architect-deploy/data.tf at main · agentsofthesystem/architect-deploy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
# This will be the terraform user.
data "aws_caller_identity" "current" {}

# Create an IAM policy document for assumed roles for ECS task execution service.
data "aws_iam_policy_document" "ecs_task_execution_role" {
  version = "2012-10-17"
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }

  }
}

# Create an IAM policy document for assumed roles for ECS task service.
data "aws_iam_policy_document" "ecs_task_role" {
  version = "2012-10-17"
  statement {

    sid     = ""
    effect  = "Allow"

    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = [
        "ecs-tasks.amazonaws.com",
        "ecs.amazonaws.com"
      ]
    }

    # Have to exlicitly allow the ECS service to assume the role and trust itself.
    principals {
     type        = "AWS"
     identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${var.app_acronym}-${var.app_environment}-ecs-task-role"]
    }

  }
}


data "aws_iam_policy_document" "aots_sqs" {

  statement {
    sid    = "First"
    effect = "Allow"
    actions   = [
      "SQS:SendMessage",
      "SQS:ChangeMessageVisibility",
      "SQS:DeleteMessage",
      "SQS:ReceiveMessage"
    ]
    resources = [aws_sqs_queue.queue.arn]

    principals {
      type        = "AWS"
      identifiers = [aws_iam_role.ecs_task_role.arn]
    }

  }
}

data "aws_secretsmanager_secret" "db_secret" {
  arn = aws_db_instance.database.master_user_secret[0].secret_arn
}