Skip to content

Commit 15d209d

Browse files
dmitrykiselev27dmitrykiselev27
committed
replace JSON policies with terraform resources
1 parent 41a658e commit 15d209d

8 files changed

Lines changed: 262 additions & 366 deletions

File tree

‎modules/runners/job-retry/main.tf‎

Lines changed: 40 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -61,18 +61,49 @@ resource "aws_lambda_permission" "job_retry" {
6161
}
6262

6363
resource "aws_iam_role_policy" "job_retry" {
64-
name = "job_retry-policy"
65-
role = module.job_retry.lambda.role.name
66-
policy = templatefile("${path.module}/policies/lambda.json", {
67-
kms_key_arn = var.config.kms_key_arn != null ? var.config.kms_key_arn : ""
68-
sqs_build_queue_arn = var.config.sqs_build_queue.arn
69-
sqs_job_retry_queue_arn = aws_sqs_queue.job_retry_check_queue.arn
70-
ssm_parameter_arns = compact([
64+
name = "job_retry-policy"
65+
role = module.job_retry.lambda.role.name
66+
policy = data.aws_iam_policy_document.job_retry.json
67+
}
68+
69+
data "aws_iam_policy_document" "job_retry" {
70+
dynamic "statement" {
71+
for_each = length(compact([
7172
var.config.github_app_parameters.id.arn,
7273
var.config.github_app_parameters.key_base64.arn,
7374
try(var.config.enterprise_pat_parameter.arn, ""),
74-
])
75-
})
75+
])) > 0 ? [1] : []
76+
content {
77+
effect = "Allow"
78+
actions = ["ssm:GetParameter", "ssm:GetParameters"]
79+
resources = compact([
80+
var.config.github_app_parameters.id.arn,
81+
var.config.github_app_parameters.key_base64.arn,
82+
try(var.config.enterprise_pat_parameter.arn, ""),
83+
])
84+
}
85+
}
86+
87+
statement {
88+
effect = "Allow"
89+
actions = ["sqs:ReceiveMessage", "sqs:GetQueueAttributes", "sqs:DeleteMessage"]
90+
resources = [aws_sqs_queue.job_retry_check_queue.arn]
91+
}
92+
93+
statement {
94+
effect = "Allow"
95+
actions = ["sqs:SendMessage", "sqs:GetQueueAttributes"]
96+
resources = [var.config.sqs_build_queue.arn]
97+
}
98+
99+
dynamic "statement" {
100+
for_each = var.config.kms_key_arn != null && var.config.kms_key_arn != "" ? [var.config.kms_key_arn] : []
101+
content {
102+
effect = "Allow"
103+
actions = ["kms:Encrypt", "kms:Decrypt", "kms:GenerateDataKey"]
104+
resources = [statement.value]
105+
}
106+
}
76107
}
77108

78109
data "aws_iam_policy_document" "deny_insecure_transport" {

‎modules/runners/job-retry/policies/lambda.json‎

Lines changed: 0 additions & 43 deletions
This file was deleted.

‎modules/runners/policies/lambda-scale-down.json‎

Lines changed: 0 additions & 75 deletions
This file was deleted.

‎modules/runners/policies/lambda-scale-up.json‎

Lines changed: 0 additions & 101 deletions
This file was deleted.

‎modules/runners/pool/main.tf‎

Lines changed: 84 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -88,18 +88,90 @@ resource "aws_iam_role" "pool" {
8888
}
8989

9090
resource "aws_iam_role_policy" "pool" {
91-
name = "pool-policy"
92-
role = aws_iam_role.pool.name
93-
policy = templatefile("${path.module}/policies/lambda-pool.json", {
94-
arn_ssm_parameters_path_config = var.config.arn_ssm_parameters_path_config
95-
arn_runner_instance_role = var.config.runner.role.arn
96-
github_app_id_arn = nonsensitive(var.config.github_app_parameters.id.arn)
97-
github_app_key_base64_arn = nonsensitive(var.config.github_app_parameters.key_base64.arn)
98-
kms_key_arn = var.config.kms_key_arn
99-
ami_kms_key_arn = var.config.ami_kms_key_arn
100-
ssm_ami_id_parameter_arn = var.config.ami_id_ssm_parameter_arn
101-
enterprise_pat_arn = nonsensitive(try(var.config.enterprise_pat_parameter.arn, ""))
102-
})
91+
name = "pool-policy"
92+
role = aws_iam_role.pool.name
93+
policy = data.aws_iam_policy_document.pool.json
94+
}
95+
96+
data "aws_iam_policy_document" "pool" {
97+
statement {
98+
effect = "Allow"
99+
actions = [
100+
"ec2:DescribeInstances",
101+
"ec2:DescribeTags",
102+
"ec2:RunInstances",
103+
"ec2:CreateFleet",
104+
"ec2:CreateTags",
105+
]
106+
resources = ["*"]
107+
}
108+
109+
statement {
110+
effect = "Allow"
111+
actions = ["iam:PassRole"]
112+
resources = [var.config.runner.role.arn]
113+
}
114+
115+
statement {
116+
effect = "Allow"
117+
actions = ["ssm:AddTagsToResource", "ssm:PutParameter"]
118+
resources = ["*"]
119+
}
120+
121+
statement {
122+
effect = "Allow"
123+
actions = ["ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath"]
124+
resources = [var.config.arn_ssm_parameters_path_config, "${var.config.arn_ssm_parameters_path_config}/*"]
125+
}
126+
127+
statement {
128+
effect = "Allow"
129+
actions = ["ssm:GetParameters"]
130+
resources = [var.config.ami_id_ssm_parameter_arn]
131+
}
132+
133+
statement {
134+
effect = "Allow"
135+
actions = ["ssm:GetParameter", "ssm:GetParameters"]
136+
resources = compact([
137+
"${var.config.arn_ssm_parameters_path_config}/*",
138+
var.config.github_app_parameters.key_base64.arn,
139+
var.config.github_app_parameters.id.arn,
140+
try(var.config.enterprise_pat_parameter.arn, ""),
141+
])
142+
}
143+
144+
dynamic "statement" {
145+
for_each = var.config.kms_key_arn != "" ? [var.config.kms_key_arn] : []
146+
content {
147+
effect = "Allow"
148+
actions = ["kms:Decrypt"]
149+
resources = [statement.value]
150+
}
151+
}
152+
153+
dynamic "statement" {
154+
for_each = var.config.ami_kms_key_arn != "" ? [var.config.ami_kms_key_arn] : []
155+
content {
156+
effect = "Allow"
157+
actions = ["kms:DescribeKey", "kms:ReEncrypt*", "kms:Decrypt"]
158+
resources = [statement.value]
159+
}
160+
}
161+
162+
dynamic "statement" {
163+
for_each = var.config.ami_kms_key_arn != "" ? [var.config.ami_kms_key_arn] : []
164+
content {
165+
effect = "Allow"
166+
actions = ["kms:CreateGrant"]
167+
resources = [statement.value]
168+
condition {
169+
test = "Bool"
170+
variable = "aws:ViaAWSService"
171+
values = ["true"]
172+
}
173+
}
174+
}
103175
}
104176

105177
resource "aws_iam_role_policy" "pool_logging" {

0 commit comments

Comments
 (0)