immunisation-fhir-api/infrastructure/account/iam.tf at 8759869adde7fb51437eaff6eede2cff6b51f1db · NHSDigital/immunisation-fhir-api · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
resource "aws_iam_role" "kinesis_role" {
  name = "kinesis-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Principal = {
        Service = "kinesis.amazonaws.com"
      }
      Action = "sts:AssumeRole"
    }]
  })
}

resource "aws_iam_policy" "kinesis_kms_policy" {
  name        = "kinesis-kms-policy"
  description = "Allow Kinesis to use the KMS key"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Action = [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:GenerateDataKey*",
        "kms:ReEncrypt*",
        "kms:DescribeKey"
      ]
      Resource = aws_kms_key.kinesis_stream_encryption.arn
    }]
  })
}

resource "aws_iam_role_policy_attachment" "kinesis_role_policy_attachment" {
  role       = aws_iam_role.kinesis_role.name
  policy_arn = aws_iam_policy.kinesis_kms_policy.arn
}

resource "aws_iam_role" "auto_ops" {
  name = "auto-ops"

  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Sid    = "",
        Effect = "Allow",
        Principal = {
          Service = "ec2.amazonaws.com"
        },
        Action = "sts:AssumeRole"
      },
      {
        Sid    = "",
        Effect = "Allow",
        Principal = {
          AWS = "arn:aws:iam::${var.build_agent_account_id}:role/build-agent"
        },
        Action = "sts:AssumeRole"
      },
      {
        Sid    = "",
        Effect = "Allow",
        Principal = {
          Federated = "arn:aws:iam::${var.imms_account_id}:oidc-provider/token.actions.githubusercontent.com"
        },
        Action = "sts:AssumeRoleWithWebIdentity",
        Condition = {
          StringEquals = {
            "token.actions.githubusercontent.com:aud" : "sts.amazonaws.com"
          },
          StringLike = {
            "token.actions.githubusercontent.com:sub" : var.environment != "prod" ? [
              "repo:NHSDigital/immunisation-fhir-api:*",
              "repo:NHSDigital/imms_fhir_api_automation:*"
            ] : ["repo:NHSDigital/immunisation-fhir-api:*"]
          }
        }
      }
    ]
  })
}

resource "aws_iam_policy" "auto_ops" {
  name   = "auto-ops"
  policy = file("auto_ops_policy.json")
}

resource "aws_iam_role_policy_attachment" "ssm_core" {
  role       = aws_iam_role.auto_ops.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

resource "aws_iam_role_policy_attachment" "custom_auto_ops" {
  role       = aws_iam_role.auto_ops.name
  policy_arn = aws_iam_policy.auto_ops.arn
}

resource "aws_iam_openid_connect_provider" "github" {
  url = "https://token.actions.githubusercontent.com"

  client_id_list = [
    "sts.amazonaws.com"
  ]

  thumbprint_list = [
    "2b18947a6a9fc7764fd8b5fb18a863b0c6dac24f"
  ]
}