-
Notifications
You must be signed in to change notification settings - Fork 3
/
Copy pathiam.tf
165 lines (153 loc) · 5.29 KB
/
iam.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
resource "aws_iam_role" "int_tableau" {
name = "internal-tableau"
assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": [
"ec2.amazonaws.com",
"s3.amazonaws.com"
]
},
"Action": "sts:AssumeRole"
}
]
}
EOF
}
resource "aws_iam_policy" "int_tableau" {
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ssm:GetParameter"
],
"Resource": [
"arn:aws:ssm:eu-west-2:*:parameter/addomainjoin",
"arn:aws:ssm:eu-west-2:*:parameter/int_tableau_hostname",
"arn:aws:ssm:eu-west-2:*:parameter/tableau_server_username",
"arn:aws:ssm:eu-west-2:*:parameter/tableau_server_password",
"arn:aws:ssm:eu-west-2:*:parameter/tableau_int_s3_prefix",
"arn:aws:ssm:eu-west-2:*:parameter/tableau_linux_ssh_private_key",
"arn:aws:ssm:eu-west-2:*:parameter/tableau_linux_ssh_public_key",
"arn:aws:ssm:eu-west-2:*:parameter/data_archive_tab_int_backup_url",
"arn:aws:ssm:eu-west-2:*:parameter/data_archive_tab_int_backup_sub_directory",
"arn:aws:ssm:eu-west-2:*:parameter/tab_int_repo_protocol",
"arn:aws:ssm:eu-west-2:*:parameter/tab_int_repo_user",
"arn:aws:ssm:eu-west-2:*:parameter/tab_int_repo_host",
"arn:aws:ssm:eu-west-2:*:parameter/tab_int_repo_port",
"arn:aws:ssm:eu-west-2:*:parameter/tab_int_repo_org",
"arn:aws:ssm:eu-west-2:*:parameter/tab_int_repo_name",
"arn:aws:ssm:eu-west-2:*:parameter/tableau_admin_username",
"arn:aws:ssm:eu-west-2:*:parameter/tableau_admin_password",
"arn:aws:ssm:eu-west-2:*:parameter/gp_db_user_wsr",
"arn:aws:ssm:eu-west-2:*:parameter/tableau_server_repository_username",
"arn:aws:ssm:eu-west-2:*:parameter/tableau_server_repository_password",
"arn:aws:ssm:eu-west-2:*:parameter/tableau_int_openid_provider_client_id",
"arn:aws:ssm:eu-west-2:*:parameter/tableau_int_openid_client_secret",
"arn:aws:ssm:eu-west-2:*:parameter/tableau_int_openid_provider_config_url",
"arn:aws:ssm:eu-west-2:*:parameter/tableau_int_openid_tableau_server_external_url",
"arn:aws:ssm:eu-west-2:*:parameter/tableau_int_staging_openid_provider_client_id",
"arn:aws:ssm:eu-west-2:*:parameter/tableau_int_staging_openid_client_secret",
"arn:aws:ssm:eu-west-2:*:parameter/tableau_int_staging_openid_provider_config_url",
"arn:aws:ssm:eu-west-2:*:parameter/tableau_int_staging_openid_tableau_server_external_url",
"arn:aws:ssm:eu-west-2:*:parameter/tableau_int_product_key",
"arn:aws:ssm:eu-west-2:*:parameter/tableau_notprod_product_key",
"arn:aws:ssm:eu-west-2:*:parameter/tableau_int_publish_datasources",
"arn:aws:ssm:eu-west-2:*:parameter/tableau_int_publish_workbooks",
"arn:aws:ssm:eu-west-2:*:parameter/rds_internal_tableau_postgres_endpoint",
"arn:aws:ssm:eu-west-2:*:parameter/rds_internal_tableau_service_username",
"arn:aws:ssm:eu-west-2:*:parameter/rds_internal_tableau_service_password",
"arn:aws:ssm:eu-west-2:*:parameter/tableau_config_smtp_int"
]
},
{
"Effect": "Allow",
"Action": [
"ssm:PutParameter"
],
"Resource": "arn:aws:ssm:eu-west-2:*:parameter/data_archive_tab_int_backup_sub_directory"
},
{
"Effect": "Allow",
"Action": [
"ec2:ModifyInstanceMetadataOptions"
],
"Resource": "arn:aws:ec2:*:*:instance/*"
}
]
}
EOF
}
resource "aws_iam_role_policy_attachment" "int_tableau" {
role = aws_iam_role.int_tableau.id
policy_arn = aws_iam_policy.int_tableau.arn
}
resource "aws_iam_policy" "int_tableau_s3" {
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:ListBucket"],
"Resource": [
"${var.s3_archive_bucket}",
"arn:aws:s3:::${var.s3_httpd_config_bucket}"
]
},
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject"
],
"Resource": "${var.s3_archive_bucket}/*"
},
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject"
],
"Resource": "arn:aws:s3:::${var.s3_httpd_config_bucket}/*"
},
{
"Effect": "Allow",
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey"
],
"Resource": [
"${var.s3_archive_bucket_key}",
"${var.s3_httpd_config_bucket_key}"
]
}
]
}
EOF
}
resource "aws_iam_role_policy_attachment" "int_tableau_s3" {
role = aws_iam_role.int_tableau.id
policy_arn = aws_iam_policy.int_tableau_s3.arn
}
resource "aws_iam_instance_profile" "int_tableau" {
role = aws_iam_role.int_tableau.name
}
resource "aws_iam_role_policy_attachment" "cloud_watch_agent" {
role = aws_iam_role.int_tableau.name
policy_arn = "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy"
}
resource "aws_iam_role_policy_attachment" "dq_tf_infra_write_to_cw" {
role = aws_iam_role.int_tableau.id
policy_arn = "arn:aws:iam::${var.account_id[var.environment]}:policy/dq-tf-infra-write-to-cw"
}