Merge pull request #9153 from ministryofjustice/DBA-827

Dba 827
ministryofjustice · Dec 20, 2024 · d923a78 · d923a78
2 parents 7043afb + 53ea13d
commit d923a78
Show file tree

Hide file tree

Showing 4 changed files with 48 additions and 0 deletions.
diff --git a/terraform/environments/delius-core/modules/components/oracle_db_shared/backup_vault.tf b/terraform/environments/delius-core/modules/components/oracle_db_shared/backup_vault.tf
@@ -7,4 +7,41 @@ resource "aws_backup_vault" "oracle_backup_vault" {
       "Name" = "${var.env_name}-${var.db_suffix}-oracle-backup-vault"
     },
   )
+}
+
+# Allow the AWSBackupDefaultServiceRole role to be passed to the instance roles.
+# We use Backup Vault to manage EC2 snapshots for Oracle hosts as these are only created sporadically, 
+# e.g. ahead of a service release, and will therefore not be continually overwritten.  Writing them to a
+# backup vault allows them to timeout without being overwritten.
+# The AWSBackupDefaultServiceRole managed by AWS and is documented at: 
+# https://docs.aws.amazon.com/aws-backup/latest/devguide/iam-service-roles.html
+resource "aws_iam_policy" "oracle_ec2_snapshot_backup_role_policy" {
+  name = "oracle-ec2-snapshot-backup-role-policy"
+  description = "Allow iam:PassRole for AWSBackupDefaultServiceRole"
+
+  policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [
+      {
+        Effect   = "Allow",
+        Action   = "iam:PassRole",
+        Resource = "arn:aws:iam::${var.account_info.id}:role/service-role/AWSBackupDefaultServiceRole"
+      },
+      {
+        Effect  = "Allow"
+        Action  = ["backup:ListBackupVaults",
+                   "backup:StartBackupJob",
+                   "backup:DescribeBackupJob",
+                   "ec2:DescribeSnapshots"],
+        Resource = "*"
+      }
+    ]
+  })
+}
+
+# Allow Access To AWSBackupDefaultServiceRolePolicy From EC2 Instance Roles
+resource "aws_iam_policy_attachment" "oracle_ec2_snapshot_backup_role_policy_attachment" {
+  name       = "oracle-ec2-snapshot-backup-role-policy-attachment"
+  roles      = var.instance_roles
+  policy_arn = aws_iam_policy.oracle_ec2_snapshot_backup_role_policy.arn
 }
diff --git a/terraform/environments/delius-core/modules/components/oracle_db_shared/variables.tf b/terraform/environments/delius-core/modules/components/oracle_db_shared/variables.tf
@@ -49,3 +49,8 @@ variable "db_suffix" {
   type        = string
   default     = "db"
 }
+
+variable "instance_roles" {
+  description = "AMI roles associated with the database EC2 hosts"
+  type        = list(string)
+}
diff --git a/terraform/environments/delius-core/modules/delius_environment/database.tf b/terraform/environments/delius-core/modules/delius_environment/database.tf
@@ -17,6 +17,7 @@ module "oracle_db_shared" {
   env_name           = var.env_name
   tags               = local.tags
   public_keys        = local.db_public_key_data.keys[var.env_name]
+  instance_roles     = [for i in range(1,try(var.db_config.primary_instance_count, 1) + try(var.db_config.standby_count, 0) + 1): "instance-role-delius-core-${var.env_name}-db-${i}"]
 
   bastion_sg_id = module.bastion_linux.bastion_security_group
 

diff --git a/terraform/environments/delius-mis/modules/mis_environment/databases.tf b/terraform/environments/delius-mis/modules/mis_environment/databases.tf
@@ -20,6 +20,11 @@ module "oracle_db_shared" {
   env_name           = var.env_name
   tags               = local.tags
   public_keys        = local.db_public_key_data.keys[var.account_info.mp_environment]
+  instance_roles     = concat(
+     each.key == "mis-db" ? [for i in range(1,try(var.mis_db_config.instance_count, 1) + 1): "arn:aws:iam::${var.account_info.id}:role/instance-role-delius-mis-${var.env_name}-mis-db-${i}"] : [],
+     each.key == "boe-db" ? [for i in range(1,try(var.boe_db_config.instance_count, 1) + 1): "arn:aws:iam::${var.account_info.id}:role/instance-role-delius-mis-${var.env_name}-boe-db-${i}"] : [],
+     each.key == "dsd-db" ? [for i in range(1,try(var.dsd_db_config.instance_count, 1) + 1): "arn:aws:iam::${var.account_info.id}:role/instance-role-delius-mis-${var.env_name}-mis-db-${i}"] : []
+  )
 
   db_suffix = each.key