Issue146 OIDC plan april (#154)

* Separate Terraform plan and apply roles for incubator

* Applying recommended role detail changes for plan and apply

* Removed Pull Request condition from incubator_tf_apply

* new TF Plan read policy for secrets manager and fixed lines

* Executed feedback: generalized custom policy .json and home-unite-us secrets

* Previous push rejected for deprecated aws resource. Fixed, and aligned cross-reference.

* Add DynamoDB TF Plan policy entries

Author: Benettonkkb

terraform/aws-custom-policies.tf

@@ -9,5 +9,9 @@ module "aws_custom_policies" {
       description = "Policy enforcing MFA for devops security users"
       filename    = "enforce-mfa-for-users-policy.json"
     }
+    "IncubatorTfPlanSecretsRead" = {
+      description = "Allows incubator tf plan role to read specific Secrets Manager secrets needed for terraform plan"
+      filename    = "tf-plan-scoped.json"
+    }
   }
 }

terraform/aws-custom-policies/tf-plan-scoped.json

@@ -0,0 +1,45 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "AllowReadSpecificSecretsForTerraformPlan",
+      "Effect": "Allow",
+      "Action": [
+        "secretsmanager:GetSecretValue"
+      ],
+      "Resource": [
+        "arn:aws:secretsmanager:us-west-2:035866691871:secret:*"
+      ]
+    },
+    {
+      "Sid": "AllowS3BackendAccessForTerraformPlan",
+      "Effect": "Allow",
+      "Action": [
+        "s3:GetObject",
+        "s3:PutObject",
+        "s3:DeleteObject",
+        "s3:ListBucket",
+        "s3:GetBucketLocation"
+      ],
+      "Resource": [
+        "arn:aws:s3:::hfla-ops-terraform-state",
+        "arn:aws:s3:::hfla-ops-terraform-state/*"
+      ]
+    },
+    {
+      "Sid": "AllowDynamoDBLockTableAccessForTerraformPlan",
+      "Effect": "Allow",
+      "Action": [
+        "dynamodb:PutItem",
+        "dynamodb:DeleteItem",
+        "dynamodb:GetItem",
+        "dynamodb:UpdateItem",
+        "dynamodb:DescribeTable"
+      ],
+      "Resource": [
+        "arn:aws:dynamodb:us-west-2:035866691871:table/hfla_ops_terraform_table"
+      ]
+    }
+  ]
+}
+

terraform/aws-gha-oidc-providers.tf

@@ -40,13 +40,17 @@ resource "aws_iam_role" "incubator_tf_plan" {
 }
 
 resource "aws_iam_role_policy_attachment" "incubator_tf_plan_readonly" {
-  role      = aws_iam_role.incubator_tf_plan.name
+  role       = aws_iam_role.incubator_tf_plan.name
   policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess"
 }
 
+resource "aws_iam_role_policy_attachment" "incubator_tf_plan_secrets_read" {
+  role       = aws_iam_role.incubator_tf_plan.name
+  policy_arn = module.aws_custom_policies.policy_arns["IncubatorTfPlanSecretsRead"]
+}
+
 resource "aws_iam_role" "incubator_tf_apply" {
   name = "incubator-tf-apply"
-
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
     Statement = [

terraform/modules/aws-gha-oidc-providers/main.tf

@@ -50,8 +50,7 @@ resource "aws_iam_openid_connect_provider" "github_actions" {
 
 resource "aws_iam_role" "github_actions_oidc" {
 
-  name                = var.role_name
-  managed_policy_arns = var.policy_arns
+  name = var.role_name
 
   assume_role_policy = jsonencode({
     "Version" : "2012-10-17",
@@ -71,4 +70,11 @@ resource "aws_iam_role" "github_actions_oidc" {
       }
     }]
   })
-}
+}
+
+resource "aws_iam_role_policy_attachment" "github_actions_oidc" {
+  for_each = toset(var.policy_arns)
+
+  role       = aws_iam_role.github_actions_oidc.name
+  policy_arn = each.value
+}