Skip to content

Commit 38dc88e

Browse files
eshiferaxeshiferax
authored
style: Convert rift-compute-manager and rift-compute policies from HCL to json template. (#202)
Moving policy definitions for the `tecton-rift-compute` and `tecton-rift-compute-manager` roles out of HCL and into json templates in the `templates/` directory. Tested by using git source reference to this (`templates-iam`) branch and running `terraform plan` on an internal cluster state that uses the `rift_compute` module. Result = "No changes. Your infrastructure matches the configuration."
1 parent d2b3d2a commit 38dc88e

9 files changed

+355
-339
lines changed

‎rift_compute/iam.tf‎

Lines changed: 29 additions & 339 deletions
Large diffs are not rendered by default.

‎templates/manage_rift_compute_policy.json‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Action": [
7+
"ec2:StopInstances",
8+
"ec2:TerminateInstances",
9+
"ec2:CreateTags"
10+
],
11+
"Resource": [
12+
"arn:aws:ec2:*:${ACCOUNT_ID}:instance/*"
13+
],
14+
"Condition": {
15+
"Null": {
16+
"ec2:ResourceTag/tecton_rift_workflow_id": "false"
17+
}
18+
}
19+
},
20+
{
21+
"Effect": "Allow",
22+
"Action": [
23+
"ec2:StartInstances",
24+
"ec2:RunInstances"
25+
],
26+
"Resource": [
27+
"arn:aws:ec2:*:${ACCOUNT_ID}:instance/*"
28+
],
29+
"Condition": {
30+
"Null": {
31+
"aws:RequestTag/tecton_rift_workflow_id": "false"
32+
}
33+
}
34+
},
35+
{
36+
"Effect": "Allow",
37+
"Action": [
38+
"ec2:DescribeInstances",
39+
"ec2:DescribeInstanceStatus",
40+
"ec2:DescribeInstanceTypes",
41+
"ec2:DescribeNetworkInterfaces",
42+
"ec2:CreateTags",
43+
"ec2:DeleteTags"
44+
],
45+
"Resource": ["*"]
46+
},
47+
{
48+
"Effect": "Allow",
49+
"Action": [
50+
"ec2:RunInstances"
51+
],
52+
"Resource": ${ALLOW_RUN_INSTANCES_RESOURCES}
53+
},
54+
{
55+
"Effect": "Allow",
56+
"Action": [
57+
"ec2:RunInstances",
58+
"ec2:DeleteNetworkInterface"
59+
],
60+
"Resource": [
61+
"arn:aws:ec2:*:${ACCOUNT_ID}:network-interface/*"
62+
],
63+
"Condition": {
64+
"Null": {
65+
"ec2:ResourceTag/tecton_rift_workflow_id": "false"
66+
}
67+
}
68+
},
69+
{
70+
"Effect": "Allow",
71+
"Action": [
72+
"ec2:CreateNetworkInterface"
73+
],
74+
"Resource": [
75+
"arn:aws:ec2:*:${ACCOUNT_ID}:network-interface/*"
76+
],
77+
"Condition": {
78+
"Null": {
79+
"aws:RequestTag/tecton_rift_workflow_id": "false"
80+
}
81+
}
82+
},
83+
{
84+
"Effect": "Allow",
85+
"Action": [
86+
"ec2:CreateNetworkInterface"
87+
],
88+
"Resource": ${ALLOW_NETWORK_INTERFACE_RESOURCES}
89+
},
90+
{
91+
"Effect": "Allow",
92+
"Action": [
93+
"ec2:RunInstances"
94+
],
95+
"Resource": [
96+
"arn:aws:ec2:*::image/*"
97+
],
98+
"Condition": {
99+
"StringEquals": {
100+
"ec2:Owner": ["amazon", "472542229217"]
101+
}
102+
}
103+
},
104+
{
105+
"Effect": "Allow",
106+
"Action": ["iam:PassRole"],
107+
"Resource": ["${RIFT_COMPUTE_ROLE_ARN}"]
108+
},
109+
{
110+
"Effect": "Allow",
111+
"Action": [
112+
"ssm:GetParameters"
113+
],
114+
"Resource": ["*"]
115+
},
116+
{
117+
"Effect": "Allow",
118+
"Action": [
119+
"servicequotas:GetServiceQuota"
120+
],
121+
"Resource": [
122+
"arn:aws:servicequotas:*:${ACCOUNT_ID}:ec2/L-1216C47A"
123+
]
124+
}
125+
]
126+
}

‎templates/offline_store_access_policy.json‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Action": ["s3:ListBucket", "s3:HeadBucket"],
7+
"Resource": ["${OFFLINE_STORE_BUCKET_ARN}"]
8+
},
9+
{
10+
"Effect": "Allow",
11+
"Action": ["s3:*"],
12+
"Resource": [
13+
"${OFFLINE_STORE_BUCKET_ARN}/${OFFLINE_STORE_KEY_PREFIX}",
14+
"${OFFLINE_STORE_BUCKET_ARN}/${OFFLINE_STORE_KEY_PREFIX}*",
15+
"${OFFLINE_STORE_BUCKET_ARN}/tecton-model-artifacts",
16+
"${OFFLINE_STORE_BUCKET_ARN}/tecton-model-artifacts*"
17+
]
18+
},
19+
{
20+
"Effect": "Allow",
21+
"Action": ["s3:*"],
22+
"Resource": ["${OFFLINE_STORE_BUCKET_ARN}"],
23+
"Condition": {
24+
"StringLike": {
25+
"s3:prefix": "${OFFLINE_STORE_KEY_PREFIX}*"
26+
}
27+
}
28+
},
29+
{
30+
"Effect": "Allow",
31+
"Action": [
32+
"s3:Get*",
33+
"s3:List*",
34+
"s3:Describe*"
35+
],
36+
"Resource": ["${OFFLINE_STORE_BUCKET_ARN}/internal/*"]
37+
},
38+
{
39+
"Effect": "Allow",
40+
"Action": [
41+
"s3:ListBucket",
42+
"s3:GetObject"
43+
],
44+
"Resource": ["*"],
45+
"Condition": {
46+
"StringNotEquals": {
47+
"s3:ResourceAccount": "${ACCOUNT_ID}"
48+
}
49+
}
50+
}
51+
%{ if USE_KMS_KEY ~}
52+
,
53+
{
54+
"Effect": "Allow",
55+
"Action": [
56+
"kms:Decrypt",
57+
"kms:GenerateDataKey"
58+
],
59+
"Resource": ["${KMS_KEY_ARN}"]
60+
}
61+
%{ endif ~}
62+
]
63+
}

‎templates/rift_bootstrap_scripts_policy.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Action": [
7+
"s3:GetObject",
8+
"s3:ListObject",
9+
"s3:HeadObject"
10+
],
11+
"Resource": [
12+
"${OFFLINE_STORE_BUCKET_ARN}/rift-bootstrap-scripts/*"
13+
]
14+
}
15+
]
16+
}

‎templates/rift_compute_internal_policy.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Action": [
7+
"secretsmanager:*"
8+
],
9+
"Resource": ["*"],
10+
"Condition": {
11+
"StringEquals": {
12+
"secretsmanager:ResourceAccount": "${ACCOUNT_ID}"
13+
}
14+
}
15+
},
16+
{
17+
"Effect": "Allow",
18+
"Action": [
19+
"kms:*"
20+
],
21+
"Resource": ["*"],
22+
"Condition": {
23+
"StringEquals": {
24+
"kms:ResourceAccount": "${ACCOUNT_ID}"
25+
}
26+
}
27+
}
28+
]
29+
}

‎templates/rift_compute_logs_policy.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Action": [
7+
"s3:GetObject",
8+
"s3:ListObject",
9+
"s3:HeadObject",
10+
"s3:PutObject"
11+
],
12+
"Resource": [
13+
"${S3_LOG_DESTINATION}",
14+
"${S3_LOG_DESTINATION}/*"
15+
]
16+
}
17+
]
18+
}

‎templates/rift_dynamodb_access_policy.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Action": [
7+
"dynamodb:BatchGetItem",
8+
"dynamodb:BatchWriteItem",
9+
"dynamodb:CreateTable",
10+
"dynamodb:DeleteItem",
11+
"dynamodb:DescribeTable",
12+
"dynamodb:GetItem",
13+
"dynamodb:PutItem",
14+
"dynamodb:UpdateItem",
15+
"dynamodb:Query"
16+
],
17+
"Resource": [
18+
"arn:aws:dynamodb:*:${ACCOUNT_ID}:table/tecton-*"
19+
]
20+
},
21+
{
22+
"Effect": "Allow",
23+
"Action": [
24+
"sts:AssumeRole"
25+
],
26+
"Resource": ["arn:aws:iam::${ACCOUNT_ID}:role/${CLUSTER_NAME}-cross-account-intermediate"]
27+
}
28+
]
29+
}

‎templates/rift_ecr_readonly_policy.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Action": [
7+
"ecr:BatchCheckLayerAvailability",
8+
"ecr:GetDownloadUrlForLayer",
9+
"ecr:GetRepositoryPolicy",
10+
"ecr:DescribeRepositories",
11+
"ecr:ListImages",
12+
"ecr:DescribeImages",
13+
"ecr:BatchGetImage",
14+
"ecr:GetLifecyclePolicy",
15+
"ecr:GetLifecyclePolicyPreview",
16+
"ecr:ListTagsForResource",
17+
"ecr:DescribeImageScanFindings"
18+
],
19+
"Resource": [
20+
"${RIFT_ENV_ECR_REPOSITORY_ARN}"
21+
]
22+
},
23+
{
24+
"Effect": "Allow",
25+
"Action": [
26+
"ecr:GetAuthorizationToken"
27+
],
28+
"Resource": ["*"]
29+
}
30+
]
31+
}

‎templates/rift_legacy_secrets_manager_access_policy.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Action": [
7+
"secretsmanager:*"
8+
],
9+
"Resource": [
10+
"arn:aws:secretsmanager:*:${ACCOUNT_ID}:secret:tecton-*"
11+
]
12+
}
13+
]
14+
}

0 commit comments

Comments
 (0)