From 8b4e78b781617f68554efebcda75d982a382f650 Mon Sep 17 00:00:00 2001
From: Alex Schofield <git@ajschof.me>
Date: Mon, 19 Aug 2024 16:31:50 +0100
Subject: fix(tf): fix permissions for bucket/object access

---
 terraform/iam.tf | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

(limited to 'terraform/iam.tf')

diff --git a/terraform/iam.tf b/terraform/iam.tf
index 0e5fa6d..7585ff8 100644
--- a/terraform/iam.tf
+++ b/terraform/iam.tf
@@ -28,17 +28,19 @@ resource "aws_iam_role" "multi_service_role" {
 ########################################################################
 # S3 SETUP                                                        
 # Description: allows allows retention/tagging/access control settings
-# Lambda IAM Policy for S3 Write
+# Lambda IAM Policy for S3
 ########################################################################
 
 # S3 DEFINE POLICY
 data "aws_iam_policy_document" "s3_data_policy_doc" {
   statement {
+    effect = "Allow"
     actions = [
       "s3:PutObject",
       "s3:PutObjectRetention",
       "s3:PutObjectTagging",
-      "s3:PutObjectAcl"
+      "s3:PutObjectAcl",
+      "s3:ListObjects"
     ]
     resources = [
       "${aws_s3_bucket.extract_bucket.arn}/*",
@@ -46,6 +48,17 @@ data "aws_iam_policy_document" "s3_data_policy_doc" {
       "${aws_s3_bucket.lambda_code_bucket.arn}/*",
     ]
   }
+
+  statement {
+    effect = "Allow"
+    actions = [
+      "s3:ListBuckets",
+      "s3:ListAllMyBuckets"
+    ]
+    resources = [
+      "arn:aws:s3:::*",
+    ]
+  }
 }
 
 
-- 
cgit v1.2.3


From 746f4206b2f30126c3c09ac11a2d49be3259fe6f Mon Sep 17 00:00:00 2001
From: Alex Schofield <git@ajschof.me>
Date: Tue, 20 Aug 2024 00:42:54 +0100
Subject: infra(tf): add secrets manager permissions

I feel like what I've done is bad but we'll find out soon.
---
 terraform/iam.tf | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

(limited to 'terraform/iam.tf')

diff --git a/terraform/iam.tf b/terraform/iam.tf
index 7585ff8..a36cfdf 100644
--- a/terraform/iam.tf
+++ b/terraform/iam.tf
@@ -169,3 +169,30 @@ resource "aws_iam_role_policy_attachment" "cloudwatch_events_attachment" {
   role       = aws_iam_role.multi_service_role.name
   policy_arn = aws_iam_policy.cloudwatch_events_policy.arn
 }
+
+#########################
+# SECRETS MANAGER SETUP #
+#########################
+
+# Policy Doc
+data "aws_iam_policy_document" "secrets_manager_policy_doc" {
+  statement {
+    effect = "Allow"
+    actions = [
+      "secretsmanager:GetSecretValue"
+    ]
+    resources = []
+  }
+}
+
+# SM Policy Resource
+resource "aws_iam_policy" "secrets_manager_policy" {
+  name   = "secrets_manager_policy"
+  policy = data.aws_iam_policy_document.secrets_manager_policy_doc.json
+}
+
+# Attach SM Policy to Role
+resource "aws_iam_role_policy_attachment" "secrets_manager_attachment" {
+  role       = aws_iam_role.multi_service_role.name
+  policy_arn = aws_iam_policy.secrets_manager_policy.arn
+}
-- 
cgit v1.2.3


From 2045888e1ae497444c58347096547f0475bba7a1 Mon Sep 17 00:00:00 2001
From: Alex Schofield <git@ajschof.me>
Date: Tue, 20 Aug 2024 00:51:11 +0100
Subject: infra(tf): add resource access for secrets-manager policy doc

---
 terraform/iam.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'terraform/iam.tf')

diff --git a/terraform/iam.tf b/terraform/iam.tf
index a36cfdf..a8054ca 100644
--- a/terraform/iam.tf
+++ b/terraform/iam.tf
@@ -181,7 +181,7 @@ data "aws_iam_policy_document" "secrets_manager_policy_doc" {
     actions = [
       "secretsmanager:GetSecretValue"
     ]
-    resources = []
+    resources = ["arn:aws:secretsmanager:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:secret:bentley-secrets-Na0yc8"]
   }
 }
 
-- 
cgit v1.2.3


From ae57535d9f201d6fd749d4286551884d3c86fd60 Mon Sep 17 00:00:00 2001
From: Alex Schofield <git@ajschof.me>
Date: Tue, 20 Aug 2024 10:26:48 +0100
Subject: infra(tf): add missing ListObjectsV2 permission

---
 terraform/iam.tf | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'terraform/iam.tf')

diff --git a/terraform/iam.tf b/terraform/iam.tf
index a8054ca..3ac8c45 100644
--- a/terraform/iam.tf
+++ b/terraform/iam.tf
@@ -40,7 +40,8 @@ data "aws_iam_policy_document" "s3_data_policy_doc" {
       "s3:PutObjectRetention",
       "s3:PutObjectTagging",
       "s3:PutObjectAcl",
-      "s3:ListObjects"
+      "s3:ListObjects",
+      "s3:ListObjectsV2"
     ]
     resources = [
       "${aws_s3_bucket.extract_bucket.arn}/*",
-- 
cgit v1.2.3


From 5493cdc71da4730c4e388d9718f278bc2f14badf Mon Sep 17 00:00:00 2001
From: Alex Schofield <git@ajschof.me>
Date: Tue, 20 Aug 2024 15:15:28 +0100
Subject: infra(tf): add ListBucket and GetObject permissions

---
 terraform/iam.tf | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

(limited to 'terraform/iam.tf')

diff --git a/terraform/iam.tf b/terraform/iam.tf
index 3ac8c45..3d62b69 100644
--- a/terraform/iam.tf
+++ b/terraform/iam.tf
@@ -41,7 +41,8 @@ data "aws_iam_policy_document" "s3_data_policy_doc" {
       "s3:PutObjectTagging",
       "s3:PutObjectAcl",
       "s3:ListObjects",
-      "s3:ListObjectsV2"
+      "s3:ListObjectsV2",
+      "s3:GetObject"
     ]
     resources = [
       "${aws_s3_bucket.extract_bucket.arn}/*",
@@ -53,8 +54,10 @@ data "aws_iam_policy_document" "s3_data_policy_doc" {
   statement {
     effect = "Allow"
     actions = [
-      "s3:ListBuckets",
-      "s3:ListAllMyBuckets"
+      "s3:ListBucket",
+      "s3:ListAllMyBuckets",
+      "s3:ListObjectsV2",
+      "s3:ListObjects"
     ]
     resources = [
       "arn:aws:s3:::*",
-- 
cgit v1.2.3