feat: permission are created based on binary scanner use

Author: hayk99

examples/single-account-k8s/credentials.tf

@@ -3,6 +3,7 @@ module "iam_user" {
   name   = var.name
 
   deploy_image_scanning = local.deploy_image_scanning
+  use_standalone_scanner = var.use_standalone_scanner
 
   ssm_secure_api_token_arn       = module.ssm.secure_api_token_secret_arn
   cloudtrail_s3_bucket_arn       = length(module.cloudtrail) > 0 ? module.cloudtrail[0].s3_bucket_arn : "*"

modules/infrastructure/permissions/cloud-scanning/main.tf

@@ -1,4 +1,5 @@
 resource "aws_iam_user_policy" "cloud_scanner" {
+
   name   = "${var.name}-cs"
   user   = data.aws_iam_user.this.user_name
   policy = data.aws_iam_policy_document.cloud_scanner.json
@@ -17,16 +18,18 @@ data "aws_iam_policy_document" "cloud_scanner" {
     resources = [var.cloudtrail_subscribed_sqs_arn]
   }
 
-  statement {
-    sid    = "AllowScanningCodeBuildStartBuild"
-    effect = "Allow"
-    actions = [
-      "codebuild:StartBuild"
-    ]
-    resources = [var.scanning_codebuild_project_arn]
+  dynamic "statement" {
+    for_each = var.use_standalone_scanner ? [1] : []
+    content {
+      sid    = "AllowScanningCodeBuildStartBuild"
+      effect = "Allow"
+      actions = [
+        "codebuild:StartBuild"
+      ]
+      resources = [var.scanning_codebuild_project_arn]
+    }
   }
 
-
   statement {
     sid    = "AllowScanningECRRead"
     effect = "Allow"

modules/infrastructure/permissions/cloud-scanning/variables.tf

@@ -14,6 +14,11 @@ variable "scanning_codebuild_project_arn" {
   description = "ARN of codebuild to launch the image scanning process"
 }
 
+variable "use_standalone_scanner" {
+  type        = bool
+  description = "true/false whether use inline scanner or not"
+  default     = false
+}
 
 #---------------------------------
 # optionals - with default

modules/infrastructure/permissions/iam-user/main.tf

@@ -1,4 +1,3 @@
-
 resource "aws_iam_user" "this" {
   name          = var.name
   force_destroy = true
@@ -12,7 +11,6 @@ resource "aws_iam_access_key" "this" {
 }
 
 
-
 module "credentials_general" {
   source = "../general"
   name   = var.name
@@ -43,6 +41,7 @@ module "credentials_cloud_scanning" {
   sfc_user_name                  = aws_iam_user.this.name
   scanning_codebuild_project_arn = var.scanning_codebuild_project_arn
   cloudtrail_subscribed_sqs_arn  = var.cloudtrail_subscribed_sqs_arn
+  use_standalone_scanner         = var.use_standalone_scanner
 
   depends_on = [aws_iam_user.this]
 }

modules/infrastructure/permissions/iam-user/variables.tf

@@ -8,6 +8,11 @@ variable "deploy_image_scanning" {
   default     = true
 }
 
+variable "use_standalone_scanner" {
+  type        = bool
+  description = "true/false whether use inline scanner or not"
+  default     = false
+}
 
 # permission defaults to all resources; ARN *