From dbfe1d076e50260b27970fe3e208d37545f27722 Mon Sep 17 00:00:00 2001 From: Dave Arnold Date: Tue, 16 Jun 2026 14:08:02 -0400 Subject: [PATCH] fix: terraform-csvd-patch4 cleanup batch (CSVDIES-10106/10107/10109/10110/10111) CSVDIES-10106: convert module sources from SSH to HTTPS (roles.tf) CSVDIES-10107: add sts:AssumeRole on patch_execution_role to patch_execproxy_role policy CSVDIES-10109: remove dead TARGET_SQS_QUEUE_AUTOMATIONDOC_URL env var from dispatcher Lambda and Python source CSVDIES-10110: remove direct lambda.amazonaws.com principal from patch_role assume policy CSVDIES-10111: remove unused null provider from versions.tf CSVDIES-10108: dispatcher does not need the shared Lambda layer (no psycopg dependency) --- lambda-dispatcher/src/lambda_function.py | 3 +-- lambda.tf | 1 - policies.tf | 14 ++++++-------- roles.tf | 6 +++--- versions.tf | 4 ---- 5 files changed, 10 insertions(+), 18 deletions(-) diff --git a/lambda-dispatcher/src/lambda_function.py b/lambda-dispatcher/src/lambda_function.py index fc1ddc4..0692d8d 100644 --- a/lambda-dispatcher/src/lambda_function.py +++ b/lambda-dispatcher/src/lambda_function.py @@ -7,11 +7,10 @@ logger = logging.getLogger() logger.setLevel(logging.INFO) -# Load the three queue URLs into a hash (dictionary) +# Load the two queue URLs into a hash (dictionary) QUEUE_MAP = { 1: os.environ.get('TARGET_SQS_QUEUE_LAMBDA_URL'), # Lambda Workers 2: os.environ.get('TARGET_SQS_QUEUE_REMOTEEXECUTION_URL'), # Remote Execution - 3: os.environ.get('TARGET_SQS_QUEUE_AUTOMATIONDOC_URL') # Automation Documents } # Validate that all queues are configured diff --git a/lambda.tf b/lambda.tf index 0b252c1..8438faa 100644 --- a/lambda.tf +++ b/lambda.tf @@ -59,7 +59,6 @@ resource "aws_lambda_function" "dispatcher" { environment { variables = { - TARGET_SQS_QUEUE_AUTOMATIONDOC_URL = "unused" TARGET_SQS_QUEUE_LAMBDA_URL = aws_sqs_queue.dispatch_lambda.url TARGET_SQS_QUEUE_REMOTEEXECUTION_URL = aws_sqs_queue.dispatch_remote_execution.url } diff --git a/policies.tf b/policies.tf index 902111a..4c317f8 100644 --- a/policies.tf +++ b/policies.tf @@ -20,14 +20,6 @@ data "aws_iam_policy_document" "patch_role_assume" { values = ["${data.aws_organizations_organization.org.id}/*"] } } - statement { - effect = "Allow" - actions = ["sts:AssumeRole"] - principals { - type = "Service" - identifiers = ["lambda.amazonaws.com"] - } - } } data "aws_iam_policy_document" "patch_execution_role_assume" { @@ -171,6 +163,12 @@ data "aws_iam_policy_document" "patch_execproxy_role" { "arn:${local.partition}:rds-db:${local.region}:${local.account_id}:dbuser:cluster-*/${local.db_user_name}", ] } + statement { + sid = "AssumePatchExecutionRole" + effect = "Allow" + actions = ["sts:AssumeRole"] + resources = [module.patch_execution_role.role_arn] + } } # ─── IAM Policies ──────────────────────────────────────────────────────────── diff --git a/roles.tf b/roles.tf index c944e42..53f17a5 100644 --- a/roles.tf +++ b/roles.tf @@ -1,6 +1,6 @@ # patch_role — assumed by patch_execution_role to perform EC2 operations in target accounts module "patch_role" { - source = "git@github.e.it.census.gov:terraform-modules/aws-iam-role.git?ref=tf-upgrade" + source = "git::https://github.e.it.census.gov/terraform-modules/aws-iam-role.git?ref=tf-upgrade" role_name = local.patch_role_name role_description = "Assumed by ${local.patch_execution_role_name} to execute patching operations on EC2 instances in target accounts" @@ -12,7 +12,7 @@ module "patch_role" { # patch_execution_role — assumed by Lambda functions to orchestrate patching module "patch_execution_role" { - source = "git@github.e.it.census.gov:terraform-modules/aws-iam-role.git?ref=tf-upgrade" + source = "git::https://github.e.it.census.gov/terraform-modules/aws-iam-role.git?ref=tf-upgrade" role_name = local.patch_execution_role_name role_description = "Assumed by Lambda functions to invoke patch operations, access SQS/RDS, and assume ${local.patch_role_name} in target accounts" @@ -26,7 +26,7 @@ module "patch_execution_role" { # This instance profile is used by the EC2 host running p4proxy to authenticate # to RDS via IAM and to assume patch_execution_role for orchestration tasks. module "patch_execproxy_role" { - source = "git@github.e.it.census.gov:terraform-modules/aws-iam-role.git?ref=tf-upgrade" + source = "git::https://github.e.it.census.gov/terraform-modules/aws-iam-role.git?ref=tf-upgrade" role_name = local.patch_execproxy_role_name role_description = "Applied to the EC2 host running p4proxy; allows RDS IAM auth and assumption of ${local.patch_execution_role_name}" diff --git a/versions.tf b/versions.tf index 4c3132e..86163ea 100644 --- a/versions.tf +++ b/versions.tf @@ -9,9 +9,5 @@ terraform { source = "hashicorp/archive" version = ">= 2.0" } - null = { - source = "hashicorp/null" - version = ">= 3.0" - } } }