Skip to content

Commit 737a5d5

Browse files
tutengtuteng
committed
Merge branch 'feature/support-init-sn-volume-access-bak' into feature/support-init-sn-volume-access
2 parents 7d46c0d + 1778f65 commit 737a5d5

File tree

5 files changed

+252
-0
lines changed

5 files changed

+252
-0
lines changed

‎examples/volume-access/main.tf‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
provider "aws" {
2+
region = "us-west-2"
3+
}
4+
5+
module "sn_managed_cloud" {
6+
source = "github.com/streamnative/terraform-managed-cloud//modules/aws/volume-access"
7+
8+
external_id = "max"
9+
bucket = "test-ursa-storage"
10+
path = "ursa"
11+
12+
oidc_providers = [
13+
"oidc.eks.us-east-2.amazonaws.com/id/B1C90381FF99EB05EDE1C8E2C2884166",
14+
"oidc.eks.us-east-2.amazonaws.com/id/9ACC7EF87FC7333990CF6BEFA7CEA816"
15+
]
16+
17+
streamnative_vendor_access_role_arns = [
18+
"arn:aws:iam::738562057640:role/cloud-manager"
19+
]
20+
}

‎modules/aws/volume-access/files/sn_volume_s3_bucket.json.tpl‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Action": [
7+
"s3:ListBucket"
8+
],
9+
"Resource": [
10+
"arn:aws:s3:::${bucket}"
11+
]
12+
},
13+
{
14+
"Effect": "Allow",
15+
"Action": [
16+
"s3:PutObject",
17+
"s3:GetObject",
18+
"s3:DeleteObject"
19+
],
20+
"Resource": [
21+
"arn:aws:s3:::${bucket}/${path}/*"
22+
]
23+
},
24+
{
25+
"Effect": "Allow",
26+
"Action": [
27+
"s3:PutLifecycleConfiguration",
28+
"s3:GetLifecycleConfiguration"
29+
],
30+
"Resource": [
31+
"arn:aws:s3:::${bucket}/${path}"
32+
]
33+
}
34+
]
35+
}

‎modules/aws/volume-access/main.tf‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
data "aws_caller_identity" "current" {}
2+
locals {
3+
account_id = data.aws_caller_identity.current.account_id
4+
external_id = (var.external_id != "" ? [{ test : "StringEquals", variable : "sts:ExternalId", values : [var.external_id] }] : [])
5+
assume_conditions = concat(local.external_id, local.source_identity, local.principal_check, local.vendor_federation)
6+
support_assume_conditions = concat(local.external_id, local.source_identity)
7+
source_identity = (length(var.source_identities) > 0 ? [{ test : var.source_identity_test, variable : "sts:SourceIdentity", values : var.source_identities }] : [])
8+
oidc_providers = distinct(concat(var.oidc_providers, local.default_oidc_providers))
9+
principal_check = (length(var.streamnative_principal_ids) > 0 ? [{ test : "StringLike", variable : "aws:PrincipalArn", values : var.streamnative_principal_ids }] : [])
10+
tag_set = merge({ Vendor = "StreamNative", Module = "StreamNative Volume", SNVersion = var.sn_policy_version }, var.tags)
11+
vendor_federation = (var.enforce_vendor_federation ? [{ test : "StringLike", variable : "aws:FederatedProvider", values : ["accounts.google.com"] }] : [])
12+
# Add streamnative default eks oidc provider
13+
default_oidc_providers = compact([
14+
15+
])
16+
conditions = [
17+
for value in local.oidc_providers :
18+
[
19+
{
20+
provider : "${value}",
21+
test : "StringEquals",
22+
variable : "${value}:aud",
23+
values : ["sts.amazonaws.com"]
24+
},
25+
{
26+
provider : "${value}",
27+
test : "StringEquals",
28+
variable : "${value}:sub",
29+
values : [format("system:serviceaccount:%s:*", var.external_id)]
30+
}
31+
]
32+
]
33+
}
34+
35+
resource "aws_iam_openid_connect_provider" "streamnative_oidc_providers" {
36+
count = length(local.oidc_providers)
37+
url = "https://${var.oidc_providers[count.index]}"
38+
client_id_list = ["sts.amazonaws.com"]
39+
tags = local.tag_set
40+
}
41+
42+
data "aws_iam_policy_document" "streamnative_management_access" {
43+
statement {
44+
sid = "AllowStreamNativeControlPlaneAccess"
45+
effect = "Allow"
46+
actions = ["sts:AssumeRole"]
47+
48+
principals {
49+
type = "AWS"
50+
identifiers = var.streamnative_vendor_access_role_arns
51+
}
52+
dynamic "condition" {
53+
for_each = local.assume_conditions
54+
content {
55+
test = condition.value["test"]
56+
values = condition.value["values"]
57+
variable = condition.value["variable"]
58+
}
59+
}
60+
}
61+
62+
dynamic "statement" {
63+
for_each = local.conditions
64+
content {
65+
effect = "Allow"
66+
actions = ["sts:AssumeRoleWithWebIdentity"]
67+
68+
principals {
69+
type = "Federated"
70+
identifiers = [for provider in local.oidc_providers : "arn:aws:iam::${local.account_id}:oidc-provider/${provider}" if "${provider}" == statement.value[0].provider]
71+
}
72+
73+
dynamic "condition" {
74+
for_each = toset(statement.value)
75+
content {
76+
test = condition.value["test"]
77+
values = condition.value["values"]
78+
variable = condition.value["variable"]
79+
}
80+
}
81+
}
82+
}
83+
}
84+
85+
######
86+
#-- Create the IAM role for the the StreamNative Cloud data access to s3 bucket
87+
######
88+
resource "aws_iam_policy" "access_bucket_role" {
89+
name = "sn-${var.external_id}-${var.bucket}-${var.path}"
90+
description = "This policy sets the limits for the access s3 bucket for StreamNative's vendor access."
91+
path = "/StreamNative/"
92+
policy = templatefile("${path.module}/files/sn_volume_s3_bucket.json.tpl",
93+
{
94+
bucket = var.bucket
95+
path = var.path
96+
})
97+
tags = local.tag_set
98+
}
99+
100+
resource "aws_iam_role" "access_bucket_role" {
101+
name = "sn-${var.external_id}-${var.bucket}-${var.path}"
102+
description = "This role is used by StreamNative for the access s3 bucket."
103+
assume_role_policy = data.aws_iam_policy_document.streamnative_management_access.json
104+
path = "/StreamNative/"
105+
tags = local.tag_set
106+
max_session_duration = 43200
107+
}
108+
109+
resource "aws_iam_role_policy_attachment" "access_bucket_role" {
110+
policy_arn = aws_iam_policy.access_bucket_role.arn
111+
role = aws_iam_role.access_bucket_role.name
112+
}

‎modules/aws/volume-access/variables.tf‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
variable "sn_policy_version" {
2+
description = "The value of SNVersion tag"
3+
default = "3.16.1" # {{ x-release-please-version }}
4+
type = string
5+
}
6+
7+
variable "region" {
8+
default = "*"
9+
description = "The AWS region where your instance of StreamNative Cloud is deployed. Defaults to all regions \"*\""
10+
type = string
11+
}
12+
13+
variable "streamnative_vendor_access_role_arns" {
14+
default = ["arn:aws:iam::311022431024:role/cloud-manager"]
15+
description = "This role for access customer s3 bucket on control plane."
16+
type = list(string)
17+
}
18+
19+
variable "additional_federated_identifiers" {
20+
default = []
21+
description = "This federated identified list for access customer s3 bucket on data plane."
22+
type = list(string)
23+
}
24+
25+
variable "streamnative_principal_ids" {
26+
default = []
27+
description = "When set, this applies an additional check for certain StreamNative principals to futher restrict access to which services / users can access an account."
28+
type = list(string)
29+
}
30+
31+
variable "source_identities" {
32+
default = []
33+
description = "Place an additional constraint on source identity, disabled by default and only to be used if specified by StreamNative"
34+
type = list(any)
35+
}
36+
37+
variable "source_identity_test" {
38+
default = "ForAnyValue:StringLike"
39+
description = "The test to use for source identity"
40+
type = string
41+
}
42+
43+
variable "external_id" {
44+
default = ""
45+
description = "A external ID that correspond to your Organization within StreamNative Cloud, used for all STS assume role calls to the IAM roles created by the module. This will be the organization ID in the StreamNative console, e.g. \"o-xhopj\"."
46+
type = string
47+
}
48+
49+
variable "tags" {
50+
default = {}
51+
description = "Extra tags to apply to the resources created by this module."
52+
type = map(string)
53+
}
54+
55+
variable "enforce_vendor_federation" {
56+
default = false
57+
description = "Do not enable this unless explicitly told to do so by StreamNative. Restrict access for the streamnative_vendor_access_role_arns to only federated Google accounts. Intended to be true by default in the future."
58+
type = bool
59+
}
60+
61+
variable "bucket" {
62+
description = "User bucket name"
63+
type = string
64+
}
65+
66+
variable "path" {
67+
description = "S3 bucket path"
68+
type = string
69+
}
70+
71+
variable "oidc_providers" {
72+
default = []
73+
description = "Your aws eks cluster OIDC Providers"
74+
type = list(string)
75+
}

‎modules/aws/volume-access/versions.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_version = ">= 1.0"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 5.30"
8+
}
9+
}
10+
}

0 commit comments

Comments
 (0)