Skip to content

Commit b788be5

Browse files
oanhnnoanhnn
committed
Add some policy statements
1 parent 51c763d commit b788be5

File tree

7 files changed

+174
-21
lines changed

7 files changed

+174
-21
lines changed

‎modules/ecs-task-role/README.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -73,11 +73,11 @@ module "task_role" {
7373
| <a name="input_enable_ssm_core_policy"></a> [enable\_ssm\_core\_policy](#input\_enable\_ssm\_core\_policy) | Enable to attach AmazonSSMManagedInstanceCore to task role | `bool` | `true` | no |
7474
| <a name="input_path"></a> [path](#input\_path) | The path to the IAM role | `string` | `"/"` | no |
7575
| <a name="input_permissions_boundary_arn"></a> [permissions\_boundary\_arn](#input\_permissions\_boundary\_arn) | The permissions boundary of the IAM role | `string` | `""` | no |
76-
| <a name="input_readable_s3_arns"></a> [readable\_s3\_arns](#input\_readable\_s3\_arns) | The list of S3 ARN that can be read from | `list(string)` | <pre>[<br> "arn:aws:s3:::*"<br>]</pre> | no |
77-
| <a name="input_sendable_ses_arns"></a> [sendable\_ses\_arns](#input\_sendable\_ses\_arns) | The list of SES domain identity ARN that can be sent from | `list(string)` | <pre>[<br> "arn:aws:ses:*:*:*"<br>]</pre> | no |
76+
| <a name="input_readable_s3_arns"></a> [readable\_s3\_arns](#input\_readable\_s3\_arns) | The list of S3 ARN that can be read from | `list(string)` | <pre>[<br/> "arn:aws:s3:::*"<br/>]</pre> | no |
77+
| <a name="input_sendable_ses_arns"></a> [sendable\_ses\_arns](#input\_sendable\_ses\_arns) | The list of SES domain identity ARN that can be sent from | `list(string)` | <pre>[<br/> "arn:aws:ses:*:*:*"<br/>]</pre> | no |
7878
| <a name="input_tags"></a> [tags](#input\_tags) | The list of tags to apply to the IAM role | `map(string)` | `{}` | no |
79-
| <a name="input_writable_log_group_arns"></a> [writable\_log\_group\_arns](#input\_writable\_log\_group\_arns) | The list of Log group ARN that can be written to | `list(string)` | <pre>[<br> "arn:aws:logs:::*"<br>]</pre> | no |
80-
| <a name="input_writable_s3_arns"></a> [writable\_s3\_arns](#input\_writable\_s3\_arns) | The list of S3 ARN that can be written to | `list(string)` | <pre>[<br> "arn:aws:s3:::*"<br>]</pre> | no |
79+
| <a name="input_writable_log_group_arns"></a> [writable\_log\_group\_arns](#input\_writable\_log\_group\_arns) | The list of Log group ARN that can be written to | `list(string)` | <pre>[<br/> "arn:aws:logs:::*"<br/>]</pre> | no |
80+
| <a name="input_writable_s3_arns"></a> [writable\_s3\_arns](#input\_writable\_s3\_arns) | The list of S3 ARN that can be written to | `list(string)` | <pre>[<br/> "arn:aws:s3:::*"<br/>]</pre> | no |
8181

8282
## Outputs
8383

‎modules/execution-role/README.md‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ This submodule help create an IAM assumable role for ECS Task Execution Role
77
```hcl
88
module "task_execution_role" {
99
source = "rabiloo/ecs/aws//modules/ecs-execution-role"
10-
version = "~>0.3.0"
10+
version = "~>0.3.1"
1111
1212
name = "custom-ecs-execution-role"
1313
path = "/service-roles/"
@@ -17,12 +17,8 @@ module "task_execution_role" {
1717
Managed = "Terraform"
1818
}
1919
20-
statements = {
21-
Logs = {
22-
actions = ["logs:CreateLogStream", "logs:PutLogEvents"]
23-
resources = ["*"]
24-
}
25-
}
20+
enable_write_log_streams = true
21+
enable_pull_ecr_images = true
2622
}
2723
```
2824

@@ -48,8 +44,9 @@ No modules.
4844

4945
| Name | Type |
5046
|------|------|
47+
| [aws_iam_policy.custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
5148
| [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
52-
| [aws_iam_role_policy.custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
49+
| [aws_iam_role_policy_attachment.custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
5350
| [aws_iam_role_policy_attachment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
5451
| [aws_iam_policy_document.assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
5552
| [aws_iam_policy_document.custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
@@ -61,12 +58,20 @@ No modules.
6158
| <a name="input_name"></a> [name](#input\_name) | The name of the IAM role | `string` | n/a | yes |
6259
| <a name="input_create"></a> [create](#input\_create) | Determines whether resources will be created (affects all resources) | `bool` | `true` | no |
6360
| <a name="input_description"></a> [description](#input\_description) | The description of the IAM role | `string` | `null` | no |
61+
| <a name="input_enable_pull_ecr_images"></a> [enable\_pull\_ecr\_images](#input\_enable\_pull\_ecr\_images) | Controls if the task execution role will be permitted to pull ECR private repositories | `bool` | `false` | no |
62+
| <a name="input_enable_read_secrets"></a> [enable\_read\_secrets](#input\_enable\_read\_secrets) | Controls if the task execution role will be permitted to get/read SecretsManager secrets | `bool` | `false` | no |
63+
| <a name="input_enable_read_ssm_params"></a> [enable\_read\_ssm\_params](#input\_enable\_read\_ssm\_params) | Controls if the task execution role will be permitted to get/read SSM parameters | `bool` | `false` | no |
64+
| <a name="input_enable_write_log_streams"></a> [enable\_write\_log\_streams](#input\_enable\_write\_log\_streams) | Controls if the task execution role will be permitted to put/write CloudWatch log streams | `bool` | `false` | no |
6465
| <a name="input_path"></a> [path](#input\_path) | The path to the IAM role | `string` | `"/"` | no |
6566
| <a name="input_permissions_boundary_arn"></a> [permissions\_boundary\_arn](#input\_permissions\_boundary\_arn) | The permissions boundary of the IAM role | `string` | `null` | no |
6667
| <a name="input_policy_arns"></a> [policy\_arns](#input\_policy\_arns) | The list of IAM policy ARN be attached to IAM role | `map(string)` | `{}` | no |
68+
| <a name="input_pullable_ecr_images"></a> [pullable\_ecr\_images](#input\_pullable\_ecr\_images) | List of ECR private repositories the task execution role will be permitted to pull | `list(string)` | <pre>[<br/> "*"<br/>]</pre> | no |
69+
| <a name="input_readable_secrets"></a> [readable\_secrets](#input\_readable\_secrets) | List of SecretsManager secret ARNs the task execution role will be permitted to get/read | `list(string)` | <pre>[<br/> "arn:aws:secretsmanager:*:*:secret:*"<br/>]</pre> | no |
70+
| <a name="input_readable_ssm_params"></a> [readable\_ssm\_params](#input\_readable\_ssm\_params) | List of SSM parameter ARNs the task execution role will be permitted to get/read | `list(string)` | <pre>[<br/> "arn:aws:ssm:*:*:parameter/*"<br/>]</pre> | no |
6771
| <a name="input_statements"></a> [statements](#input\_statements) | A map of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for custom permission usage | `any` | `{}` | no |
6872
| <a name="input_tags"></a> [tags](#input\_tags) | TheA map of tags to add to all resources | `map(string)` | `{}` | no |
6973
| <a name="input_use_name_prefix"></a> [use\_name\_prefix](#input\_use\_name\_prefix) | Determines whether the IAM role name is used as a prefix | `bool` | `true` | no |
74+
| <a name="input_writable_log_streams"></a> [writable\_log\_streams](#input\_writable\_log\_streams) | List of CloudWatch log streams the task execution role will be permitted to put/write | `list(string)` | <pre>[<br/> "*"<br/>]</pre> | no |
7075

7176
## Outputs
7277

‎modules/execution-role/main.tf‎

Lines changed: 70 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
locals {
77
name_prefix = "${trimsuffix(var.name)}-"
88

9-
create_custom_policy = var.create && length(var.statements) > 0
9+
create_custom_policy = var.create && (length(var.statements) > 0 || var.enable_read_ssm_params || var.enable_read_secrets || var.enable_write_log_streams || var.enable_pull_ecr_images)
1010
}
1111

1212
data "aws_iam_policy_document" "assume_role" {
@@ -48,6 +48,65 @@ resource "aws_iam_role_policy_attachment" "this" {
4848
data "aws_iam_policy_document" "custom" {
4949
count = local.create_custom_policy ? 1 : 0
5050

51+
dynamic "statement" {
52+
for_each = var.enable_write_log_streams ? [1] : []
53+
54+
content {
55+
sid = "WriteLogs"
56+
actions = [
57+
"logs:CreateLogStream",
58+
"logs:PutLogEvents",
59+
]
60+
resources = var.writable_log_streams
61+
}
62+
}
63+
64+
dynamic "statement" {
65+
for_each = var.enable_pull_ecr_images ? [1] : []
66+
67+
content {
68+
sid = "GetECRToken"
69+
actions = [
70+
"ecr:GetAuthorizationToken",
71+
]
72+
resources = ["*"]
73+
}
74+
}
75+
76+
dynamic "statement" {
77+
for_each = var.enable_pull_ecr_images ? [1] : []
78+
79+
content {
80+
sid = "PullECRImages"
81+
actions = [
82+
"ecr:BatchCheckLayerAvailability",
83+
"ecr:GetDownloadUrlForLayer",
84+
"ecr:BatchGetImage",
85+
]
86+
resources = var.pullable_ecr_images
87+
}
88+
}
89+
90+
dynamic "statement" {
91+
for_each = var.enable_read_ssm_params ? [1] : []
92+
93+
content {
94+
sid = "GetSSMParams"
95+
actions = ["ssm:GetParameters"]
96+
resources = var.readable_ssm_params
97+
}
98+
}
99+
100+
dynamic "statement" {
101+
for_each = var.enable_read_secrets ? [1] : []
102+
103+
content {
104+
sid = "GetSecrets"
105+
actions = ["secretsmanager:GetSecretValue"]
106+
resources = var.readable_secrets
107+
}
108+
}
109+
51110
dynamic "statement" {
52111
for_each = var.statements
53112

@@ -90,11 +149,19 @@ data "aws_iam_policy_document" "custom" {
90149
}
91150
}
92151

93-
resource "aws_iam_role_policy" "custom" {
152+
resource "aws_iam_policy" "custom" {
94153
count = local.create_custom_policy ? 1 : 0
95154

96155
name = var.use_name_prefix ? null : var.name
97156
name_prefix = var.use_name_prefix ? local.name_prefix : null
98157
policy = data.aws_iam_policy_document.custom[0].json
99-
role = aws_iam_role.this[0].id
158+
description = "Task execution role IAM policy"
159+
tags = var.tags
160+
}
161+
162+
resource "aws_iam_role_policy_attachment" "custom" {
163+
count = local.create_custom_policy ? 1 : 0
164+
165+
role = aws_iam_role.this[0].id
166+
policy_arn = aws_iam_policy.custom[0].arn
100167
}

‎modules/execution-role/variables.tf‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,3 +65,51 @@ variable "statements" {
6565
type = any
6666
default = {}
6767
}
68+
69+
variable "enable_read_ssm_params" {
70+
description = "Controls if the task execution role will be permitted to get/read SSM parameters"
71+
type = bool
72+
default = false
73+
}
74+
75+
variable "readable_ssm_params" {
76+
description = "List of SSM parameter ARNs the task execution role will be permitted to get/read"
77+
type = list(string)
78+
default = ["arn:aws:ssm:*:*:parameter/*"]
79+
}
80+
81+
variable "enable_read_secrets" {
82+
description = "Controls if the task execution role will be permitted to get/read SecretsManager secrets"
83+
type = bool
84+
default = false
85+
}
86+
87+
variable "readable_secrets" {
88+
description = "List of SecretsManager secret ARNs the task execution role will be permitted to get/read"
89+
type = list(string)
90+
default = ["arn:aws:secretsmanager:*:*:secret:*"]
91+
}
92+
93+
variable "enable_write_log_streams" {
94+
description = "Controls if the task execution role will be permitted to put/write CloudWatch log streams"
95+
type = bool
96+
default = false
97+
}
98+
99+
variable "writable_log_streams" {
100+
description = "List of CloudWatch log streams the task execution role will be permitted to put/write"
101+
type = list(string)
102+
default = ["*"]
103+
}
104+
105+
variable "enable_pull_ecr_images" {
106+
description = "Controls if the task execution role will be permitted to pull ECR private repositories"
107+
type = bool
108+
default = false
109+
}
110+
111+
variable "pullable_ecr_images" {
112+
description = "List of ECR private repositories the task execution role will be permitted to pull"
113+
type = list(string)
114+
default = ["*"]
115+
}

‎modules/task-role/README.md‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ This submodule help create an IAM assumable role for ECS Task
77
```hcl
88
module "task_role" {
99
source = "rabiloo/ecs/aws//modules/task-role"
10-
version = "~>0.3.0"
10+
version = "~>0.3.1"
1111
1212
name = "custom-ecs-task-role"
1313
path = "/service-roles/"
@@ -17,6 +17,8 @@ module "task_role" {
1717
Managed = "Terraform"
1818
}
1919
20+
enable_execute_command = true
21+
2022
statements = {
2123
Logs = {
2224
actions = ["logs:CreateLogStream", "logs:PutLogEvents"]
@@ -49,8 +51,9 @@ No modules.
4951

5052
| Name | Type |
5153
|------|------|
54+
| [aws_iam_policy.custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
5255
| [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
53-
| [aws_iam_role_policy.custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
56+
| [aws_iam_role_policy_attachment.custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
5457
| [aws_iam_role_policy_attachment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
5558
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
5659
| [aws_iam_policy_document.assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
@@ -65,6 +68,7 @@ No modules.
6568
| <a name="input_name"></a> [name](#input\_name) | The name of the IAM role | `string` | n/a | yes |
6669
| <a name="input_create"></a> [create](#input\_create) | Determines whether resources will be created (affects all resources) | `bool` | `true` | no |
6770
| <a name="input_description"></a> [description](#input\_description) | The description of the IAM role | `string` | `null` | no |
71+
| <a name="input_enable_execute_command"></a> [enable\_execute\_command](#input\_enable\_execute\_command) | Specifies whether to enable Amazon ECS Exec for the tasks within the service | `bool` | `false` | no |
6872
| <a name="input_path"></a> [path](#input\_path) | The path to the IAM role | `string` | `"/"` | no |
6973
| <a name="input_permissions_boundary_arn"></a> [permissions\_boundary\_arn](#input\_permissions\_boundary\_arn) | The permissions boundary of the IAM role | `string` | `null` | no |
7074
| <a name="input_policy_arns"></a> [policy\_arns](#input\_policy\_arns) | The list of IAM policy ARN be attached to IAM role | `map(string)` | `{}` | no |

‎modules/task-role/main.tf‎

Lines changed: 27 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ locals {
1313
region = data.aws_region.current.name
1414
name_prefix = "${trimsuffix(var.name)}-"
1515

16-
create_custom_policy = var.create && length(var.statements) > 0
16+
create_custom_policy = var.create && (length(var.statements) > 0 || var.enable_execute_command)
1717
}
1818

1919
data "aws_iam_policy_document" "assume_role" {
@@ -66,7 +66,22 @@ resource "aws_iam_role_policy_attachment" "this" {
6666
}
6767

6868
data "aws_iam_policy_document" "custom" {
69-
count = var.create && length(var.statements) > 0 ? 1 : 0
69+
count = local.create_custom_policy ? 1 : 0
70+
71+
dynamic "statement" {
72+
for_each = var.enable_execute_command ? [1] : []
73+
74+
content {
75+
sid = "ECSExec"
76+
actions = [
77+
"ssmmessages:CreateControlChannel",
78+
"ssmmessages:CreateDataChannel",
79+
"ssmmessages:OpenControlChannel",
80+
"ssmmessages:OpenDataChannel",
81+
]
82+
resources = ["*"]
83+
}
84+
}
7085

7186
dynamic "statement" {
7287
for_each = var.statements
@@ -110,11 +125,19 @@ data "aws_iam_policy_document" "custom" {
110125
}
111126
}
112127

113-
resource "aws_iam_role_policy" "custom" {
128+
resource "aws_iam_policy" "custom" {
114129
count = local.create_custom_policy ? 1 : 0
115130

116131
name = var.use_name_prefix ? null : var.name
117132
name_prefix = var.use_name_prefix ? local.name_prefix : null
118133
policy = data.aws_iam_policy_document.custom[0].json
119-
role = aws_iam_role.this[0].id
134+
description = "Task role IAM policy"
135+
tags = var.tags
136+
}
137+
138+
resource "aws_iam_role_policy_attachment" "custom" {
139+
count = local.create_custom_policy ? 1 : 0
140+
141+
role = aws_iam_role.this[0].id
142+
policy_arn = aws_iam_policy.custom[0].arn
120143
}

‎modules/task-role/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,3 +65,9 @@ variable "statements" {
6565
type = any
6666
default = {}
6767
}
68+
69+
variable "enable_execute_command" {
70+
description = "Specifies whether to enable Amazon ECS Exec for the tasks within the service"
71+
type = bool
72+
default = false
73+
}

0 commit comments

Comments
 (0)