-
-
Notifications
You must be signed in to change notification settings - Fork 3
/
iam.tf
96 lines (92 loc) · 2.45 KB
/
iam.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
resource "aws_iam_role" "bastion_host_iam_role" {
name = "${var.name}-bastion-host-iam-role"
managed_policy_arns = [
"arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
"arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy"
]
assume_role_policy = jsonencode({
"Version" : "2012-10-17",
"Statement" : [
{
"Action" : "sts:AssumeRole",
"Principal" : {
"Service" : "ec2.amazonaws.com"
},
"Effect" : "Allow",
"Sid" : ""
}
]
})
}
resource "aws_iam_instance_profile" "bastion_instance_profile" {
name = "${var.name}-bastion-instance-profile"
role = aws_iam_role.bastion_host_iam_role.name
}
resource "aws_iam_role_policy" "bastion_host_iam_role" {
name = "${var.name}-bastion-host-iam-role"
role = aws_iam_role.bastion_host_iam_role.id
policy = jsonencode({
"Version" : "2012-10-17",
"Statement" : [
{
"Effect" : "Allow",
"Action" : ["s3:ListBucket"],
"Resource" : ["arn:aws:s3:::*"]
},
{
"Effect" : "Allow",
"Action" : [
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObject"
],
"Resource" : ["arn:aws:s3:::*/*"]
},
{
"Effect" : "Allow",
"Action" : [
"cloudwatch:PutMetricData",
"ec2:DescribeVolumes",
"ec2:DescribeTags",
"logs:PutLogEvents",
"logs:DescribeLogStreams",
"logs:DescribeLogGroups",
"logs:CreateLogStream",
"logs:CreateLogGroup"
],
"Resource" : "*"
},
{
"Effect" : "Allow",
"Action" : [
"ssm:GetParameter"
],
"Resource" : "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-*"
},
{
"Effect" : "Allow",
"Action" : [
"secretsmanager:GetSecretValue"
],
"Resource" : "arn:aws:secretsmanager:*:*:secret:*"
}
]
})
}
resource "aws_iam_policy" "ec2_instance_connect_policy" {
name = "${var.name}-ec2-instance-connect-policy"
policy = jsonencode({
"Version" : "2012-10-17",
"Statement" : [
{
"Effect" : "Allow",
"Action" : "ec2-instance-connect:SendSSHPublicKey",
"Resource" : "*"
}
]
})
}
resource "aws_iam_role_policy_attachment" "bastion_host_instance_connect_policy_attachment" {
role = aws_iam_role.bastion_host_iam_role.name
policy_arn = aws_iam_policy.ec2_instance_connect_policy.arn
}