KEH-2171: Assume Service Role via SSO

README.md

@@ -47,6 +47,18 @@ Install dev dependencies to run linting tools
 make install-dev
 ```
 
+Sign in with AWS SSO, and export the correct profile for this service:
+
+```bash
+aws sso login
+
+export AWS_PROFILE=keh-tech-audit-tool-api
+```
+
+This allows you to assume the AWS IAM role for the service, enabling the most secure development experience. This also means you will have limited permissions until you exit out of the profile.
+
+**Note:** See the Developer Onboarding Guide on the "Using AWS SSO for Local Development" page on Confluence to set up service profile selection on your local machine.
+
 Set environment variables:
 
 ```bash

terraform/lambda/main.tf

@@ -22,6 +22,20 @@ resource "aws_iam_role" "lambda_execution_role" {
         Principal = {
           Service = "lambda.amazonaws.com"
         }
+      },
+      {
+        Action = "sts:AssumeRole"
+        Effect = "Allow"
+        Principal = {
+          AWS = "arn:aws:iam::${var.aws_account_id}:root"
+        }
+        Condition = {
+          ArnLike = {
+            "aws:PrincipalArn" = [
+              "arn:aws:iam::${var.aws_account_id}:role/aws-reserved/sso.amazonaws.com/eu-west-2/AWSReservedSSO_Standard_Administrator_Access_*"
+            ]
+          }
+        }
       }
     ]
   })