feat(sc-db-user) add policy for sc-db-user

.tflint.hcl

@@ -1,15 +1,15 @@
 config {
-  module = true
-  force = false
+  module              = true
+  force               = false
   disabled_by_default = false
 
-#  ignore_module = {
-#    "terraform-aws-modules/vpc/aws"            = true
-#    "terraform-aws-modules/security-group/aws" = true
-#  }
+  #  ignore_module = {
+  #    "terraform-aws-modules/vpc/aws"            = true
+  #    "terraform-aws-modules/security-group/aws" = true
+  #  }
 
-#  varfile = ["example1.tfvars", "example2.tfvars"]
-#  variables = ["foo=bar", "bar=[\"baz\"]"]
+  #  varfile = ["example1.tfvars", "example2.tfvars"]
+  #  variables = ["foo=bar", "bar=[\"baz\"]"]
 }
 
 rule "aws_instance_invalid_type" {

CHANGELOG.md

@@ -76,3 +76,7 @@
 * 1.5.0 -- 2026-02-12
   - created policies
     - policies/sc-developer
+
+* 1.5.1 -- 2026-03-10
+  - created policies
+    - policies/sc-db-user

policies/sc-db-user/README.md

@@ -0,0 +1,44 @@
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.12 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.0 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.0 |
+
+## Modules
+
+No modules.
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source |
+| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
+| [aws_iam_policy_document.inline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_account_alias"></a> [account\_alias](#input\_account\_alias) | AWS Account Alias | `string` | `""` | no |
+| <a name="input_account_id"></a> [account\_id](#input\_account\_id) | AWS Account ID (default will pull from current user) | `string` | `""` | no |
+| <a name="input_override_prefixes"></a> [override\_prefixes](#input\_override\_prefixes) | Override built-in prefixes by component. This should be used primarily for common infrastructure things | `map(string)` | `{}` | no |
+| <a name="input_tags"></a> [tags](#input\_tags) | AWS Tags to apply to appropriate resources | `map(string)` | `{}` | no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_customer_managed_policy_names"></a> [customer\_managed\_policy\_names](#output\_customer\_managed\_policy\_names) | Map of policy name to permission boundary of Customer Managed Policy to attach to the permissionset |
+| <a name="output_inline_policy"></a> [inline\_policy](#output\_inline\_policy) | AWS Policy document for the single allowed inline policy (use .json to get policy) |
+| <a name="output_managed_policy_names"></a> [managed\_policy\_names](#output\_managed\_policy\_names) | Names of AWS Managed Policy to attach to the permissionset |
+| <a name="output_name"></a> [name](#output\_name) | Permission Set Name for which all settings apply |
+| <a name="output_relay_state"></a> [relay\_state](#output\_relay\_state) | Relay State to pass along to permissionset |

policies/sc-db-user/base_arn.tf

@@ -0,0 +1,3 @@
+locals {
+  all_account_arn_iam = format("arn:%v:%v::%v:%%v", data.aws_arn.current.partition, "iam", "*")
+}

policies/sc-db-user/data.tf

@@ -0,0 +1 @@
+../../common/data.tf

policies/sc-db-user/defaults.tf

@@ -0,0 +1 @@
+../../common/defaults.tf

policies/sc-db-user/locals.tf

@@ -0,0 +1,12 @@
+locals {
+  account_id          = var.account_id != "" ? var.account_id : data.aws_caller_identity.current.account_id
+  account_environment = data.aws_arn.current.partition == "aws-us-gov" ? "gov" : "ew"
+  region              = data.aws_region.current.region
+  region_short        = join("", [for c in split("-", local.region) : substr(c, 0, 1)])
+
+  base_tags = {
+    "boc:tf_module_version" = local._module_version
+    "boc:tf_module_name"    = local._module_name
+    "boc:created_by"        = "terraform"
+  }
+}

policies/sc-db-user/main.tf

@@ -0,0 +1,2 @@
+/*
+*/

policies/sc-db-user/module_name.tf

@@ -0,0 +1,3 @@
+locals {
+  _module_name = "aws-sso/policies/sc-db-user"
+}

policies/sc-db-user/outputs.tf

@@ -0,0 +1,24 @@
+output "name" {
+  description = "Permission Set Name for which all settings apply"
+  value       = local.name
+}
+
+output "managed_policy_names" {
+  description = "Names of AWS Managed Policy to attach to the permissionset"
+  value       = local.managed_policy_names
+}
+
+output "customer_managed_policy_names" {
+  description = "Map of policy name to permission boundary of Customer Managed Policy to attach to the permissionset"
+  value       = local.customer_managed_policy_names
+}
+
+output "inline_policy" {
+  description = "AWS Policy document for the single allowed inline policy (use .json to get policy)"
+  value       = local.inline_policy
+}
+
+output "relay_state" {
+  description = "Relay State to pass along to permissionset"
+  value       = local.relay_state
+}

policies/sc-db-user/policy.tf

@@ -0,0 +1,112 @@
+data "aws_iam_policy_document" "inline" {
+  statement {
+    sid       = "AllowEC2Read"
+    effect    = "Allow"
+    resources = ["*"]
+    actions = [
+      "ec2:Describe*",
+      "ec2:Get*",
+      "ec2:List*",
+    ]
+  }
+  statement {
+    sid       = "AllowKMSList"
+    effect    = "Allow"
+    resources = ["*"]
+    actions = [
+      "kms:Describe*",
+      "kms:List*",
+    ]
+  }
+  statement {
+    sid       = "RDSKMSDefaultKeyAccess"
+    effect    = "Allow"
+    resources = ["*"]
+    actions = [
+      "kms:Decrypt",
+      "kms:EnableK*",
+      "kms:Encrypt",
+      "kms:GenerateDataKey*",
+      "kms:ReEncrypt*",
+    ]
+    condition {
+      test     = "StringEquals"
+      variable = "kms:ResourceAliases"
+      values = [
+        "alias/aws/rds",
+        "alias/aws/secretsmanager"
+      ]
+    }
+  }
+  statement {
+    sid       = "RestrictInfKMS"
+    effect    = "Deny"
+    resources = ["*"]
+    actions   = ["kms:*"]
+    condition {
+      test     = "StringLike"
+      variable = "kms:RequestAlias"
+      values = [
+        "alias/k-kms-inf*"
+      ]
+    }
+  }
+  statement {
+    sid       = "AllowRDSDB"
+    effect    = "Allow"
+    resources = ["*"]
+    actions = [
+      "rds-db:connect",
+      "rds:DescribeDBInstances",
+      "rds:DescribeDBClusters",
+      "rds:DescribeDBInstancesPerformance",
+      "rds:DescribeDBClustersPerformance",
+      "pi:DescribeDimensionKeys",
+      "pi:GetResourceMetrics",
+      "pi:ListAvailableResourceDimensions",
+      "pi:ListAvailableResourceMetrics"
+    ]
+  }
+  statement {
+    sid       = "AllowSecretsManagerList"
+    effect    = "Allow"
+    resources = ["*"]
+    actions = [
+      "secretsmanager:List*",
+    ]
+  }
+  statement {
+    sid       = "AllowSecretsManagerReadByJBID"
+    effect    = "Allow"
+    resources = ["*"]
+    actions = [
+      "secretsmanager:BatchGetSecretValue",
+      "secretsmanager:DescribeSecret",
+      "secretsmanager:GetSecretValue",
+    ]
+    # Enforce expected principal attribute shape: 8-character JBID.
+    condition {
+      test     = "StringLike"
+      variable = "aws:PrincipalTag/jbid"
+      values = [
+        "????????"
+      ]
+    }
+    # Secret must be tagged to the same JBID as the caller.
+    condition {
+      test     = "StringEquals"
+      variable = "secretsmanager:ResourceTag/jbid"
+      values = [
+        "&{aws:PrincipalTag/jbid}"
+      ]
+    }
+    # Name tag pattern includes the caller identifier.
+    condition {
+      test     = "StringLike"
+      variable = "secretsmanager:ResourceTag/Name"
+      values = [
+        "*&{aws:PrincipalTag/jbid}*"
+      ]
+    }
+  }
+}

policies/sc-db-user/prefixes.tf

@@ -0,0 +1 @@
+../../common/prefixes.tf

policies/sc-db-user/settings.tf

@@ -0,0 +1,12 @@
+locals {
+  name        = "sc-db-user"
+  description = "System Common DB User"
+  managed_policy_names = [
+    "ReadOnlyAccess",
+  ]
+  customer_managed_policy_names = {
+    "p-inf-tfstate-write" = null
+  }
+  relay_state   = null
+  inline_policy = data.aws_iam_policy_document.inline
+}

policies/sc-db-user/variables.common.tf

@@ -0,0 +1 @@
+../../common/variables.common.tf

policies/sc-db-user/variables.tf.unused

@@ -0,0 +1,29 @@
+variable "name" {
+  description = "Permission Set Name for which all settings apply"
+  type        = string
+  default     = null
+}
+
+variable "managed_policy_names" {
+  description = "Names of AWS Managed Policy to attach to the permissionset"
+  type        = list(string)
+  default     = []
+}
+
+variable "customer_managed_policy_names" {
+  description = "Map of policy name to permission boundary of Customer Managed Policy to attach to the permissionset"
+  type        = map(string)
+  default     = {}
+}
+
+# variable "inline_policy" {
+#   description = "AWS Policy document for the single allowed inline policy"
+#   type        = string
+#   default     = null
+# }
+
+variable "relay_state" {
+  description = "Relay State to pass along to permissionset"
+  type        = string
+  default     = null
+}

policies/sc-db-user/version.tf

@@ -0,0 +1 @@
+../../common/version.tf

policies/sc-db-user/versions.tf

@@ -0,0 +1 @@
+../../common/versions.tf