intercode/terraform/modules/intercode_aws_resources/iam.tf at 988fb9cff453d19056303f5cafcfc24b0ee41e46 · neinteractiveliterature/intercode · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
locals {
  region     = data.aws_region.current.region
  account_id = data.aws_caller_identity.current.account_id
}

resource "aws_iam_group" "this" {
  name = var.name
}

resource "aws_iam_group_policy" "this" {
  name  = var.name
  group = aws_iam_group.this.name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "S3ObjectAccess"
        Effect = "Allow"
        Action = [
          "s3:GetObjectVersion",
          "s3:DeleteObjectVersion",
          "s3:DeleteObject",
          "s3:GetObject",
          "s3:GetObjectAcl",
          "s3:PutObject",
          "s3:PutObjectAcl",
          "s3:RestoreObject",
        ]
        Resource = "${aws_s3_bucket.uploads.arn}/*"
      },
      {
        Sid      = "S3BucketAccess"
        Effect   = "Allow"
        Action   = ["s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:ListBucket"]
        Resource = "arn:aws:s3:::*"
      },
      {
        Sid    = "SqsAccess"
        Effect = "Allow"
        Action = [
          "sqs:ChangeMessageVisibility",
          "sqs:ChangeMessageVisibilityBatch",
          "sqs:DeleteMessage",
          "sqs:DeleteMessageBatch",
          "sqs:GetQueueAttributes",
          "sqs:GetQueueUrl",
          "sqs:ReceiveMessage",
          "sqs:SendMessage",
          "sqs:SendMessageBatch",
          "sqs:ListQueues",
        ]
        Resource = "arn:aws:sqs:${local.region}:${local.account_id}:${var.name}_*"
      },
      {
        Sid      = "SesAccess"
        Effect   = "Allow"
        Action   = ["ses:SendRawEmail", "ses:SendBounce"]
        Resource = "*"
      },
      {
        Sid    = "CloudwatchSchedulerProvisioning"
        Effect = "Allow"
        Action = [
          "sqs:CreateQueue",
          "sqs:GetQueueAttributes",
          "sqs:SetQueueAttributes",
        ]
        Resource = [
          "arn:aws:sqs:${local.region}:${local.account_id}:${var.name}_cloudwatch_scheduler",
          "arn:aws:sqs:${local.region}:${local.account_id}:${var.name}_cloudwatch_scheduler-failures",
        ]
      },
      {
        Sid      = "CloudwatchSchedulerAccess"
        Effect   = "Allow"
        Action   = ["events:PutRule", "events:PutTargets"]
        Resource = "*"
      },
      {
        Sid    = "SsmParameterAccess"
        Effect = "Allow"
        Action = [
          "ssm:GetParametersByPath",
          "ssm:GetParameter",
          "ssm:GetParameters",
        ]
        Resource = "arn:aws:ssm:${local.region}:${local.account_id}:parameter/${var.name}/*"
      },
    ]
  })
}

resource "aws_iam_user" "this" {
  name = var.name
}

resource "aws_iam_user_group_membership" "this" {
  user   = aws_iam_user.this.name
  groups = [aws_iam_group.this.name]
}

resource "aws_iam_access_key" "this" {
  user = aws_iam_user.this.name
}