Skip to content

Commit 9b5cae8

Browse files
mattdean3-nhsmattdean3-nhs
authored
Merge pull request #1141 from NHSDigital/feature/made14-NRL-1938-add-github-ci-policies
NRL-1938 Add CI policies to mgmt account
2 parents d76eb5f + ec1b245 commit 9b5cae8

11 files changed

Lines changed: 322 additions & 127 deletions

File tree

‎.github/workflows/deploy-account-wide-infra.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -88,9 +88,9 @@ jobs:
8888
run: |
8989
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} show -no-color tfplan > terraform/account-wide-infrastructure/$ACCOUNT_NAME/tfplan.txt
9090
91-
aws s3 cp terraform/account-wide-infrastructure/$ACCOUNT_NAME/tfplan s3://nhsd-nrlf--mgmt--github-ci-logging/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan
92-
aws s3 cp terraform/account-wide-infrastructure/$ACCOUNT_NAME/tfplan.txt s3://nhsd-nrlf--mgmt--github-ci-logging/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan.txt
93-
aws s3 cp terraform/account-wide-infrastructure/modules/glue/files/src.zip s3://nhsd-nrlf--mgmt--github-ci-logging/acc-$ACCOUNT_NAME/${{ github.run_id }}/glue-src.zip
91+
aws s3 cp terraform/account-wide-infrastructure/$ACCOUNT_NAME/tfplan s3://nhsd-nrlf--mgmt--ci-data/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan
92+
aws s3 cp terraform/account-wide-infrastructure/$ACCOUNT_NAME/tfplan.txt s3://nhsd-nrlf--mgmt--ci-data/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan.txt
93+
aws s3 cp terraform/account-wide-infrastructure/modules/glue/files/src.zip s3://nhsd-nrlf--mgmt--ci-data/acc-$ACCOUNT_NAME/${{ github.run_id }}/glue-src.zip
9494
9595
terraform-apply:
9696
name: Terraform Apply - ${{ inputs.environment }}
@@ -120,11 +120,11 @@ jobs:
120120
env:
121121
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
122122
run: |
123-
aws s3 cp s3://nhsd-nrlf--mgmt--github-ci-logging/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan terraform/account-wide-infrastructure/${ACCOUNT_NAME}/tfplan
124-
aws s3 cp s3://nhsd-nrlf--mgmt--github-ci-logging/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan.txt terraform/account-wide-infrastructure/${ACCOUNT_NAME}/tfplan.txt
123+
aws s3 cp s3://nhsd-nrlf--mgmt--ci-data/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan terraform/account-wide-infrastructure/${ACCOUNT_NAME}/tfplan
124+
aws s3 cp s3://nhsd-nrlf--mgmt--ci-data/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan.txt terraform/account-wide-infrastructure/${ACCOUNT_NAME}/tfplan.txt
125125
126126
mkdir -p terraform/account-wide-infrastructure/modules/glue/files
127-
aws s3 cp s3://nhsd-nrlf--mgmt--github-ci-logging/acc-$ACCOUNT_NAME/${{ github.run_id }}/glue-src.zip terraform/account-wide-infrastructure/modules/glue/files/src.zip
127+
aws s3 cp s3://nhsd-nrlf--mgmt--ci-data/acc-$ACCOUNT_NAME/${{ github.run_id }}/glue-src.zip terraform/account-wide-infrastructure/modules/glue/files/src.zip
128128
129129
- name: Retrieve Server Certificates
130130
env:

‎.github/workflows/persistent-environment.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -143,8 +143,8 @@ jobs:
143143
ENVIRONMENT: ${{ inputs.environment }}
144144
run: |
145145
terraform -chdir=terraform/infrastructure show -no-color tfplan > terraform/infrastructure/tfplan.txt
146-
aws s3 cp terraform/infrastructure/tfplan s3://nhsd-nrlf--mgmt--github-ci-logging/$ENVIRONMENT/${{ github.run_id }}/tfplan
147-
aws s3 cp terraform/infrastructure/tfplan.txt s3://nhsd-nrlf--mgmt--github-ci-logging/$ENVIRONMENT/${{ github.run_id }}/tfplan.txt
146+
aws s3 cp terraform/infrastructure/tfplan s3://nhsd-nrlf--mgmt--ci-data/$ENVIRONMENT/${{ github.run_id }}/tfplan
147+
aws s3 cp terraform/infrastructure/tfplan.txt s3://nhsd-nrlf--mgmt--ci-data/$ENVIRONMENT/${{ github.run_id }}/tfplan.txt
148148
149149
terraform-apply:
150150
name: Terraform Apply - ${{ inputs.environment }}
@@ -186,7 +186,7 @@ jobs:
186186
- name: Download Terraform Plan artifact
187187
env:
188188
ENVIRONMENT: ${{ inputs.environment }}
189-
run: aws s3 cp s3://nhsd-nrlf--mgmt--github-ci-logging/$ENVIRONMENT/${{ github.run_id }}/tfplan terraform/infrastructure/tfplan
189+
run: aws s3 cp s3://nhsd-nrlf--mgmt--ci-data/$ENVIRONMENT/${{ github.run_id }}/tfplan terraform/infrastructure/tfplan
190190

191191
- name: Retrieve Server Certificates
192192
env:

‎.github/workflows/update-lambda-permissions.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -220,8 +220,8 @@ jobs:
220220
ENVIRONMENT: ${{ inputs.environment }}
221221
run: |
222222
terraform -chdir=terraform/infrastructure show -no-color tfplan > terraform/infrastructure/tfplan.txt
223-
aws s3 cp terraform/infrastructure/tfplan s3://nhsd-nrlf--mgmt--github-ci-logging/$ENVIRONMENT/${{ github.run_id }}/tfplan
224-
aws s3 cp terraform/infrastructure/tfplan.txt s3://nhsd-nrlf--mgmt--github-ci-logging/$ENVIRONMENT/${{ github.run_id }}/tfplan.txt
223+
aws s3 cp terraform/infrastructure/tfplan s3://nhsd-nrlf--mgmt--ci-data/$ENVIRONMENT/${{ github.run_id }}/tfplan
224+
aws s3 cp terraform/infrastructure/tfplan.txt s3://nhsd-nrlf--mgmt--ci-data/$ENVIRONMENT/${{ github.run_id }}/tfplan.txt
225225
226226
terraform-apply:
227227
name: Apply permissions
@@ -265,7 +265,7 @@ jobs:
265265
- name: Download Terraform Plan artifact
266266
env:
267267
ENVIRONMENT: ${{ inputs.environment }}
268-
run: aws s3 cp s3://nhsd-nrlf--mgmt--github-ci-logging/$ENVIRONMENT/${{ github.run_id }}/tfplan terraform/infrastructure/tfplan
268+
run: aws s3 cp s3://nhsd-nrlf--mgmt--ci-data/$ENVIRONMENT/${{ github.run_id }}/tfplan terraform/infrastructure/tfplan
269269

270270
- name: Terraform Init
271271
env:

‎terraform/account-wide-infrastructure/mgmt/codebuild.tf‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,9 @@ data "aws_iam_policy_document" "codebuild_policy" {
6363
statement {
6464
effect = "Allow"
6565
actions = [
66-
"ecr:*"
66+
"ecr:GetDownloadUrlForLayer",
67+
"ecr:BatchGetImage",
68+
"ecr:BatchCheckLayerAvailability"
6769
]
6870
resources = [
6971
"${aws_ecr_repository.repository.arn}",

‎terraform/account-wide-infrastructure/mgmt/data.tf‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,13 @@ data "aws_caller_identity" "current" {}
22

33
data "aws_region" "current" {}
44

5+
data "external" "current-info" {
6+
program = [
7+
"bash",
8+
"../../../scripts/get-current-info.sh",
9+
]
10+
}
11+
512
data "aws_dynamodb_table" "terraform_state_lock" {
613
name = "${local.project}--terraform-state-lock"
714
}
@@ -10,10 +17,6 @@ data "aws_s3_bucket" "terraform_state" {
1017
bucket = "${local.project}--terraform-state"
1118
}
1219

13-
data "aws_s3_bucket" "ci_logging" {
14-
bucket = "${local.project}--mgmt--github-ci-logging"
15-
}
16-
1720
data "aws_s3_bucket" "truststore" {
1821
bucket = "${local.project}--truststore"
1922
}
@@ -53,3 +56,7 @@ data "aws_secretsmanager_secret_version" "test_backup_account_id" {
5356
data "aws_secretsmanager_secret_version" "test_restore_account_id" {
5457
secret_id = data.aws_secretsmanager_secret.test_restore_account_id.name
5558
}
59+
60+
data "aws_secretsmanager_secret_version" "prod_account_id" {
61+
secret_id = data.aws_secretsmanager_secret.prod_account_id.name
62+
}

‎terraform/account-wide-infrastructure/mgmt/iam.tf‎

Lines changed: 0 additions & 110 deletions
This file was deleted.

‎terraform/account-wide-infrastructure/mgmt/iam_developer.tf‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
resource "aws_iam_policy" "developer_policy" {
2+
name = "${local.prefix}--developer-policy"
3+
4+
policy = jsonencode({
5+
Version = "2012-10-17"
6+
Statement = [
7+
{
8+
Action = [
9+
"s3:PutObject",
10+
"s3:DeleteObject",
11+
"s3:GetObject",
12+
"dynamodb:PutItem",
13+
"dynamodb:GetItem",
14+
"dynamodb:DeleteItem",
15+
"s3:ListBucket"
16+
]
17+
Effect = "Allow"
18+
Resource = [
19+
data.aws_dynamodb_table.terraform_state_lock.arn,
20+
data.aws_s3_bucket.terraform_state.arn,
21+
"${data.aws_s3_bucket.terraform_state.arn}/*"
22+
]
23+
},
24+
{
25+
Action = [
26+
"s3:PutObject",
27+
"s3:GetObject",
28+
"s3:DeleteObject"
29+
]
30+
Effect = "Deny"
31+
Resource = [
32+
"${data.aws_s3_bucket.terraform_state.arn}/${local.project}/prod/*",
33+
"${data.aws_s3_bucket.terraform_state.arn}/${local.project}/mgmt/*",
34+
]
35+
},
36+
{
37+
Action = [
38+
"s3:DeleteObject"
39+
]
40+
Effect = "Deny"
41+
Resource = [
42+
"${data.aws_s3_bucket.terraform_state.arn}/${local.project}/dev/*"
43+
]
44+
},
45+
{
46+
Action = "sts:AssumeRole"
47+
Effect = "Allow"
48+
Resource = [
49+
"arn:aws:iam::${data.aws_secretsmanager_secret_version.dev_account_id.secret_string}:role/terraform",
50+
"arn:aws:iam::${data.aws_secretsmanager_secret_version.test_account_id.secret_string}:role/terraform",
51+
"arn:aws:iam::${data.aws_secretsmanager_secret_version.test_backup_account_id.secret_string}:role/terraform",
52+
"arn:aws:iam::${data.aws_secretsmanager_secret_version.test_restore_account_id.secret_string}:role/terraform"
53+
]
54+
},
55+
{
56+
Action = [
57+
"secretsmanager:GetResourcePolicy",
58+
"secretsmanager:GetSecretValue",
59+
"secretsmanager:DescribeSecret",
60+
"secretsmanager:ListSecretVersionIds"
61+
]
62+
Effect = "Allow"
63+
Resource = [
64+
data.aws_secretsmanager_secret.dev_account_id.arn,
65+
data.aws_secretsmanager_secret.test_account_id.arn
66+
]
67+
},
68+
{
69+
Action = [
70+
"s3:ListAllMyBuckets"
71+
]
72+
Effect = "Allow"
73+
Resource = [
74+
"arn:aws:s3:::*"
75+
]
76+
},
77+
{
78+
Action = [
79+
"s3:GetObject",
80+
"s3:ListBucket"
81+
]
82+
Effect = "Allow"
83+
Resource = [
84+
aws_s3_bucket.ci_data.arn,
85+
"${aws_s3_bucket.ci_data.arn}/*"
86+
]
87+
},
88+
{
89+
Action = [
90+
"s3:PutObject",
91+
"s3:GetObject",
92+
"s3:DeleteObject"
93+
]
94+
Effect = "Deny"
95+
Resource = [
96+
"${data.aws_s3_bucket.truststore.arn}/ca/prod*",
97+
"${data.aws_s3_bucket.truststore.arn}/client/prod*",
98+
"${data.aws_s3_bucket.truststore.arn}/server/prod*"
99+
]
100+
},
101+
{
102+
Action = [
103+
"s3:GetObject"
104+
]
105+
Effect = "Allow"
106+
Resource = [
107+
"${data.aws_s3_bucket.truststore.arn}/*"
108+
]
109+
}
110+
]
111+
})
112+
}
113+
114+
resource "aws_iam_role_policy_attachment" "developer_policy_attachment" {
115+
role = var.developer_role_name
116+
policy_arn = aws_iam_policy.developer_policy.arn
117+
}

0 commit comments

Comments
 (0)