From 1af6ad72c0bc9f7b8f15c246cbcfaa859605fabc Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 16 Mar 2026 16:56:19 -0400 Subject: [PATCH] feat(sc-db-user) add policy for sc-db-user --- .tflint.hcl | 16 ++-- CHANGELOG.md | 4 + policies/sc-db-user/README.md | 44 ++++++++++ policies/sc-db-user/base_arn.tf | 3 + policies/sc-db-user/data.tf | 1 + policies/sc-db-user/defaults.tf | 1 + policies/sc-db-user/locals.tf | 12 +++ policies/sc-db-user/main.tf | 2 + policies/sc-db-user/module_name.tf | 3 + policies/sc-db-user/outputs.tf | 24 +++++ policies/sc-db-user/policy.tf | 112 ++++++++++++++++++++++++ policies/sc-db-user/prefixes.tf | 1 + policies/sc-db-user/settings.tf | 12 +++ policies/sc-db-user/variables.common.tf | 1 + policies/sc-db-user/variables.tf.unused | 29 ++++++ policies/sc-db-user/version.tf | 1 + policies/sc-db-user/versions.tf | 1 + 17 files changed, 259 insertions(+), 8 deletions(-) create mode 100644 policies/sc-db-user/README.md create mode 100644 policies/sc-db-user/base_arn.tf create mode 120000 policies/sc-db-user/data.tf create mode 120000 policies/sc-db-user/defaults.tf create mode 100644 policies/sc-db-user/locals.tf create mode 100644 policies/sc-db-user/main.tf create mode 100644 policies/sc-db-user/module_name.tf create mode 100644 policies/sc-db-user/outputs.tf create mode 100644 policies/sc-db-user/policy.tf create mode 120000 policies/sc-db-user/prefixes.tf create mode 100644 policies/sc-db-user/settings.tf create mode 120000 policies/sc-db-user/variables.common.tf create mode 100644 policies/sc-db-user/variables.tf.unused create mode 120000 policies/sc-db-user/version.tf create mode 120000 policies/sc-db-user/versions.tf diff --git a/.tflint.hcl b/.tflint.hcl index fcc2fa8..a4029d7 100644 --- a/.tflint.hcl +++ b/.tflint.hcl @@ -1,15 +1,15 @@ config { - module = true - force = false + module = true + force = false disabled_by_default = false -# ignore_module = { -# "terraform-aws-modules/vpc/aws" = true -# "terraform-aws-modules/security-group/aws" = true -# } + # ignore_module = { + # "terraform-aws-modules/vpc/aws" = true + # "terraform-aws-modules/security-group/aws" = true + # } -# varfile = ["example1.tfvars", "example2.tfvars"] -# variables = ["foo=bar", "bar=[\"baz\"]"] + # varfile = ["example1.tfvars", "example2.tfvars"] + # variables = ["foo=bar", "bar=[\"baz\"]"] } rule "aws_instance_invalid_type" { diff --git a/CHANGELOG.md b/CHANGELOG.md index c733f4f..c816a8c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -76,3 +76,7 @@ * 1.5.0 -- 2026-02-12 - created policies - policies/sc-developer + +* 1.5.1 -- 2026-03-10 + - created policies + - policies/sc-db-user \ No newline at end of file diff --git a/policies/sc-db-user/README.md b/policies/sc-db-user/README.md new file mode 100644 index 0000000..33cb3c2 --- /dev/null +++ b/policies/sc-db-user/README.md @@ -0,0 +1,44 @@ +## Requirements + +| Name | Version | +|------|---------| +| [terraform](#requirement\_terraform) | >= 1.12 | +| [aws](#requirement\_aws) | >= 6.0 | + +## Providers + +| Name | Version | +|------|---------| +| [aws](#provider\_aws) | >= 6.0 | + +## Modules + +No modules. + +## Resources + +| Name | Type | +|------|------| +| [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source | +| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | +| [aws_iam_policy_document.inline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | +| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [account\_alias](#input\_account\_alias) | AWS Account Alias | `string` | `""` | no | +| [account\_id](#input\_account\_id) | AWS Account ID (default will pull from current user) | `string` | `""` | no | +| [override\_prefixes](#input\_override\_prefixes) | Override built-in prefixes by component. This should be used primarily for common infrastructure things | `map(string)` | `{}` | no | +| [tags](#input\_tags) | AWS Tags to apply to appropriate resources | `map(string)` | `{}` | no | + +## Outputs + +| Name | Description | +|------|-------------| +| [customer\_managed\_policy\_names](#output\_customer\_managed\_policy\_names) | Map of policy name to permission boundary of Customer Managed Policy to attach to the permissionset | +| [inline\_policy](#output\_inline\_policy) | AWS Policy document for the single allowed inline policy (use .json to get policy) | +| [managed\_policy\_names](#output\_managed\_policy\_names) | Names of AWS Managed Policy to attach to the permissionset | +| [name](#output\_name) | Permission Set Name for which all settings apply | +| [relay\_state](#output\_relay\_state) | Relay State to pass along to permissionset | diff --git a/policies/sc-db-user/base_arn.tf b/policies/sc-db-user/base_arn.tf new file mode 100644 index 0000000..5eba500 --- /dev/null +++ b/policies/sc-db-user/base_arn.tf @@ -0,0 +1,3 @@ +locals { + all_account_arn_iam = format("arn:%v:%v::%v:%%v", data.aws_arn.current.partition, "iam", "*") +} diff --git a/policies/sc-db-user/data.tf b/policies/sc-db-user/data.tf new file mode 120000 index 0000000..37fff16 --- /dev/null +++ b/policies/sc-db-user/data.tf @@ -0,0 +1 @@ +../../common/data.tf \ No newline at end of file diff --git a/policies/sc-db-user/defaults.tf b/policies/sc-db-user/defaults.tf new file mode 120000 index 0000000..1227df3 --- /dev/null +++ b/policies/sc-db-user/defaults.tf @@ -0,0 +1 @@ +../../common/defaults.tf \ No newline at end of file diff --git a/policies/sc-db-user/locals.tf b/policies/sc-db-user/locals.tf new file mode 100644 index 0000000..6aa29cd --- /dev/null +++ b/policies/sc-db-user/locals.tf @@ -0,0 +1,12 @@ +locals { + account_id = var.account_id != "" ? var.account_id : data.aws_caller_identity.current.account_id + account_environment = data.aws_arn.current.partition == "aws-us-gov" ? "gov" : "ew" + region = data.aws_region.current.region + region_short = join("", [for c in split("-", local.region) : substr(c, 0, 1)]) + + base_tags = { + "boc:tf_module_version" = local._module_version + "boc:tf_module_name" = local._module_name + "boc:created_by" = "terraform" + } +} diff --git a/policies/sc-db-user/main.tf b/policies/sc-db-user/main.tf new file mode 100644 index 0000000..3c91f4a --- /dev/null +++ b/policies/sc-db-user/main.tf @@ -0,0 +1,2 @@ +/* +*/ diff --git a/policies/sc-db-user/module_name.tf b/policies/sc-db-user/module_name.tf new file mode 100644 index 0000000..711d77e --- /dev/null +++ b/policies/sc-db-user/module_name.tf @@ -0,0 +1,3 @@ +locals { + _module_name = "aws-sso/policies/sc-db-user" +} diff --git a/policies/sc-db-user/outputs.tf b/policies/sc-db-user/outputs.tf new file mode 100644 index 0000000..776869b --- /dev/null +++ b/policies/sc-db-user/outputs.tf @@ -0,0 +1,24 @@ +output "name" { + description = "Permission Set Name for which all settings apply" + value = local.name +} + +output "managed_policy_names" { + description = "Names of AWS Managed Policy to attach to the permissionset" + value = local.managed_policy_names +} + +output "customer_managed_policy_names" { + description = "Map of policy name to permission boundary of Customer Managed Policy to attach to the permissionset" + value = local.customer_managed_policy_names +} + +output "inline_policy" { + description = "AWS Policy document for the single allowed inline policy (use .json to get policy)" + value = local.inline_policy +} + +output "relay_state" { + description = "Relay State to pass along to permissionset" + value = local.relay_state +} diff --git a/policies/sc-db-user/policy.tf b/policies/sc-db-user/policy.tf new file mode 100644 index 0000000..0812850 --- /dev/null +++ b/policies/sc-db-user/policy.tf @@ -0,0 +1,112 @@ +data "aws_iam_policy_document" "inline" { + statement { + sid = "AllowEC2Read" + effect = "Allow" + resources = ["*"] + actions = [ + "ec2:Describe*", + "ec2:Get*", + "ec2:List*", + ] + } + statement { + sid = "AllowKMSList" + effect = "Allow" + resources = ["*"] + actions = [ + "kms:Describe*", + "kms:List*", + ] + } + statement { + sid = "RDSKMSDefaultKeyAccess" + effect = "Allow" + resources = ["*"] + actions = [ + "kms:Decrypt", + "kms:EnableK*", + "kms:Encrypt", + "kms:GenerateDataKey*", + "kms:ReEncrypt*", + ] + condition { + test = "StringEquals" + variable = "kms:ResourceAliases" + values = [ + "alias/aws/rds", + "alias/aws/secretsmanager" + ] + } + } + statement { + sid = "RestrictInfKMS" + effect = "Deny" + resources = ["*"] + actions = ["kms:*"] + condition { + test = "StringLike" + variable = "kms:RequestAlias" + values = [ + "alias/k-kms-inf*" + ] + } + } + statement { + sid = "AllowRDSDB" + effect = "Allow" + resources = ["*"] + actions = [ + "rds-db:connect", + "rds:DescribeDBInstances", + "rds:DescribeDBClusters", + "rds:DescribeDBInstancesPerformance", + "rds:DescribeDBClustersPerformance", + "pi:DescribeDimensionKeys", + "pi:GetResourceMetrics", + "pi:ListAvailableResourceDimensions", + "pi:ListAvailableResourceMetrics" + ] + } + statement { + sid = "AllowSecretsManagerList" + effect = "Allow" + resources = ["*"] + actions = [ + "secretsmanager:List*", + ] + } + statement { + sid = "AllowSecretsManagerReadByJBID" + effect = "Allow" + resources = ["*"] + actions = [ + "secretsmanager:BatchGetSecretValue", + "secretsmanager:DescribeSecret", + "secretsmanager:GetSecretValue", + ] + # Enforce expected principal attribute shape: 8-character JBID. + condition { + test = "StringLike" + variable = "aws:PrincipalTag/jbid" + values = [ + "????????" + ] + } + # Secret must be tagged to the same JBID as the caller. + condition { + test = "StringEquals" + variable = "secretsmanager:ResourceTag/jbid" + values = [ + "&{aws:PrincipalTag/jbid}" + ] + } + # Name tag pattern includes the caller identifier. + condition { + test = "StringLike" + variable = "secretsmanager:ResourceTag/Name" + values = [ + "*&{aws:PrincipalTag/jbid}*" + ] + } + } +} diff --git a/policies/sc-db-user/prefixes.tf b/policies/sc-db-user/prefixes.tf new file mode 120000 index 0000000..5bc256c --- /dev/null +++ b/policies/sc-db-user/prefixes.tf @@ -0,0 +1 @@ +../../common/prefixes.tf \ No newline at end of file diff --git a/policies/sc-db-user/settings.tf b/policies/sc-db-user/settings.tf new file mode 100644 index 0000000..a70df81 --- /dev/null +++ b/policies/sc-db-user/settings.tf @@ -0,0 +1,12 @@ +locals { + name = "sc-db-user" + description = "System Common DB User" + managed_policy_names = [ + "ReadOnlyAccess", + ] + customer_managed_policy_names = { + "p-inf-tfstate-write" = null + } + relay_state = null + inline_policy = data.aws_iam_policy_document.inline +} diff --git a/policies/sc-db-user/variables.common.tf b/policies/sc-db-user/variables.common.tf new file mode 120000 index 0000000..e01226c --- /dev/null +++ b/policies/sc-db-user/variables.common.tf @@ -0,0 +1 @@ +../../common/variables.common.tf \ No newline at end of file diff --git a/policies/sc-db-user/variables.tf.unused b/policies/sc-db-user/variables.tf.unused new file mode 100644 index 0000000..53d6bf1 --- /dev/null +++ b/policies/sc-db-user/variables.tf.unused @@ -0,0 +1,29 @@ +variable "name" { + description = "Permission Set Name for which all settings apply" + type = string + default = null +} + +variable "managed_policy_names" { + description = "Names of AWS Managed Policy to attach to the permissionset" + type = list(string) + default = [] +} + +variable "customer_managed_policy_names" { + description = "Map of policy name to permission boundary of Customer Managed Policy to attach to the permissionset" + type = map(string) + default = {} +} + +# variable "inline_policy" { +# description = "AWS Policy document for the single allowed inline policy" +# type = string +# default = null +# } + +variable "relay_state" { + description = "Relay State to pass along to permissionset" + type = string + default = null +} diff --git a/policies/sc-db-user/version.tf b/policies/sc-db-user/version.tf new file mode 120000 index 0000000..4950c91 --- /dev/null +++ b/policies/sc-db-user/version.tf @@ -0,0 +1 @@ +../../common/version.tf \ No newline at end of file diff --git a/policies/sc-db-user/versions.tf b/policies/sc-db-user/versions.tf new file mode 120000 index 0000000..cbeda73 --- /dev/null +++ b/policies/sc-db-user/versions.tf @@ -0,0 +1 @@ +../../common/versions.tf \ No newline at end of file