-
-
Notifications
You must be signed in to change notification settings - Fork 23
/
identities.tf
125 lines (122 loc) · 3.47 KB
/
identities.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
#
# This role is used by RDS Start Export Task
#
resource "aws_iam_role" "rdsSnapshotExportTask" {
name = "${local.prefix}snapshot-export-task${local.postfix}"
tags = merge({ Name = "${local.prefix}snapshot-export-task${local.postfix}" }, var.tags)
assume_role_policy = <<POLICY
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "export.rds.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
POLICY
}
#
# Allow RDS Start Export Task to write the snapshot on the S3 bucket
#
resource "aws_iam_role_policy" "rdsSnapshotExportToS3" {
name = "${local.prefix}rds-snapshot-export-to-s3${local.postfix}"
role = aws_iam_role.rdsSnapshotExportTask.id
policy = <<POLICY
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ExportPolicy",
"Effect": "Allow",
"Action": [
"s3:PutObject*",
"s3:ListBucket",
"s3:GetObject*",
"s3:DeleteObject*",
"s3:GetBucketLocation"
],
"Resource": [
"${local.snapshots_bucket_arn}",
"${local.snapshots_bucket_arn}/*"
]
}
]
}
POLICY
}
#
# Lambda Permissions: Start Export Task
#
resource "aws_iam_policy" "rdsStartExportTaskLambda" {
name = "${local.prefix}rds-snapshot-exporter-lambda${local.postfix}"
tags = merge({ Name = "${local.prefix}rds-snapshot-exporter-lambda${local.postfix}" }, var.tags)
policy = <<POLICY
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"rds:StartExportTask",
"rds:DescribeDBSnapshots",
"rds:DescribeDBClusterSnapshots"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "iam:PassRole",
"Resource": ["${aws_iam_role.rdsSnapshotExportTask.arn}"],
"Effect": "Allow"
},
{
"Effect" : "Allow",
"Action" : [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey"
],
"Resource" : [
"${var.create_customer_kms_key ? aws_kms_key.snapshotExportEncryptionKey[0].arn : var.customer_kms_key_arn}"
]
},
{
"Effect": "Allow",
"Action": [
"kms:CreateGrant",
"kms:ListGrants",
"kms:RevokeGrant"
],
"Resource": "${var.create_customer_kms_key ? aws_kms_key.snapshotExportEncryptionKey[0].arn : var.customer_kms_key_arn}",
"Condition": {
"Bool": { "kms:GrantIsForAWSResource": "true" }
}
}
]
}
POLICY
}
#
# Lambda Permissions: Export Task Monitor
#
resource "aws_iam_policy" "rdsMonitorExportTaskLambda" {
name = "${local.prefix}rds-snapshot-exporter-monitor-lambda${local.postfix}"
tags = merge({ Name = "${local.prefix}rds-snapshot-exporter-monitor-lambda${local.postfix}" }, var.tags)
policy = <<POLICY
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sns:Publish",
"Resource": ["${var.create_notifications_topic ? aws_sns_topic.exportMonitorNotifications[0].arn : var.notifications_topic_arn}"],
"Effect": "Allow"
}
]
}
POLICY
}