Skip to content

Commit 1143a23

Browse files
jamesiarmesjamesiarmes
authored
feat: Configure deployment permissions. (#11)
1 parent 99740ba commit 1143a23

File tree

15 files changed

+254
-4
lines changed

15 files changed

+254
-4
lines changed

‎.github/workflows/deploy.yaml‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,13 @@ jobs:
3434
secrets:
3535
AWS_REGION: ${{ secrets.AWS_REGION }}
3636
AWS_ROLE_ARN: ${{ secrets.AWS_ROLE_ARN }}
37+
TF_VAR_ENVIRONMENT: ${{ secrets.TF_VAR_ENVIRONMENT }}
3738
TF_VAR_EXPORT_EXPIRATION: ${{ secrets.TF_VAR_EXPORT_EXPIRATION }}
3839
TF_VAR_KEY_RECOVERY_PERIOD: ${{ secrets.TF_VAR_KEY_RECOVERY_PERIOD }}
3940
TF_VAR_PROGRAM: ${{ secrets.TF_VAR_PROGRAM }}
41+
TF_VAR_PROJECT: ${{ secrets.TF_VAR_PROGRAM }}
42+
TF_VAR_REPO_OIDC_ARN: ${{ secrets.TF_VAR_REPO_OIDC_ARN }}
43+
TF_VAR_REPOSITORY: ${{ secrets.TF_VAR_REPOSITORY }}
4044
TF_VAR_VPC_CIDR: ${{ secrets.TF_VAR_VPC_CIDR }}
4145
TF_VAR_VPC_PRIVATE_SUBNET_CIDRS: ${{ secrets.TF_VAR_VPC_PRIVATE_SUBNET_CIDRS }}
4246
TF_VAR_VPC_PUBLIC_SUBNET_CIDRS: ${{ secrets.TF_VAR_VPC_PUBLIC_SUBNET_CIDRS }}
@@ -48,6 +52,7 @@ jobs:
4852
environment: ${{ inputs.environment || 'development' }}
4953
env:
5054
# Set required variables.
55+
TF_VAR_repo_oidc_arn: ${{ secrets.TF_VAR_REPO_OIDC_ARN }}
5156
TF_VAR_vpc_cidr: ${{ secrets.TF_VAR_VPC_CIDR }}
5257
TF_VAR_vpc_private_subnet_cidrs: ${{ secrets.TF_VAR_VPC_PRIVATE_SUBNET_CIDRS }}
5358
TF_VAR_vpc_public_subnet_cidrs: ${{ secrets.TF_VAR_VPC_PUBLIC_SUBNET_CIDRS }}
@@ -62,17 +67,25 @@ jobs:
6267
role-session-name: GitHub_to_AWS_via_FederatedOIDC
6368
- name: Setup OpenTofu
6469
uses: opentofu/setup-opentofu@v1
70+
with:
71+
tofu_wrapper: false
6572
- name: Display OpenTofu version
6673
run: tofu version
6774
- name: Set optional variables
6875
env:
6976
# For any of these that have a value, the corresponding TF_VAR_*
7077
# environment variable will be set.
78+
ENVIRONMENT: ${{ secrets.TF_VAR_ENVIRONMENT }}
7179
EXPORT_EXPIRATION: ${{ secrets.TF_VAR_EXPORT_EXPIRATION }}
7280
KEY_RECOVERY_PERIOD: ${{ secrets.TF_VAR_KEY_RECOVERY_PERIOD }}
7381
PROGRAM: ${{ secrets.TF_VAR_PROGRAM }}
82+
PROJECT: ${{ secrets.TF_VAR_PROJECT }}
83+
REPOSITORY: ${{ secrets.TF_VAR_REPOSITORY }}
7484
run: |
75-
variables=("export_expiration" "key_recovery_period" "program")
85+
variables=(
86+
"environment" "export_expiration" "key_recovery_period" "program"
87+
"project" "repository"
88+
)
7689
for var in ${variables[@]}; do
7790
name="$(echo $var | tr '[:lower:]' '[:upper:]')"
7891
if [ -n "${!name}" ]; then

‎.github/workflows/plan.yaml‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,19 @@ on:
1616
secrets:
1717
AWS_REGION:
1818
AWS_ROLE_ARN:
19+
TF_VAR_ENVIRONMENT:
20+
required: false
1921
TF_VAR_EXPORT_EXPIRATION:
2022
required: false
2123
TF_VAR_KEY_RECOVERY_PERIOD:
2224
required: false
2325
TF_VAR_PROGRAM:
2426
required: false
27+
TF_VAR_PROJECT:
28+
required: false
29+
TF_VAR_REPO_OIDC_ARN:
30+
TF_VAR_REPOSITORY:
31+
required: false
2532
TF_VAR_VPC_CIDR:
2633
TF_VAR_VPC_PRIVATE_SUBNET_CIDRS:
2734
TF_VAR_VPC_PUBLIC_SUBNET_CIDRS:
@@ -53,6 +60,7 @@ jobs:
5360
environment: ${{ inputs.environment || 'development' }}
5461
env:
5562
# Set required variables.
63+
TF_VAR_repo_oidc_arn: ${{ secrets.TF_VAR_REPO_OIDC_ARN }}
5664
TF_VAR_vpc_cidr: ${{ secrets.TF_VAR_VPC_CIDR }}
5765
TF_VAR_vpc_private_subnet_cidrs: ${{ secrets.TF_VAR_VPC_PRIVATE_SUBNET_CIDRS }}
5866
TF_VAR_vpc_public_subnet_cidrs: ${{ secrets.TF_VAR_VPC_PUBLIC_SUBNET_CIDRS }}
@@ -67,17 +75,25 @@ jobs:
6775
role-session-name: GitHub_to_AWS_via_FederatedOIDC
6876
- name: Setup OpenTofu
6977
uses: opentofu/setup-opentofu@v1
78+
with:
79+
tofu_wrapper: false
7080
- name: Display OpenTofu version
7181
run: tofu version
7282
- name: Set optional variables
7383
env:
7484
# For any of these that have a value, the corresponding TF_VAR_*
7585
# environment variable will be set.
86+
ENVIRONMENT: ${{ secrets.TF_VAR_ENVIRONMENT }}
7687
EXPORT_EXPIRATION: ${{ secrets.TF_VAR_EXPORT_EXPIRATION }}
7788
KEY_RECOVERY_PERIOD: ${{ secrets.TF_VAR_KEY_RECOVERY_PERIOD }}
7889
PROGRAM: ${{ secrets.TF_VAR_PROGRAM }}
90+
PROJECT: ${{ secrets.TF_VAR_PROJECT }}
91+
REPOSITORY: ${{ secrets.TF_VAR_REPOSITORY }}
7992
run: |
80-
variables=("export_expiration" "key_recovery_period" "program")
93+
variables=(
94+
"environment" "export_expiration" "key_recovery_period" "program"
95+
"project" "repository"
96+
)
8197
for var in ${variables[@]}; do
8298
name="$(echo $var | tr '[:lower:]' '[:upper:]')"
8399
if [ -n "${!name}" ]; then

‎.github/workflows/pull-request.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ on:
66
jobs:
77
configs:
88
runs-on: ubuntu-latest
9+
permissions:
10+
contents: read
911
steps:
1012
- name: Checkout source code
1113
uses: actions/checkout@v4
@@ -65,6 +67,7 @@ jobs:
6567
TF_VAR_EXPORT_EXPIRATION: ${{ secrets.TF_VAR_EXPORT_EXPIRATION }}
6668
TF_VAR_KEY_RECOVERY_PERIOD: ${{ secrets.TF_VAR_KEY_RECOVERY_PERIOD }}
6769
TF_VAR_PROGRAM: ${{ secrets.TF_VAR_PROGRAM }}
70+
TF_VAR_REPO_OIDC_ARN: ${{ secrets.TF_VAR_REPO_OIDC_ARN }}
6871
TF_VAR_VPC_CIDR: ${{ secrets.TF_VAR_VPC_CIDR }}
6972
TF_VAR_VPC_PRIVATE_SUBNET_CIDRS: ${{ secrets.TF_VAR_VPC_PRIVATE_SUBNET_CIDRS }}
7073
TF_VAR_VPC_PUBLIC_SUBNET_CIDRS: ${{ secrets.TF_VAR_VPC_PUBLIC_SUBNET_CIDRS }}

‎tofu/config/foundation/main.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,16 @@ module "logging" {
3131
tags = resource.aws_servicecatalogappregistry_application.application.application_tag
3232
}
3333

34+
module "deployment" {
35+
source = "../../modules/deployment"
36+
37+
environment = var.environment
38+
oidc_arn = var.repo_oidc_arn
39+
project = var.project
40+
repository = var.repository
41+
tags = resource.aws_servicecatalogappregistry_application.application.application_tag
42+
}
43+
3444
module "outputs" {
3545
source = "../../modules/outputs"
3646

‎tofu/config/foundation/outputs.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,11 @@ output "application_arn" {
33
value = aws_servicecatalogappregistry_application.application.arn
44
}
55

6+
output "deployment_role_arn" {
7+
value = module.deployment.role_arn
8+
description = "The ARN of the deployment role for system components."
9+
}
10+
611
output "logging_bucket" {
712
value = module.logging.bucket
813
description = "The name of the S3 bucket for logging."

‎tofu/config/foundation/variables.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,3 +32,14 @@ variable "region" {
3232
description = "AWS region where resources should be deployed."
3333
default = "us-west-1"
3434
}
35+
36+
variable "repository" {
37+
type = string
38+
description = "GitHub repository in the format 'owner/repo'."
39+
default = "codeforamerica/sqs-entity-resolution"
40+
}
41+
42+
variable "repo_oidc_arn" {
43+
type = string
44+
description = "ARN of the OpenID Connect provider for the GitHub repository."
45+
}

‎tofu/modules/deployment/data.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
data "aws_caller_identity" "identity" {}
2+
3+
data "aws_partition" "current" {}
4+
5+
data "aws_region" "current" {}

‎tofu/modules/deployment/main.tf‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
resource "aws_iam_role" "deployment" {
2+
name = "${var.project}-${var.environment}-deployment-role"
3+
assume_role_policy = jsonencode(yamldecode(templatefile("${path.module}/templates/assume-policy.yaml.tftpl", {
4+
oidc_arn : var.oidc_arn
5+
repository : var.repository
6+
})))
7+
8+
tags = var.tags
9+
}
10+
11+
resource "aws_iam_role_policy" "deployment" {
12+
name = "${var.project}-${var.environment}-deployment-policy"
13+
role = aws_iam_role.deployment.name
14+
15+
policy = jsonencode(yamldecode(templatefile("${path.module}/templates/iam-policy.yaml.tftpl", {
16+
account_id : data.aws_caller_identity.identity.account_id
17+
environment : var.environment
18+
region : data.aws_region.current.region
19+
partition : data.aws_partition.current.partition
20+
project : var.project
21+
})))
22+
}

‎tofu/modules/deployment/outputs.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
output "role_arn" {
2+
description = "ARN of the IAM role created for deployments."
3+
value = aws_iam_role.deployment.arn
4+
}
5+
6+
output "role_name" {
7+
description = "Name of the IAM role created for deployments."
8+
value = aws_iam_role.deployment.name
9+
}

‎tofu/modules/deployment/templates/assume-policy.yaml.tftpl‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
Version: "2012-10-17"
2+
Statement:
3+
- Effect: Allow
4+
Principal:
5+
Federated: ${oidc_arn}
6+
Action: sts:AssumeRoleWithWebIdentity
7+
Condition:
8+
StringEquals:
9+
token.actions.githubusercontent.com:aud: sts.amazonaws.com
10+
StringLike:
11+
token.actions.githubusercontent.com:sub: repo:${repository}:*

0 commit comments

Comments
 (0)