Skip to content

Commit b84201a

Browse files
jamesiarmesjamesiarmes
authored
feat: Add additional deployment roles and permissions. (#21)
1 parent aa69031 commit b84201a

File tree

10 files changed

+123
-6
lines changed

10 files changed

+123
-6
lines changed

‎.github/workflows/deploy.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ jobs:
3838
TF_VAR_APPLY_DATABASE_UPDATES_IMMEDIATELY: ${{ secrets.TF_VAR_APPLY_DATABASE_UPDATES_IMMEDIATELY }}
3939
TF_VAR_DATABASE_SKIP_FINAL_SNAPSHOT: ${{ secrets.TF_VAR_DATABASE_SKIP_FINAL_SNAPSHOT }}
4040
TF_VAR_DELETION_PROTECTION: ${{ secrets.TF_VAR_DELETION_PROTECTION }}
41+
TF_VAR_DEPLOYMENT_ENVIRONMENTS: ${{ secrets.TF_VAR_DEPLOYMENT_ENVIRONMENTS }}
4142
TF_VAR_ENVIRONMENT: ${{ secrets.TF_VAR_ENVIRONMENT }}
4243
TF_VAR_EXPORT_EXPIRATION: ${{ secrets.TF_VAR_EXPORT_EXPIRATION }}
4344
TF_VAR_KEY_RECOVERY_PERIOD: ${{ secrets.TF_VAR_KEY_RECOVERY_PERIOD }}
@@ -82,6 +83,7 @@ jobs:
8283
APPLY_DATABASE_UPDATES_IMMEDIATELY: ${{ secrets.TF_VAR_APPLY_DATABASE_UPDATES_IMMEDIATELY }}
8384
DATABASE_SKIP_FINAL_SNAPSHOT: ${{ secrets.TF_VAR_DATABASE_SKIP_FINAL_SNAPSHOT }}
8485
DELETION_PROTECTION: ${{ secrets.TF_VAR_DELETION_PROTECTION }}
86+
DEPLOYMENT_ENVIRONMENTS: ${{ secrets.TF_VAR_DEPLOYMENT_ENVIRONMENTS }}
8587
ENVIRONMENT: ${{ secrets.TF_VAR_ENVIRONMENT }}
8688
EXPORT_EXPIRATION: ${{ secrets.TF_VAR_EXPORT_EXPIRATION }}
8789
KEY_RECOVERY_PERIOD: ${{ secrets.TF_VAR_KEY_RECOVERY_PERIOD }}
@@ -91,8 +93,9 @@ jobs:
9193
run: |
9294
variables=(
9395
"apply_database_updates_immediately" "database_skip_final_snapshot"
94-
"deletion_protection" "environment" "export_expiration"
95-
"key_recovery_period" "program" "project" "repository"
96+
"deletion_protection" "deployment_environments" "environment"
97+
"export_expiration" "key_recovery_period" "program" "project"
98+
"repository"
9699
)
97100
for var in ${variables[@]}; do
98101
name="$(echo $var | tr '[:lower:]' '[:upper:]')"

‎.github/workflows/plan.yaml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ on:
2222
required: false
2323
TF_VAR_DELETION_PROTECTION:
2424
required: false
25+
TF_VAR_DEPLOYMENT_ENVIRONMENTS:
26+
required: false
2527
TF_VAR_ENVIRONMENT:
2628
required: false
2729
TF_VAR_EXPORT_EXPIRATION:
@@ -92,6 +94,7 @@ jobs:
9294
APPLY_DATABASE_UPDATES_IMMEDIATELY: ${{ secrets.TF_VAR_APPLY_DATABASE_UPDATES_IMMEDIATELY }}
9395
DATABASE_SKIP_FINAL_SNAPSHOT: ${{ secrets.TF_VAR_DATABASE_SKIP_FINAL_SNAPSHOT }}
9496
DELETION_PROTECTION: ${{ secrets.TF_VAR_DELETION_PROTECTION }}
97+
DEPLOYMENT_ENVIRONMENTS: ${{ secrets.TF_VAR_DEPLOYMENT_ENVIRONMENTS }}
9598
ENVIRONMENT: ${{ secrets.TF_VAR_ENVIRONMENT }}
9699
EXPORT_EXPIRATION: ${{ secrets.TF_VAR_EXPORT_EXPIRATION }}
97100
KEY_RECOVERY_PERIOD: ${{ secrets.TF_VAR_KEY_RECOVERY_PERIOD }}
@@ -101,8 +104,9 @@ jobs:
101104
run: |
102105
variables=(
103106
"apply_database_updates_immediately" "database_skip_final_snapshot"
104-
"deletion_protection" "environment" "export_expiration"
105-
"key_recovery_period" "program" "project" "repository"
107+
"deletion_protection" "deployment_environments" "environment"
108+
"export_expiration" "key_recovery_period" "program" "project"
109+
"repository"
106110
)
107111
for var in ${variables[@]}; do
108112
name="$(echo $var | tr '[:lower:]' '[:upper:]')"

‎.github/workflows/pull-request.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,10 +67,12 @@ jobs:
6767
TF_VAR_APPLY_DATABASE_UPDATES_IMMEDIATELY: ${{ secrets.TF_VAR_APPLY_DATABASE_UPDATES_IMMEDIATELY }}
6868
TF_VAR_DATABASE_SKIP_FINAL_SNAPSHOT: ${{ secrets.TF_VAR_DATABASE_SKIP_FINAL_SNAPSHOT }}
6969
TF_VAR_DELETION_PROTECTION: ${{ secrets.TF_VAR_DELETION_PROTECTION }}
70+
TF_VAR_DEPLOYMENT_ENVIRONMENTS: ${{ secrets.TF_VAR_DEPLOYMENT_ENVIRONMENTS }}
7071
TF_VAR_EXPORT_EXPIRATION: ${{ secrets.TF_VAR_EXPORT_EXPIRATION }}
7172
TF_VAR_KEY_RECOVERY_PERIOD: ${{ secrets.TF_VAR_KEY_RECOVERY_PERIOD }}
7273
TF_VAR_PROGRAM: ${{ secrets.TF_VAR_PROGRAM }}
7374
TF_VAR_REPO_OIDC_ARN: ${{ secrets.TF_VAR_REPO_OIDC_ARN }}
75+
TF_VAR_REPOSITORY: ${{ secrets.TF_VAR_REPOSITORY }}
7476
TF_VAR_VPC_CIDR: ${{ secrets.TF_VAR_VPC_CIDR }}
7577
TF_VAR_VPC_PRIVATE_SUBNET_CIDRS: ${{ secrets.TF_VAR_VPC_PRIVATE_SUBNET_CIDRS }}
7678
TF_VAR_VPC_PUBLIC_SUBNET_CIDRS: ${{ secrets.TF_VAR_VPC_PUBLIC_SUBNET_CIDRS }}

‎tofu/config/foundation/main.tf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,19 @@ module "deployment" {
4141
tags = resource.aws_servicecatalogappregistry_application.application.application_tag
4242
}
4343

44+
# Create deployment resources for any deployment environments specified.
45+
module "deployment_environments" {
46+
source = "../../modules/deployment"
47+
for_each = toset(var.deployment_environments)
48+
49+
environment = "development"
50+
system_environment = each.value
51+
oidc_arn = var.repo_oidc_arn
52+
project = var.project
53+
repository = var.repository
54+
tags = resource.aws_servicecatalogappregistry_application.application.application_tag
55+
}
56+
4457
module "outputs" {
4558
source = "../../modules/outputs"
4659

‎tofu/config/foundation/outputs.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,11 @@ output "deployment_role_arn" {
88
description = "The ARN of the deployment role for system components."
99
}
1010

11+
output "environment_deployment_roles" {
12+
value = { for env, mod in module.deployment_environments : env => mod.role_arn }
13+
description = "The ARN of the deployment role for the dev-cdii environment."
14+
}
15+
1116
output "logging_bucket" {
1217
value = module.logging.bucket
1318
description = "The name of the S3 bucket for logging."

‎tofu/config/foundation/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
variable "deployment_environments" {
2+
type = list(string)
3+
description = "List of deployment environments to create permissions for. This is useful if you'll be deploying multiple service environments within the same infrastructure environment."
4+
default = []
5+
}
6+
17
variable "environment" {
28
type = string
39
description = "Environment for the deployment."

‎tofu/modules/deployment/locals.tf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
locals {
2+
system_environment = coalesce(var.system_environment, var.environment)
3+
}

‎tofu/modules/deployment/main.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
resource "aws_iam_role" "deployment" {
2-
name = "${var.project}-${var.environment}-deployment-role"
2+
name = "${var.project}-${local.system_environment}-deployment-role"
33
assume_role_policy = jsonencode(yamldecode(templatefile("${path.module}/templates/assume-policy.yaml.tftpl", {
44
oidc_arn : var.oidc_arn
55
repository : var.repository
@@ -9,7 +9,7 @@ resource "aws_iam_role" "deployment" {
99
}
1010

1111
resource "aws_iam_role_policy" "deployment" {
12-
name = "${var.project}-${var.environment}-deployment-policy"
12+
name = "${var.project}-${local.system_environment}-deployment-policy"
1313
role = aws_iam_role.deployment.name
1414

1515
policy = jsonencode(yamldecode(templatefile("${path.module}/templates/iam-policy.yaml.tftpl", {
@@ -18,5 +18,6 @@ resource "aws_iam_role_policy" "deployment" {
1818
region : data.aws_region.current.region
1919
partition : data.aws_partition.current.partition
2020
project : var.project
21+
system_environment : local.system_environment
2122
})))
2223
}

‎tofu/modules/deployment/templates/iam-policy.yaml.tftpl‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,79 @@
11
Version: "2012-10-17"
22
Statement:
3+
- Sid: InfraStateAccess
4+
Effect: Allow
5+
Action:
6+
- s3:CreateBucket
7+
- s3:ListBucket
8+
- s3:GetBucketLocation
9+
- s3:GetObject
10+
- s3:PutObject
11+
- s3:DeleteObject
12+
Resource:
13+
- arn:${partition}:s3:::${project}-${environment}-tfstate
14+
- arn:${partition}:s3:::${project}-${environment}-tfstate/*
15+
- Sid: InfraLockAccess
16+
Effect: Allow
17+
Action:
18+
- dynamodb:CreateTable
19+
- dynamodb:DescribeTable
20+
- dynamodb:DeleteTable
21+
- dynamodb:UpdateTable
22+
- dynamodb:GetItem
23+
- dynamodb:PutItem
24+
- dynamodb:DeleteItem
25+
Resource:
26+
- arn:${partition}:dynamodb:${region}:${account_id}:table/${environment}.tfstate
27+
28+
- Sid: ServiceCatalogAccess
29+
Effect: Allow
30+
Action:
31+
- servicecatalog:CreateApplication
32+
- servicecatalog:GetApplication
33+
- servicecatalog:DeleteApplication
34+
- servicecatalog:ListTagsForResource
35+
- servicecatalog:TagResource
36+
- servicecatalog:UntagResource
37+
- servicecatalog:UpdateApplication
38+
Resource: "*"
39+
Condition:
40+
ForAnyValue:StringEquals:
41+
aws:ResourceTag/project: sqs-senzing
42+
43+
- Sid: SQSAccess
44+
Effect: Allow
45+
Action:
46+
- sqs:CreateQueue
47+
- sqs:DeleteQueue
48+
- sqs:GetQueueAttributes
49+
- sqs:GetQueueUrl
50+
- sqs:ListQueues
51+
- sqs:ListQueueTags
52+
- sqs:SetQueueAttributes
53+
- sqs:TagQueue
54+
- sqs:UntagQueue
55+
Resource: arn:${partition}:sqs:${region}:${account_id}:${project}-${system_environment}-*
56+
57+
- Sid: S3Access
58+
Effect: Allow
59+
Action:
60+
- s3:CreateBucket
61+
- s3:DeleteBucket
62+
- s3:DeleteObject
63+
- s3:GetBucketAcl
64+
- s3:GetBucketLocation
65+
- s3:GetBucketPolicy
66+
- s3:GetBucketTagging
67+
- s3:GetObject
68+
- s3:ListBucket
69+
- s3:PutBucketAcl
70+
- s3:PutBucketPolicy
71+
- s3:PutBucketTagging
72+
- s3:PutObject
73+
Resource:
74+
- arn:${partition}:s3:::${project}-${system_environment}-*
75+
- arn:${partition}:s3:::${project}-${system_environment}-*/*
76+
377
- Effect: Allow
478
Action:
579
- ec2:DescribeAddresses

‎tofu/modules/deployment/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,12 @@ variable "environment" {
44
default = "development"
55
}
66

7+
variable "system_environment" {
8+
type = string
9+
description = "Environment name for the system, if different from the deployment environment."
10+
default = null
11+
}
12+
713
variable "oidc_arn" {
814
type = string
915
description = "ARN of the OpenID Connect provider for the GitHub repository."

0 commit comments

Comments
 (0)