Merge pull request #303 from NHSDigital/feature/CCM-8202_Grafana_Cross_Account_Access

CCM-8202: Grafana Cross Account Access

Author: aidenvaines-cgi

infrastructure/terraform/components/acct/iam_role_grafana_access.tf

@@ -0,0 +1,20 @@
+resource "aws_iam_role" "grafana_access" {
+  name               = "${local.csi}-grafana-cross-access-role"
+  assume_role_policy = data.aws_iam_policy_document.observability_grafana_role_assume_role_policy.json
+}
+
+data "aws_iam_policy_document" "observability_grafana_role_assume_role_policy" {
+  statement {
+    actions = ["sts:AssumeRole"]
+    effect  = "Allow"
+    principals {
+      type        = "AWS"
+      identifiers = ["arn:aws:iam::${var.observability_account_id}:role/${local.csi}-grafana-workspace-role"]
+    }
+  }
+}
+
+resource "aws_iam_role_policy_attachment" "grafana_workspace_cloudwatch" {
+  role       = aws_iam_role.grafana_access.name
+  policy_arn = "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess"
+}

infrastructure/terraform/components/acct/variables.tf

@@ -70,3 +70,8 @@ variable "initial_cli_secrets_provision_override" {
   # Usage like:
   #  ... -a apply -- -var initial_cli_secrets_provision_override={\"github_pat\":\"l0ngstr1ng"}
 }
+
+variable "observability_account_id" {
+  type        = string
+  description = "The Observability Account ID that needs access"
+}