Skip to content

feat(RAIN-94239): Rm modify terraform to add a policy #127

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 10 commits into from
Jan 30, 2025
Merged

feat(RAIN-94239): Rm modify terraform to add a policy #127

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
e129ca1
Adding a new policy to avoid iam policy char limit
LMAX-iwnf Jan 22, 2025
97053b5
Fix bug
LMAX-iwnf Jan 22, 2025
705fcde
remove empty line
LMAX-iwnf Jan 22, 2025
3578f3d
Added comments to the code to explain why we need another policy
LMAX-iwnf Jan 22, 2025
e2cc253
Add terraform doc
LMAX-iwnf Jan 22, 2025
46fe02d
Adding permission for kinesis video
LMAX-iwnf Jan 22, 2025
f83cec9
Revise the name for the policy to be more verbose
LMAX-iwnf Jan 23, 2025
a56a278
Fix typo
LMAX-iwnf Jan 23, 2025
66996df
Updated the doc
LMAX-iwnf Jan 23, 2025
251372a
Move new permissions all into the new policy
LMAX-iwnf Jan 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,3 +195,23 @@ The audit policy is comprised of the following permissions:
| PERSONALIZE | personalize:Describe* | |
| | personalize:List* | |
| | personalize:GetSolutionMetrics | |
| CODEARTIFACT | codeartifact:ListDomains | * |
| | codeartifact:DescribeDomain | |
| | codeartifact:DescribeRepository | |
| | codeartifact:ListPackages | |
| | codeartifact:GetRepositoryEndpoint | |
| | codeartifact:DescribePackage | |
| | codeartifact:ListPackageVersions | |
| | codeartifact:DescribePackageVersion | |
| | codeartifact:GetPackageVersionReadme | |
| | codeartifact:ListPackageVersionDependencies | |
| | codeartifact:ListPackageVersionAssets | |
| | codeartifact:GetPackageVersionAsset | |
| FIS | fis:ListActions | * |
| | fis:GetAction | |
| | fis:ListExperimentTemplates | |
| | fis:GetExperimentTemplate | |
| | fis:ListTargetAccountConfigurations | |
| | fis:ListExperiments | |
| | fis:GetExperiment | |
| | fis:ListExperimentResolvedTargets | |
60 changes: 60 additions & 0 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ locals {
lacework_audit_policy_name = (
length(var.lacework_audit_policy_name) > 0 ? var.lacework_audit_policy_name : "lwaudit-policy-${random_id.uniq.hex}"
)
lacework_audit_policy_name_b = "${local.lacework_audit_policy_name}-b"
version_file = "${abspath(path.module)}/VERSION"
module_name = "terraform-aws-config"
module_version = fileexists(local.version_file) ? file(local.version_file) : ""
Expand Down Expand Up @@ -167,6 +168,7 @@ data "aws_iam_policy_document" "lacework_audit_policy" {
"ses:ListRecommendations",
"ses:ListSuppressedDestinations",
"ses:GetSuppressedDestination",
"ses:ListTagsForResource",
]
resources = ["*"]
}
Expand Down Expand Up @@ -197,6 +199,7 @@ data "aws_iam_policy_document" "lacework_audit_policy" {
"backup:ListRecoveryPointsByResource",
"backup:ListReportPlans",
"backup:ListRestoreJobs",
"backup:ListTags",
]
resources = ["*"]
}
Expand Down Expand Up @@ -248,6 +251,7 @@ data "aws_iam_policy_document" "lacework_audit_policy" {
"aps:DescribeWorkspace",
"aps:ListRuleGroupsNamespaces",
"aps:DescribeRuleGroupsNamespace",
"aps:ListTagsForResource",
]
resources = ["*"]
}
Expand All @@ -270,6 +274,46 @@ data "aws_iam_policy_document" "lacework_audit_policy" {
}
}


data "aws_iam_policy_document" "lacework_audit_policy_b" {
count = var.use_existing_iam_role_policy ? 0 : 1
version = "2012-10-17"

statement {
sid = "CODEARTIFACT"
actions = ["codeartifact:ListDomains",
"codeartifact:DescribeDomain",
"codeartifact:DescribeRepository",
"codeartifact:ListPackages",
"codeartifact:GetRepositoryEndpoint",
"codeartifact:DescribePackage",
"codeartifact:ListPackageVersions",
"codeartifact:DescribePackageVersion",
"codeartifact:GetPackageVersionReadme",
"codeartifact:ListPackageVersionDependencies",
"codeartifact:ListPackageVersionAssets",
"codeartifact:GetPackageVersionAsset",
"codeartifact:ListTagsForResource",
]
resources = ["*"]
}

statement {
sid = "FIS"
actions = ["fis:ListActions",
"fis:GetAction",
"fis:ListExperimentTemplates",
"fis:GetExperimentTemplate",
"fis:ListTargetAccountConfigurations",
"fis:ListExperiments",
"fis:GetExperiment",
"fis:ListExperimentResolvedTargets",
"fis:ListTagsForResource",
]
resources = ["*"]
}
}

resource "aws_iam_policy" "lacework_audit_policy" {
count = var.use_existing_iam_role_policy ? 0 : 1
name = local.lacework_audit_policy_name
Expand All @@ -278,20 +322,36 @@ resource "aws_iam_policy" "lacework_audit_policy" {
tags = var.tags
}

resource "aws_iam_policy" "lacework_audit_policy_b" {
count = var.use_existing_iam_role_policy ? 0 : 1
name = local.lacework_audit_policy_name_b
description = "An audit policy to allow Lacework to read configs (extends SecurityAudit), this is the second policy"
policy = data.aws_iam_policy_document.lacework_audit_policy_b[0].json
tags = var.tags
}

resource "aws_iam_role_policy_attachment" "lacework_audit_policy_attachment" {
count = var.use_existing_iam_role_policy ? 0 : 1
role = local.iam_role_name
policy_arn = aws_iam_policy.lacework_audit_policy[0].arn
depends_on = [module.lacework_cfg_iam_role]
}

resource "aws_iam_role_policy_attachment" "lacework_audit_policy_attachment_b" {
count = var.use_existing_iam_role_policy ? 0 : 1
role = local.iam_role_name
policy_arn = aws_iam_policy.lacework_audit_policy_b[0].arn
depends_on = [module.lacework_cfg_iam_role]
}

# wait for X seconds for things to settle down in the AWS side
# before trying to create the Lacework external integration
resource "time_sleep" "wait_time" {
create_duration = var.wait_time
depends_on = [
aws_iam_role_policy_attachment.security_audit_policy_attachment,
aws_iam_role_policy_attachment.lacework_audit_policy_attachment,
aws_iam_role_policy_attachment.lacework_audit_policy_attachment_b,
]
}

Expand Down
Loading