Refactor policies for the deployer role#2128
Draft
cadmiumcat wants to merge 1 commit into
Draft
Conversation
We had initially split policies according to terraform roots to help us understand which permissions where needed for each. However, we have deviated from this and the approach and we have two issues: - A lot of duplication (this matters because of the limit on policy sizes set by AWS) - it's difficult to understand what permissions are in the policy. One root may set very restrictive 's3' permissions, whilst another may have 's3:*', making the first one redundant This approach aims to simplify the policies by merging duplicated permissions (including any that had already been granted by the ReadOnly policy), and organising them based on the `aws` services the give/deny access to (as well as alphabetically) The `iam` related policy documents are kept separate from the rest, as they are special/important
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What problem does this pull request solve?
We had initially split policies according to terraform roots to help us understand which permissions where needed for each. However, we have deviated from this and the approach and we have two issues:
This approach aims to simplify the policies by merging duplicated permissions (including any that had already been granted by the ReadOnly policy), and organising them based on the
awsservices the give/deny access to (as well as alphabetically)The
iamrelated policy documents are kept separate from the rest, as they are special/important (but I'm happy to change this if it's confusing)The overall aim is to simplify permission to make it easier for us to set a permissions boundary
Trello card:
In case it helps:
Policy statements I merged together because they were giving the same permission to different resources
ManageCloudwatchMetricAlarms
ManageCloudWatchAlarms
CloudWatchApplicationSignalsPutMetricAlarmPermissions
ManageNetwork
ManageEC2Tags
ManageEcsExecutionPolicies
ManageEcsTaskPolicies
ManageMalwareProtectionRoleforS3
ManageRoles
ManageMalwareProtectionPoliciesforS3
ManageSESPolicies
ManagePolicies
ManageKMSKeySES
ManageKMSKeyAlerts
ManageLogs
ManageLogs
CreateLogs
ManageCloudwatchLogsWAF
ManageRoute53RecordSets
ManageRoute53RecordSets
ManageArtifactBuckets
ManageLambdaBuckets
ManageFormsRunnerBuckets
ManageStateBucketAccessLogs
ManageALBAccessLogsAccessLogs
ManageErrorPageBucket
ManageALBandWAFLogsBucket
ManageSESVerification
AllowManageSESTagging
ManageSNS
ManageSNS
Policy statements I removed because they were already included in the read-only policy
DescribeEC2
DescribeECSClustersAndServices
ListAlbResources
DescribeLogGroups
ListHostedZones
ListRdsDbCredentialSecrets
Things to consider when reviewing
Reminders
If you've made changes to the deployer role (files in
modules/deployer-access):make <environment> forms/account applyon the relevant environments (dev,stagingand/orprod)apply-forms-terraform-<environment>pipelines have run successfully