🛂 Add MWAA User access for Data Platform Apps and Tools

[jacobwoffenden]

Resolves ministryofjustice/analytical-platform#791

Enables access to modernisation-platform-mwaa-user

[github-actions]

TFSEC Scan Success

Show Output

*****************************

TFSEC will check the following folders:

Checkov Scan Success

Show Output

*****************************

Checkov will check the following folders:

CTFLint Scan Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:

[github-actions]

TFSEC Scan Success

Show Output

*****************************

TFSEC will check the following folders:

Checkov Scan Success

Show Output

*****************************

Checkov will check the following folders:

CTFLint Scan Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing `terraform` plugin...
Installed `terraform` (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.2.1)
tflint will check the following folders:

[davidkelliott]

So normally we would have the policy created in the Modernisation Platform repo, I’ve just had a look at the policy in the root account -

data "aws_iam_policy_document" "modernisation_platform_data_mwaa_user" {
  statement {
    actions = [
      "airflow:CreateWebLoginToken"
    ]
    resources = ["arn:aws:airflow:*:*:role/*/User"]
  }
}

This is just one statement + read only is attached, can this not be added to one of the existing data engineering roles? It doesn’t feel like we need a new access level just for this.

[davidkelliott]

Approved following a discussion with data platform team https://mojdt.slack.com/archives/C01A7QK5VM1/p1697620199412489

Airflow is that it's made available to analysts who require it for their work, but is not a system everyone will (or should) be interacting with. Given it drives a large amount of ETL in the org we want to minimise the risk of users who shouldn't really be using it being able to make changes that would affect our ETL pipelines that Airflow will need to drive.

If in future we find they need to add a lot more roles we should re-evaluate how platforms on MP access is given.