Skip to content

Commit 13f492f

Browse files
Wi11Shellcmarstondvsa
Wi11Shell
and
cmarstondvsa
authored
fix: 7077 batch role (#1395)
* feat: create custom cli job execution role * fix: remove dupicates * fix: set version * fix: versions * fix: syntax * fix: update version * fix(update providers) * fix(update providers) * fix: update ecs module version * fix: update batch module parameters * fix: update batch module parameters * fix: update batch module parameters * fix: update batch module parameters * fix: update batch module parameters * fix: format fmt module * fix: role issues * fix: syntax * fix: syntax * fix: removing custom role * fix: remove host port * fix: readd hostport --------- Co-authored-by: cmarstondvsa <chris.marston@dvsa.gov.uk>
1 parent b6fe042 commit 13f492f

3 files changed

Lines changed: 61 additions & 102 deletions

File tree

‎infra/terraform/environments/dev/main.tf‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,66 @@ locals {
7878
"arn:aws:s3:::devapp-vol-content/*"
7979
]
8080
},
81+
{
82+
effect = "Allow"
83+
actions = [
84+
"rds:CreateDBClusterSnapshot",
85+
"rds:DescribeDBClusterSnapshots",
86+
"rds:DeleteDBClusterSnapshot",
87+
]
88+
resources = [
89+
"arn:aws:rds:eu-west-1:054614622558:cluster-snapshot:olcs-anon-*"
90+
]
91+
},
92+
{
93+
effect = "Allow"
94+
actions = [
95+
"rds:DescribeDBClusters",
96+
]
97+
resources = [
98+
"arn:aws:rds:eu-west-1:054614622558:cluster:olcs-*"
99+
]
100+
},
101+
{
102+
effect = "Allow"
103+
actions = [
104+
"rds:RestoreDBClusterFromSnapshot",
105+
]
106+
resources = [
107+
"arn:aws:rds:eu-west-1:054614622558:cluster-snapshot:olcs-anon-*",
108+
"arn:aws:rds:eu-west-1:054614622558:cluster:olcs-anon-*",
109+
]
110+
},
111+
{
112+
effect = "Allow"
113+
actions = [
114+
"rds:CreateDBInstance",
115+
"rds:DescribeDBInstances",
116+
]
117+
resources = [
118+
"arn:aws:rds:eu-west-1:054614622558:db:olcs-anon-*"
119+
]
120+
},
121+
{
122+
effect = "Allow"
123+
actions = [
124+
"rds:DeleteDBInstance",
125+
"rds:DeleteDBCluster",
126+
]
127+
resources = [
128+
"arn:aws:rds:eu-west-1:054614622558:db:olcs-anon-*",
129+
"arn:aws:rds:eu-west-1:054614622558:cluster:olcs-anon-*",
130+
]
131+
},
132+
{
133+
effect = "Allow"
134+
actions = [
135+
"rds:ModifyDBClusterSnapshotAttribute"
136+
]
137+
resources = [
138+
"arn:aws:rds:eu-west-1:054614622558:cluster-snapshot:olcs-anon-*"
139+
]
140+
}
81141
]
82142
}
83143

‎infra/terraform/modules/service/README.md‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,6 @@
1818
|------|--------|---------|
1919
| <a name="module_acm"></a> [acm](#module\_acm) | terraform-aws-modules/acm/aws | ~> 5.0 |
2020
| <a name="module_batch"></a> [batch](#module\_batch) | terraform-aws-modules/batch/aws | ~> 3.0 |
21-
| <a name="module_cli_iam_policy"></a> [cli\_iam\_policy](#module\_cli\_iam\_policy) | terraform-aws-modules/iam/aws//modules/iam-policy | ~> 5.6 |
22-
| <a name="module_cli_iam_role"></a> [cli\_iam\_role](#module\_cli\_iam\_role) | terraform-aws-modules/iam/aws//modules/iam-role | ~> 6.0 |
2321
| <a name="module_cloudfront"></a> [cloudfront](#module\_cloudfront) | terraform-aws-modules/cloudfront/aws | ~> 3.4 |
2422
| <a name="module_cloudwatch_log-metric-filter"></a> [cloudwatch\_log-metric-filter](#module\_cloudwatch\_log-metric-filter) | terraform-aws-modules/cloudwatch/aws//modules/log-metric-filter | 5.7.0 |
2523
| <a name="module_ecs_cluster"></a> [ecs\_cluster](#module\_ecs\_cluster) | terraform-aws-modules/ecs/aws//modules/cluster | ~> 5.10 |

‎infra/terraform/modules/service/batch.tf‎

Lines changed: 1 addition & 100 deletions
Original file line numberDiff line numberDiff line change
@@ -165,7 +165,7 @@ locals {
165165
},
166166
],
167167

168-
executionRoleArn = module.cli_iam_role.arn
168+
executionRoleArn = module.ecs_service["api"].task_exec_iam_role_arn
169169
jobRoleArn = module.ecs_service["api"].tasks_iam_role_arn
170170

171171
logConfiguration = {
@@ -208,105 +208,6 @@ locals {
208208
})
209209
}
210210
}
211-
cli_role_statements = concat(
212-
213-
[
214-
{
215-
effect = "Allow"
216-
actions = [
217-
"rds:CreateDBClusterSnapshot",
218-
"rds:DescribeDBClusterSnapshots",
219-
"rds:DeleteDBClusterSnapshot",
220-
]
221-
resources = [
222-
"arn:aws:rds:eu-west-1:${data.aws_caller_identity.current.account_id}:cluster-snapshot:olcs-anon-*"
223-
]
224-
},
225-
{
226-
effect = "Allow"
227-
actions = [
228-
"rds:DescribeDBClusters",
229-
]
230-
resources = [
231-
"arn:aws:rds:eu-west-1:${data.aws_caller_identity.current.account_id}:cluster:olcs-*"
232-
]
233-
},
234-
{
235-
effect = "Allow"
236-
actions = [
237-
"rds:RestoreDBClusterFromSnapshot",
238-
]
239-
resources = [
240-
"arn:aws:rds:eu-west-1:${data.aws_caller_identity.current.account_id}:cluster-snapshot:olcs-anon-*",
241-
"arn:aws:rds:eu-west-1:${data.aws_caller_identity.current.account_id}:cluster:olcs-anon-*",
242-
]
243-
},
244-
{
245-
effect = "Allow"
246-
actions = [
247-
"rds:CreateDBInstance",
248-
"rds:DescribeDBInstances",
249-
]
250-
resources = [
251-
"arn:aws:rds:eu-west-1:${data.aws_caller_identity.current.account_id}:db:olcs-anon-*"
252-
]
253-
},
254-
{
255-
effect = "Allow"
256-
actions = [
257-
"rds:DeleteDBInstance",
258-
"rds:DeleteDBCluster",
259-
]
260-
resources = [
261-
"arn:aws:rds:eu-west-1:${data.aws_caller_identity.current.account_id}:db:olcs-anon-*",
262-
"arn:aws:rds:eu-west-1:${data.aws_caller_identity.current.account_id}:cluster:olcs-anon-*",
263-
]
264-
},
265-
{
266-
effect = "Allow"
267-
actions = [
268-
"rds:ModifyDBClusterSnapshotAttribute"
269-
]
270-
resources = [
271-
"arn:aws:rds:eu-west-1:${data.aws_caller_identity.current.account_id}:cluster-snapshot:olcs-anon-*"
272-
]
273-
}
274-
],
275-
276-
var.batch.task_iam_role_statements
277-
)
278-
}
279-
280-
module "cli_iam_policy" {
281-
version = "~> 5.6"
282-
source = "terraform-aws-modules/iam/aws//modules/iam-policy"
283-
284-
name = "vol-app-${var.environment}-cli"
285-
path = "/"
286-
description = "Policy for CLI batch jobs"
287-
288-
policy = jsonencode({
289-
Version = "2012-10-17"
290-
Statement = local.cli_role_statements
291-
})
292-
}
293-
module "cli_iam_role" {
294-
version = "~> 6.0"
295-
source = "terraform-aws-modules/iam/aws//modules/iam-role"
296-
297-
name = "vol-app-${var.environment}-cli-role"
298-
299-
trust_policy_permissions = {
300-
TrustRoleAndServiceToAssume = {
301-
actions = [
302-
"sts:AssumeRole",
303-
]
304-
}
305-
}
306-
307-
policies = {
308-
CLIPolicy = module.cli_iam_policy.arn
309-
}
310211
}
311212

312213
module "batch" {

0 commit comments

Comments
 (0)