Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Require individual policies for each MIS database type #9173

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
+31 −171
Open

Require individual policies for each MIS database type #9173

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
6baa021
Require individual policies for each MIS database type
bill-buchan Dec 20, 2024
206f100
Friendly name max length 64 chars
bill-buchan Dec 20, 2024
ce8eb93
Use role names, not ARNs
bill-buchan Dec 20, 2024
ad32132
Combine instance policy documents
bill-buchan Dec 24, 2024
87eb29c
Merge branch 'main' into DBA-827
bill-buchan Dec 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 14 additions & 29 deletions terraform/environments/delius-core/modules/components/oracle_db_shared/backup_vault.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,33 +15,18 @@ resource "aws_backup_vault" "oracle_backup_vault" {
# backup vault allows them to timeout without being overwritten.
# The AWSBackupDefaultServiceRole managed by AWS and is documented at:
# https://docs.aws.amazon.com/aws-backup/latest/devguide/iam-service-roles.html
resource "aws_iam_policy" "oracle_ec2_snapshot_backup_role_policy" {
name = "oracle-ec2-snapshot-backup-role-policy"
description = "Allow iam:PassRole for AWSBackupDefaultServiceRole"

policy = jsonencode({
Version = "2012-10-17",
Statement = [
{
Effect = "Allow",
Action = "iam:PassRole",
Resource = "arn:aws:iam::${var.account_info.id}:role/service-role/AWSBackupDefaultServiceRole"
},
{
Effect = "Allow"
Action = ["backup:ListBackupVaults",
"backup:StartBackupJob",
"backup:DescribeBackupJob",
"ec2:DescribeSnapshots"],
Resource = "*"
}
]
})
}

# Allow Access To AWSBackupDefaultServiceRolePolicy From EC2 Instance Roles
resource "aws_iam_policy_attachment" "oracle_ec2_snapshot_backup_role_policy_attachment" {
name = "oracle-ec2-snapshot-backup-role-policy-attachment"
roles = var.instance_roles
policy_arn = aws_iam_policy.oracle_ec2_snapshot_backup_role_policy.arn
data "aws_iam_policy_document" "oracle_ec2_snapshot_backup_role_policy_document" {
statement {
effect = "Allow"
actions = ["iam:PassRole"]
resources = ["arn:aws:iam::${var.account_info.id}:role/service-role/AWSBackupDefaultServiceRole"]
}
statement {
effect = "Allow"
actions = ["backup:ListBackupVaults",
"backup:StartBackupJob",
"backup:DescribeBackupJob",
"ec2:DescribeSnapshots"]
resources = ["*"]
}
}
139 changes: 15 additions & 124 deletions terraform/environments/delius-core/modules/components/oracle_db_shared/iam.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,6 @@
##############################################
# IAM Instance Profile
##############################################
#resource "aws_iam_instance_profile" "db_ec2_instanceprofile" {
# name = format("%s-delius-db-ec2_instance_iam_role", var.env_name)
# role = aws_iam_role.db_ec2_instance_iam_role.name
#}


# Pre-reqs - IAM role, attachment for SSM usage and instance profile
data "aws_iam_policy_document" "db_ec2_instance_iam_assume_policy" {
Expand All @@ -21,15 +16,6 @@ data "aws_iam_policy_document" "db_ec2_instance_iam_assume_policy" {
}
}


#resource "aws_iam_role" "db_ec2_instance_iam_role" {
# name = lower(format("%s-delius-db-ec2_instance", var.env_name))
# assume_role_policy = data.aws_iam_policy_document.db_ec2_instance_iam_assume_policy.json
# tags = merge(var.tags,
# { Name = lower(format("%s-delius-db-ec2_instance", var.env_name)) }
# )
#}

data "aws_iam_policy_document" "business_unit_kms_key_access" {
statement {
effect = "Allow"
Expand Down Expand Up @@ -69,12 +55,6 @@ data "aws_iam_policy_document" "core_shared_services_bucket_access" {
}
}

resource "aws_iam_policy" "core_shared_services_bucket_access" {
name = "${var.env_name}-${var.db_suffix}-core-shared-services-bucket-access-policy"
path = "/"
policy = data.aws_iam_policy_document.core_shared_services_bucket_access.json
}

data "aws_iam_policy_document" "ec2_access_for_ansible" {
statement {
effect = "Allow"
Expand All @@ -100,46 +80,6 @@ data "aws_iam_policy_document" "allow_access_to_ssm_parameter_store" {
}
}

resource "aws_iam_policy" "allow_access_to_ssm_parameter_store" {
name = "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-ssm-parameter-store-access"
path = "/"
policy = data.aws_iam_policy_document.allow_access_to_ssm_parameter_store.json
}
#
#resource "aws_iam_role_policy_attachment" "allow_access_to_ssm_parameter_store" {
# role = aws_iam_role.db_ec2_instance_iam_role.name
# policy_arn = aws_iam_policy.allow_access_to_ssm_parameter_store.arn
#}

resource "aws_iam_policy" "ec2_access_for_ansible" {
name = "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-ansible-ec2-access"
path = "/"
policy = data.aws_iam_policy_document.ec2_access_for_ansible.json
}

#resource "aws_iam_role_policy" "business_unit_kms_key_access" {
# name = "business_unit_kms_key_access"
# role = aws_iam_role.db_ec2_instance_iam_role.name
# policy = data.aws_iam_policy_document.business_unit_kms_key_access.json
#}
#
#resource "aws_iam_role_policy" "core_shared_services_bucket_access" {
# name = "core_shared_services_bucket_access"
# role = aws_iam_role.db_ec2_instance_iam_role.name
# policy = data.aws_iam_policy_document.core_shared_services_bucket_access.json
#}
#
#resource "aws_iam_role_policy" "ec2_access" {
# name = "ec2_access"
# role = aws_iam_role.db_ec2_instance_iam_role.name
# policy = data.aws_iam_policy_document.ec2_access_for_ansible.json
#}

#resource "aws_iam_role_policy_attachment" "db_ec2_instance_amazonssmmanagedinstancecore" {
# role = aws_iam_role.db_ec2_instance_iam_role.name
# policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
#}

# Policy document for both Oracle database DBA and application secrets

data "aws_iam_policy_document" "db_access_to_secrets_manager" {
Expand All @@ -161,13 +101,6 @@ data "aws_iam_policy_document" "db_access_to_secrets_manager" {
}
}

# Policy to allow access to both Oracle database DBA and application secrets

resource "aws_iam_policy" "db_access_to_secrets_manager" {
name = "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-secrets-manager-access"
policy = data.aws_iam_policy_document.db_access_to_secrets_manager.json
}

data "aws_iam_policy_document" "instance_ssm" {
#checkov:skip=CKV_AWS_108 "ignore"
#checkov:skip=CKV_AWS_111 "ignore"
Expand Down Expand Up @@ -223,62 +156,20 @@ data "aws_iam_policy_document" "instance_ssm" {
}
}

resource "aws_iam_policy" "instance_ssm" {
name = "${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-ssm-access"
policy = data.aws_iam_policy_document.instance_ssm.json
data "aws_iam_policy_document" "combined_instance_policy" {
source_policy_documents = [
data.aws_iam_policy_document.core_shared_services_bucket_access.json,
data.aws_iam_policy_document.allow_access_to_ssm_parameter_store.json,
data.aws_iam_policy_document.ec2_access_for_ansible.json,
data.aws_iam_policy_document.db_access_to_secrets_manager.json,
data.aws_iam_policy_document.oracledb_backup_bucket_access.json,
data.aws_iam_policy_document.db_ssh_keys_s3_policy_document.json,
data.aws_iam_policy_document.instance_ssm.json,
data.aws_iam_policy_document.oracle_ec2_snapshot_backup_role_policy_document.json
]
}

# new IAM role OEM setup to allow ec2s to access secrets manager and kms keys
# resource "aws_iam_role" "EC2OracleEnterpriseManagementSecretsRole" {
# name = "EC2OracleEnterpriseManagementSecretsRole-${var.env_name}-${var.db_suffix}"

# assume_role_policy = <<EOF
# {
# "Version": "2012-10-17",
# "Statement": [
# {
# "Effect": "Allow",
# "Principal": {
# "AWS": "*"
# },
# "Action": "sts:AssumeRole",
# "Condition": {
# "ForAnyValue:ArnLike": {
# "aws:PrincipalArn": "arn:aws:iam::${var.account_info.id}:role/instance-role-${var.account_info.application_name}-${var.env_name}-${var.db_suffix}-*"
# }
# }
# }
# ]
# }
# EOF
# }

# resource "aws_iam_role_policy_attachment" "allow_kms_keys_access" {
# role = aws_iam_role.EC2OracleEnterpriseManagementSecretsRole.name
# policy_arn = aws_iam_policy.business_unit_kms_key_access.arn
# }

# data "aws_iam_policy_document" "OracleEnterpriseManagementSecretsPolicyDocument" {
# statement {
# sid = "OracleEnterpriseManagementSecretsPolicyDocument"
# effect = "Allow"
# actions = [
# "secretsmanager:GetSecretValue"
# ]
# resources = [
# "arn:aws:secretsmanager:*:*:secret:/oracle/database/EMREP/shared-*",
# "arn:aws:secretsmanager:*:*:secret:/oracle/database/*RCVCAT/shared-*",
# "arn:aws:secretsmanager:*:*:secret:/oracle/oem/shared-*"
# ]
# }
# }

# resource "aws_iam_policy" "OracleEnterpriseManagementSecretsPolicy" {
# name = "OracleEnterpriseManagementSecretsPolicy-${var.env_name}-${var.db_suffix}"
# policy = data.aws_iam_policy_document.OracleEnterpriseManagementSecretsPolicyDocument.json
# }

# resource "aws_iam_role_policy_attachment" "OracleEnterpriseManagementSecretsPolicy" {
# role = aws_iam_role.EC2OracleEnterpriseManagementSecretsRole.name
# policy_arn = aws_iam_policy.OracleEnterpriseManagementSecretsPolicy.arn
# }
resource "aws_iam_policy" "combined_instance_policy" {
name = "${var.account_info.application_name}-${var.env_name}-oracle-${var.db_suffix}-combined-instance-policy"
policy = data.aws_iam_policy_document.combined_instance_policy.json
}
1 change: 1 addition & 0 deletions terraform/environments/delius-core/modules/components/oracle_db_shared/locals.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,4 +63,5 @@ locals {

db_port = 1521
db_tcps_port = 1522

}
8 changes: 1 addition & 7 deletions terraform/environments/delius-core/modules/components/oracle_db_shared/outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,13 +16,7 @@ output "ssh_keys_bucket_name" {

output "instance_policies" {
value = {
"core_shared_services_bucket_access" = aws_iam_policy.core_shared_services_bucket_access
"allow_access_to_ssm_parameter_store" = aws_iam_policy.allow_access_to_ssm_parameter_store
"ec2_access_for_ansible" = aws_iam_policy.ec2_access_for_ansible
"db_access_to_secrets_manager" = aws_iam_policy.db_access_to_secrets_manager
"oracledb_backup_bucket_access" = aws_iam_policy.oracledb_backup_bucket_access
"db_ssh_keys_s3" = aws_iam_policy.db_ssh_keys_s3
"instance_ssm" = aws_iam_policy.instance_ssm
"combined_instance_policy" = aws_iam_policy.combined_instance_policy
}
}

Expand Down
5 changes: 0 additions & 5 deletions terraform/environments/delius-core/modules/components/oracle_db_shared/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,8 +49,3 @@ variable "db_suffix" {
type = string
default = "db"
}

variable "instance_roles" {
description = "AMI roles associated with the database EC2 hosts"
type = list(string)
}
1 change: 0 additions & 1 deletion terraform/environments/delius-core/modules/delius_environment/database.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,6 @@ module "oracle_db_shared" {
env_name = var.env_name
tags = local.tags
public_keys = local.db_public_key_data.keys[var.env_name]
instance_roles = [for i in range(1, try(var.db_config.primary_instance_count, 1) + try(var.db_config.standby_count, 0) + 1) : "instance-role-delius-core-${var.env_name}-db-${i}"]

bastion_sg_id = module.bastion_linux.bastion_security_group

Expand Down
5 changes: 0 additions & 5 deletions terraform/environments/delius-mis/modules/mis_environment/databases.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,11 +20,6 @@ module "oracle_db_shared" {
env_name = var.env_name
tags = local.tags
public_keys = local.db_public_key_data.keys[var.account_info.mp_environment]
instance_roles = concat(
each.key == "mis-db" ? [for i in range(1, try(var.mis_db_config.instance_count, 1) + 1) : "arn:aws:iam::${var.account_info.id}:role/instance-role-delius-mis-${var.env_name}-mis-db-${i}"] : [],
each.key == "boe-db" ? [for i in range(1, try(var.boe_db_config.instance_count, 1) + 1) : "arn:aws:iam::${var.account_info.id}:role/instance-role-delius-mis-${var.env_name}-boe-db-${i}"] : [],
each.key == "dsd-db" ? [for i in range(1, try(var.dsd_db_config.instance_count, 1) + 1) : "arn:aws:iam::${var.account_info.id}:role/instance-role-delius-mis-${var.env_name}-mis-db-${i}"] : []
)

db_suffix = each.key

Expand Down
Loading