",
662-
"elasticloadbalancing:AddTags",
663-
"iam:UntagPolicy",
664-
"resource-groups:ListGroupResources",
665-
"events:UntagResource",
666-
]
667-
Effect = "Allow"
668-
Resource = [
669-
"arn:aws:lambda:*:${data.aws_caller_identity.current.account_id}:event-source-mapping:*",
670-
"arn:aws:lambda:*:${data.aws_caller_identity.current.account_id}:function:*",
671-
"arn:aws:lambda:*:${data.aws_caller_identity.current.account_id}:code-signing-config:*",
672-
"arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/*",
673-
"arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/*",
674-
"arn:aws:sns:*:${data.aws_caller_identity.current.account_id}:*",
675-
"arn:aws:backup:*:${data.aws_caller_identity.current.account_id}:legal-hold:*",
676-
"arn:aws:backup:*:${data.aws_caller_identity.current.account_id}:framework:*-*",
677-
"arn:aws:backup:*:${data.aws_caller_identity.current.account_id}:backup-vault:*",
678-
"arn:aws:backup:*:${data.aws_caller_identity.current.account_id}:report-plan:*-*",
679-
"arn:aws:backup:*:${data.aws_caller_identity.current.account_id}:backup-plan:*",
680-
"arn:aws:backup:*:${data.aws_caller_identity.current.account_id}:restore-testing-plan:*-*",
681-
"arn:aws:cognito-identity:*:${data.aws_caller_identity.current.account_id}:identitypool/*",
682-
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:loadbalancer/gwy/*/*",
683-
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:loadbalancer/net/*/*",
684-
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:loadbalancer/app/*/*",
685-
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:truststore/*/*",
686-
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:listener/app/*/*/*",
687-
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:listener/gwy/*/*/*",
688-
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:listener-rule/net/*/*/*/*",
689-
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:listener/net/*/*/*",
690-
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:listener-rule/app/*/*/*/*",
691-
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:targetgroup/*/*",
692-
"arn:aws:resource-groups:*:${data.aws_caller_identity.current.account_id}:group/*",
693-
"arn:aws:events:*:${data.aws_caller_identity.current.account_id}:event-bus/*",
694-
"arn:aws:events:*:${data.aws_caller_identity.current.account_id}:rule/*/*",
695-
]
696-
Sid = "VisualEditor0"
697-
},
698-
{
699-
Action = [
700-
"events:TagResource",
701-
"elasticloadbalancing:RemoveTags",
702-
"elasticloadbalancing:AddTags",
703-
"events:UntagResource",
704-
]
705-
Effect = "Allow"
706-
Resource = [
707-
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:loadbalancer/gwy/*/*",
708-
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:truststore/*/*",
709-
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:listener/app/*/*/*",
710-
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:listener/gwy/*/*/*",
711-
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:listener/net/*/*/*",
712-
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:listener-rule/net/*/*/*/*",
713-
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:listener-rule/app/*/*/*/*",
714-
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:targetgroup/*/*",
715-
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:loadbalancer/net/*/*",
716-
"arn:aws:elasticloadbalancing:*:${data.aws_caller_identity.current.account_id}:loadbalancer/app/*/*",
717-
"arn:aws:events:*:${data.aws_caller_identity.current.account_id}:rule/*",
718-
]
719-
Sid = "VisualEditor1"
720-
},
721-
{
722-
Action = [
723-
"resource-groups:SearchResources",
724-
"resource-groups:CreateGroup",
725-
"resource-groups:ListGroups",
726-
]
727-
Effect = "Allow"
728-
Resource = "*"
729-
Sid = "VisualEditor2"
730-
},
731749

732750

733751
{
@@ -822,7 +840,7 @@ resource "aws_iam_policy" "github_actions_extended" {
822840
},
823841

824842

825-
{
843+
{
826844
Action = "s3:ListBucket"
827845
Effect = "Allow"
828846
Resource = "arn:aws:s3:::ndr-dev-terraform-state-${data.aws_caller_identity.current.account_id}"

0 commit comments

Comments
 (0)