From 77b852c058d4e16764f353a761050d06a4302762 Mon Sep 17 00:00:00 2001 From: badra001 Date: Wed, 25 Mar 2026 13:47:27 -0400 Subject: [PATCH 1/4] * 1.6.1 -- 2026-03-25 - policies/sc-servicecatalog-t2 - granted select ec2 permissions --- CHANGELOG.md | 4 ++++ common/version.tf | 2 +- policies/sc-servicecatalog-t2/policy.tf | 22 ++++++++++++++++++++++ 3 files changed, 27 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5055ff9..c03df1a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -81,3 +81,7 @@ - created policies - policies/sc-readonly - included AWSSupportAccess in this policy + +* 1.6.1 -- 2026-03-25 + - policies/sc-servicecatalog-t2 + - granted select ec2 permissions diff --git a/common/version.tf b/common/version.tf index 2cc7061..78e6e8d 100644 --- a/common/version.tf +++ b/common/version.tf @@ -1,3 +1,3 @@ locals { - _module_version = "1.6.0" + _module_version = "1.6.1" } diff --git a/policies/sc-servicecatalog-t2/policy.tf b/policies/sc-servicecatalog-t2/policy.tf index 425ab7f..77c67fb 100644 --- a/policies/sc-servicecatalog-t2/policy.tf +++ b/policies/sc-servicecatalog-t2/policy.tf @@ -10,4 +10,26 @@ data "aws_iam_policy_document" "inline" { ] resources = ["*"] } + statement { + sid = "EC2Actions" + effect = "Allow" + actions = [ + "ec2:StopInstances", + "ec2:StartInstances", + "ec2:RunInstances", + "ec2:RebootInstances", + "ec2:ModifyInstanceAttribute", + "ec2:DescribeVolumesModifications", + "ec2:DescribeVolumes", + "ec2:DescribeVolumeStatus", + "ec2:DescribeVolumeAttribute", + "ec2:DescribeTags", + "ec2:DescribeSecurityGroups", + "ec2:DescribeSecurityGroupRules", + "ec2:AssociateSecurityGroupVpc", + "ec2:GetSecurityGroupsForVpc", + ] + resources = ["*"] + } } + From 52bc74e461901e10678bbc3e7bf03186e4d1820b Mon Sep 17 00:00:00 2001 From: badra001 Date: Wed, 25 Mar 2026 15:37:40 -0400 Subject: [PATCH 2/4] * 1.7.0 -- 2026-03-25 - created policies - policies/sc-operator --- CHANGELOG.md | 5 +++ common/version.tf | 2 +- policies/sc-operator/README.md | 44 ++++++++++++++++++++++++ policies/sc-operator/base_arn.tf | 3 ++ policies/sc-operator/data.tf | 1 + policies/sc-operator/defaults.tf | 1 + policies/sc-operator/locals.tf | 12 +++++++ policies/sc-operator/main.tf | 2 ++ policies/sc-operator/module_name.tf | 3 ++ policies/sc-operator/outputs.tf | 24 +++++++++++++ policies/sc-operator/policy.tf | 18 ++++++++++ policies/sc-operator/prefixes.tf | 1 + policies/sc-operator/settings.tf | 11 ++++++ policies/sc-operator/variables.common.tf | 1 + policies/sc-operator/version.tf | 1 + policies/sc-operator/versions.tf | 1 + 16 files changed, 129 insertions(+), 1 deletion(-) create mode 100644 policies/sc-operator/README.md create mode 100644 policies/sc-operator/base_arn.tf create mode 120000 policies/sc-operator/data.tf create mode 120000 policies/sc-operator/defaults.tf create mode 100644 policies/sc-operator/locals.tf create mode 100644 policies/sc-operator/main.tf create mode 100644 policies/sc-operator/module_name.tf create mode 100644 policies/sc-operator/outputs.tf create mode 100644 policies/sc-operator/policy.tf create mode 120000 policies/sc-operator/prefixes.tf create mode 100644 policies/sc-operator/settings.tf create mode 120000 policies/sc-operator/variables.common.tf create mode 120000 policies/sc-operator/version.tf create mode 120000 policies/sc-operator/versions.tf diff --git a/CHANGELOG.md b/CHANGELOG.md index c03df1a..12c31db 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -85,3 +85,8 @@ * 1.6.1 -- 2026-03-25 - policies/sc-servicecatalog-t2 - granted select ec2 permissions + +* 1.7.0 -- 2026-03-25 + - created policies + - policies/sc-operator + diff --git a/common/version.tf b/common/version.tf index 78e6e8d..d16c54d 100644 --- a/common/version.tf +++ b/common/version.tf @@ -1,3 +1,3 @@ locals { - _module_version = "1.6.1" + _module_version = "1.7.0" } diff --git a/policies/sc-operator/README.md b/policies/sc-operator/README.md new file mode 100644 index 0000000..33cb3c2 --- /dev/null +++ b/policies/sc-operator/README.md @@ -0,0 +1,44 @@ +## Requirements + +| Name | Version | +|------|---------| +| [terraform](#requirement\_terraform) | >= 1.12 | +| [aws](#requirement\_aws) | >= 6.0 | + +## Providers + +| Name | Version | +|------|---------| +| [aws](#provider\_aws) | >= 6.0 | + +## Modules + +No modules. + +## Resources + +| Name | Type | +|------|------| +| [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source | +| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | +| [aws_iam_policy_document.inline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | +| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [account\_alias](#input\_account\_alias) | AWS Account Alias | `string` | `""` | no | +| [account\_id](#input\_account\_id) | AWS Account ID (default will pull from current user) | `string` | `""` | no | +| [override\_prefixes](#input\_override\_prefixes) | Override built-in prefixes by component. This should be used primarily for common infrastructure things | `map(string)` | `{}` | no | +| [tags](#input\_tags) | AWS Tags to apply to appropriate resources | `map(string)` | `{}` | no | + +## Outputs + +| Name | Description | +|------|-------------| +| [customer\_managed\_policy\_names](#output\_customer\_managed\_policy\_names) | Map of policy name to permission boundary of Customer Managed Policy to attach to the permissionset | +| [inline\_policy](#output\_inline\_policy) | AWS Policy document for the single allowed inline policy (use .json to get policy) | +| [managed\_policy\_names](#output\_managed\_policy\_names) | Names of AWS Managed Policy to attach to the permissionset | +| [name](#output\_name) | Permission Set Name for which all settings apply | +| [relay\_state](#output\_relay\_state) | Relay State to pass along to permissionset | diff --git a/policies/sc-operator/base_arn.tf b/policies/sc-operator/base_arn.tf new file mode 100644 index 0000000..5eba500 --- /dev/null +++ b/policies/sc-operator/base_arn.tf @@ -0,0 +1,3 @@ +locals { + all_account_arn_iam = format("arn:%v:%v::%v:%%v", data.aws_arn.current.partition, "iam", "*") +} diff --git a/policies/sc-operator/data.tf b/policies/sc-operator/data.tf new file mode 120000 index 0000000..37fff16 --- /dev/null +++ b/policies/sc-operator/data.tf @@ -0,0 +1 @@ +../../common/data.tf \ No newline at end of file diff --git a/policies/sc-operator/defaults.tf b/policies/sc-operator/defaults.tf new file mode 120000 index 0000000..1227df3 --- /dev/null +++ b/policies/sc-operator/defaults.tf @@ -0,0 +1 @@ +../../common/defaults.tf \ No newline at end of file diff --git a/policies/sc-operator/locals.tf b/policies/sc-operator/locals.tf new file mode 100644 index 0000000..6aa29cd --- /dev/null +++ b/policies/sc-operator/locals.tf @@ -0,0 +1,12 @@ +locals { + account_id = var.account_id != "" ? var.account_id : data.aws_caller_identity.current.account_id + account_environment = data.aws_arn.current.partition == "aws-us-gov" ? "gov" : "ew" + region = data.aws_region.current.region + region_short = join("", [for c in split("-", local.region) : substr(c, 0, 1)]) + + base_tags = { + "boc:tf_module_version" = local._module_version + "boc:tf_module_name" = local._module_name + "boc:created_by" = "terraform" + } +} diff --git a/policies/sc-operator/main.tf b/policies/sc-operator/main.tf new file mode 100644 index 0000000..3c91f4a --- /dev/null +++ b/policies/sc-operator/main.tf @@ -0,0 +1,2 @@ +/* +*/ diff --git a/policies/sc-operator/module_name.tf b/policies/sc-operator/module_name.tf new file mode 100644 index 0000000..d48cd32 --- /dev/null +++ b/policies/sc-operator/module_name.tf @@ -0,0 +1,3 @@ +locals { + _module_name = "aws-sso/policies/sc-operator" +} diff --git a/policies/sc-operator/outputs.tf b/policies/sc-operator/outputs.tf new file mode 100644 index 0000000..776869b --- /dev/null +++ b/policies/sc-operator/outputs.tf @@ -0,0 +1,24 @@ +output "name" { + description = "Permission Set Name for which all settings apply" + value = local.name +} + +output "managed_policy_names" { + description = "Names of AWS Managed Policy to attach to the permissionset" + value = local.managed_policy_names +} + +output "customer_managed_policy_names" { + description = "Map of policy name to permission boundary of Customer Managed Policy to attach to the permissionset" + value = local.customer_managed_policy_names +} + +output "inline_policy" { + description = "AWS Policy document for the single allowed inline policy (use .json to get policy)" + value = local.inline_policy +} + +output "relay_state" { + description = "Relay State to pass along to permissionset" + value = local.relay_state +} diff --git a/policies/sc-operator/policy.tf b/policies/sc-operator/policy.tf new file mode 100644 index 0000000..ef3100f --- /dev/null +++ b/policies/sc-operator/policy.tf @@ -0,0 +1,18 @@ +data "aws_iam_policy_document" "inline" { + statement { + sid = "DenyGetAccessToData" + effect = "Deny" + resources = ["*"] + + actions = [ + "sqs:Receive*", + "s3:GetObject*", + "dynamodb:Scan", + "dynamodb:Query", + "dynamodb:Get*", + "dynamodb:BatchGet*", + "athena:Get*", + "athena:Batch*", + ] + } +} diff --git a/policies/sc-operator/prefixes.tf b/policies/sc-operator/prefixes.tf new file mode 120000 index 0000000..5bc256c --- /dev/null +++ b/policies/sc-operator/prefixes.tf @@ -0,0 +1 @@ +../../common/prefixes.tf \ No newline at end of file diff --git a/policies/sc-operator/settings.tf b/policies/sc-operator/settings.tf new file mode 100644 index 0000000..85d0a71 --- /dev/null +++ b/policies/sc-operator/settings.tf @@ -0,0 +1,11 @@ +locals { + name = "sc-operator" + description = "System Common Opeerator" + managed_policy_names = [ + "IAMReadOnlyAccess", + "ReadOnlyAccess", + ] + customer_managed_policy_names = {} + # relay_state = data.aws_arn.current.partition == "aws-us-gov" ? "https://console.amazonaws-us-gov.com/X/home" : "https://console.aws.amazon.com/X/home" + inline_policy = data.aws_iam_policy_document.inline +} diff --git a/policies/sc-operator/variables.common.tf b/policies/sc-operator/variables.common.tf new file mode 120000 index 0000000..e01226c --- /dev/null +++ b/policies/sc-operator/variables.common.tf @@ -0,0 +1 @@ +../../common/variables.common.tf \ No newline at end of file diff --git a/policies/sc-operator/version.tf b/policies/sc-operator/version.tf new file mode 120000 index 0000000..4950c91 --- /dev/null +++ b/policies/sc-operator/version.tf @@ -0,0 +1 @@ +../../common/version.tf \ No newline at end of file diff --git a/policies/sc-operator/versions.tf b/policies/sc-operator/versions.tf new file mode 120000 index 0000000..cbeda73 --- /dev/null +++ b/policies/sc-operator/versions.tf @@ -0,0 +1 @@ +../../common/versions.tf \ No newline at end of file From b3f87b2fa13beb03792db39c4d8f31ec30816c14 Mon Sep 17 00:00:00 2001 From: badra001 Date: Wed, 25 Mar 2026 15:42:15 -0400 Subject: [PATCH 3/4] fix --- policies/sc-operator/settings.tf | 1 + 1 file changed, 1 insertion(+) diff --git a/policies/sc-operator/settings.tf b/policies/sc-operator/settings.tf index 85d0a71..03aa619 100644 --- a/policies/sc-operator/settings.tf +++ b/policies/sc-operator/settings.tf @@ -7,5 +7,6 @@ locals { ] customer_managed_policy_names = {} # relay_state = data.aws_arn.current.partition == "aws-us-gov" ? "https://console.amazonaws-us-gov.com/X/home" : "https://console.aws.amazon.com/X/home" + relay_state = null inline_policy = data.aws_iam_policy_document.inline } From 1c2cec3be4759106f6067b6510250c9aaf82ea8c Mon Sep 17 00:00:00 2001 From: badra001 Date: Thu, 26 Mar 2026 10:43:30 -0400 Subject: [PATCH 4/4] * 1.7.1 -- 2026-03-26 - updated policies/sc-developer - add kms:UpdateKeyDescription --- CHANGELOG.md | 3 +++ common/version.tf | 2 +- policies/sc-developer/policy.tf | 1 + 3 files changed, 5 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 12c31db..1e3a7fa 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -90,3 +90,6 @@ - created policies - policies/sc-operator +* 1.7.1 -- 2026-03-26 + - updated policies/sc-developer + - add kms:UpdateKeyDescription diff --git a/common/version.tf b/common/version.tf index d16c54d..97aa706 100644 --- a/common/version.tf +++ b/common/version.tf @@ -1,3 +1,3 @@ locals { - _module_version = "1.7.0" + _module_version = "1.7.1" } diff --git a/policies/sc-developer/policy.tf b/policies/sc-developer/policy.tf index 042172a..0fff97b 100644 --- a/policies/sc-developer/policy.tf +++ b/policies/sc-developer/policy.tf @@ -311,6 +311,7 @@ data "aws_iam_policy_document" "inline" { "kms:RetireGrant", "kms:TagResource", "kms:UntagResource", + "kms:UpdateKeyDescription", ] } statement {