Skip to content

Feature/eli 731 add regression role to tf #642

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
TOEL2 wants to merge 9 commits into
base: main
Choose a base branch
from
Open

Feature/eli 731 add regression role to tf #642

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
14d275e
[ELI-731] creating a new role and adding a trust policy for the regre…
TOEL2 Apr 15, 2026
271901b
[ELI-731] swapping things around into a logical order
TOEL2 Apr 15, 2026
6b225d4
[ELI-731] adding required permissions to new role
TOEL2 Apr 15, 2026
7f4609e
Merge branch 'main' into feature/ELI-731-add-regression-role-to-tf
TOEL2 Apr 16, 2026
8afd37c
[ELI-731] addressing commments
TOEL2 Apr 16, 2026
a67ee36
[ELI-731] addressing comments
TOEL2 Apr 16, 2026
9541bc5
[ELI-731] addressing comments
TOEL2 Apr 16, 2026
41229b1
[ELI-731] changing name
TOEL2 Apr 17, 2026
b2a9a45
[ELI-731] addressing comments
TOEL2 Apr 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
237 changes: 194 additions & 43 deletions infrastructure/stacks/iams-developer-roles/github_actions_policies.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -678,49 +678,6 @@ resource "aws_iam_policy" "iam_management" {
tags = merge(local.tags, { Name = "iam-management" })
}

# Assume role policy document for GitHub Actions
data "aws_iam_policy_document" "github_actions_assume_role" {
statement {
sid = "OidcAssumeRoleWithWebIdentity"
effect = "Allow"
actions = ["sts:AssumeRoleWithWebIdentity"]

principals {
type = "Federated"
identifiers = [
aws_iam_openid_connect_provider.github.arn
]
}

condition {
test = "StringLike"
variable = "token.actions.githubusercontent.com:sub"
values = ["repo:${var.github_org}/${var.github_repo}:*"]
}

condition {
test = "StringEquals"
variable = "token.actions.githubusercontent.com:aud"
values = ["sts.amazonaws.com"]
}
}
dynamic "statement" {
for_each = var.environment == "dev" ? [1] : []
content {
sid = "AllowDevSSORoleToAssumeIamBootstrap"
effect = "Allow"
actions = ["sts:AssumeRole"]

principals {
type = "AWS"
identifiers = [
local.dev_role_arn
]
}
}
}
}

resource "aws_iam_policy" "stream_management" {
name = "stream-management"
description = "Allow GitHub Actions to manage project Firehose delivery streams and Kinesis streams"
Expand Down Expand Up @@ -845,6 +802,190 @@ resource "aws_iam_policy" "cloudwatch_management" {
tags = merge(local.tags, { Name = "cloudwatch-management" })
}

data "aws_iam_policy_document" "regression_test_permissions" {
statement {
sid = "S3Access"
effect = "Allow"
actions = [
"s3:ListBucket",
"s3:GetObject",
"s3:PutObject",
"s3:DeleteObject",
"s3:GetBucketTagging",
"s3:GetObjectTagging",
"s3:PutObjectTagging",
"s3:GetObjectVersion"
],
Copy link
Copy Markdown
Collaborator

@eddalmond1 eddalmond1 Apr 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

bin comma

resources = [
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-rules",
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-rules/*",
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-consumer-map",
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-consumer-map/*"
]
}

statement {
sid = "DynamoAccess"
effect = "Allow"
actions = [
"dynamodb:GetItem",
Comment thread
eddalmond1 marked this conversation as resolved.
"dynamodb:PutItem",
"dynamodb:Query",
"dynamodb:Scan",
"dynamodb:UpdateItem",
"dynamodb:DeleteItem",
"dynamodb:DescribeTable",
"dynamodb:ListTables",
"dynamodb:DeleteTable",
"dynamodb:CreateTable",
"dynamodb:TagResource",
"dynamodb:UntagResource",
"dynamodb:ListTagsOfResource"
]
resources = [
"arn:aws:dynamodb:*:${data.aws_caller_identity.current.account_id}:table/*eligibility-signposting-api-${var.environment}-eligibility_datastore"
Copy link
Copy Markdown
Collaborator

@eddalmond1 eddalmond1 Apr 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

think this needs the region var

"arn:aws:dynamodb:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:table/*eligibility-signposting-api-${var.environment}-eligibility_datastore"

Copy link
Copy Markdown
Contributor Author

@TOEL2 TOEL2 Apr 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i did think that but no where else in this file is that given? so i just went with the convention, happy to change though

]
}

statement {
sid = "SecretsManagerAccess"
effect = "Allow"
actions = [
"secretsmanager:GetSecretValue",
"secretsmanager:PutSecretValue",
Copy link
Copy Markdown
Collaborator

@eddalmond1 eddalmond1 Apr 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do the tests change the secret values or versions?

Copy link
Copy Markdown
Contributor Author

@TOEL2 TOEL2 Apr 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought they might do or may do in future, i will discuss with adam as i'd rather they didnt

"secretsmanager:DescribeSecret",
"secretsmanager:UpdateSecretVersionStage"
]
resources = ["*"]
}
Copy link
Copy Markdown
Collaborator

@eddalmond1 eddalmond1 Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we need to add a resource here for the specific secrets

Copy link
Copy Markdown
Contributor Author

@TOEL2 TOEL2 Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the reason I haven't is because we only have 1 and also because secrets that we add later will likely need to be tested by regression anyway so its just gunna end up listing all the secrets here.

Copy link
Copy Markdown
Contributor Author

@TOEL2 TOEL2 Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

happy to be convinced otherwise though

Copy link
Copy Markdown
Contributor Author

@TOEL2 TOEL2 Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

just realised i'm missing the resource tab entirely! will add a *

Copy link
Copy Markdown
Collaborator

@eddalmond1 eddalmond1 Apr 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could probably still specify a wildcarded path based on the 'path' of the secrets we save.

Copy link
Copy Markdown
Collaborator

@eddalmond1 eddalmond1 Apr 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"arn:aws:secretsmanager:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:secret:eligibility-signposting-api-*"


statement {
sid = "CloudWatchLogsRead"
effect = "Allow"
actions = [
"logs:DescribeLogGroups",
"logs:DescribeLogStreams",
"logs:GetLogEvents",
"logs:FilterLogEvents",
"logs:StartQuery",
"logs:GetQueryResults",
"logs:StopQuery"
]
resources = ["*"]
}

statement {
sid = "XRayRead"
effect = "Allow"
actions = [
"xray:GetTraceSummaries",
"xray:BatchGetTraces",
"xray:GetServiceGraph",
"xray:GetGroups",
"xray:GetGroup",
"xray:GetSamplingRules",
"xray:GetSamplingTargets",
"xray:GetSamplingStatisticSummaries",
"xray:UpdateSamplingRule"
]
resources = ["*"]
}

statement {
sid = "SSMRead"
effect = "Allow"
actions = [
"ssm:GetParameter",
"ssm:GetParameters",
"ssm:GetParametersByPath"
]
resources = [
"arn:aws:ssm:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:parameter/${var.environment}/*",
"arn:aws:ssm:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:parameter/splunk/*",
Copy link
Copy Markdown
Collaborator

@eddalmond1 eddalmond1 Apr 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can't think why regression tests would need either our splunk or proxygen tokens (the ones below).

Presumably needs mtls to send requests to our api, so the first resource is probably ok

Copy link
Copy Markdown
Contributor Author

@TOEL2 TOEL2 Apr 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah this is another case of just trying to give what they had, but agree its not needed i will remove

"arn:aws:ssm:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:parameter/ptl/*",
"arn:aws:ssm:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:parameter/prod/*"
]
}
}

resource "aws_iam_policy" "regression_test_permissions" {
name = "regression-test-permissions"
description = "Permissions for the regression test GitHub Actions role"
path = "/service-policies/"
policy = data.aws_iam_policy_document.regression_test_permissions.json
}

# Assume role policy document for GitHub Actions
data "aws_iam_policy_document" "github_actions_assume_role" {
statement {
sid = "OidcAssumeRoleWithWebIdentity"
effect = "Allow"
actions = ["sts:AssumeRoleWithWebIdentity"]

principals {
type = "Federated"
identifiers = [
aws_iam_openid_connect_provider.github.arn
]
}

condition {
test = "StringLike"
variable = "token.actions.githubusercontent.com:sub"
values = ["repo:${var.github_org}/${var.github_repo}:*"]
}

condition {
test = "StringEquals"
variable = "token.actions.githubusercontent.com:aud"
values = ["sts.amazonaws.com"]
}
}
dynamic "statement" {
for_each = var.environment == "dev" ? [1] : []
content {
sid = "AllowDevSSORoleToAssumeIamBootstrap"
effect = "Allow"
actions = ["sts:AssumeRole"]

principals {
type = "AWS"
identifiers = [
local.dev_role_arn
]
}
}
}
}

# Assume role policy document for GitHub Actions
data "aws_iam_policy_document" "regression_repo_assume_role" {
statement {
sid = "OidcAssumeRoleWithWebIdentity"
effect = "Allow"
actions = ["sts:AssumeRoleWithWebIdentity"]

principals {
type = "Federated"
identifiers = [
aws_iam_openid_connect_provider.github.arn
]
}

condition {
test = "StringLike"
variable = "token.actions.githubusercontent.com:sub"
values = ["repo:${var.github_org}/${var.regression_repo}:*"]
}

condition {
test = "StringEquals"
variable = "token.actions.githubusercontent.com:aud"
values = ["sts.amazonaws.com"]
}
}
}

# Attach the policies to the role
resource "aws_iam_role_policy_attachment" "api_infrastructure" {
role = aws_iam_role.github_actions.name
Expand Down Expand Up @@ -885,3 +1026,13 @@ resource "aws_iam_role_policy_attachment" "cloudwatch_management" {
role = aws_iam_role.github_actions.name
policy_arn = aws_iam_policy.cloudwatch_management.arn
}

resource "aws_iam_role_policy_attachment" "regression_test_permissions" {
role = aws_iam_role.regression_test_role.name
policy_arn = aws_iam_policy.regression_test_permissions.arn
}

resource "aws_iam_role_policy_attachment" "regression_security_management" {
role = aws_iam_role.regression_test_role.name
policy_arn = aws_iam_policy.security_management.arn
Comment thread
eddalmond1 marked this conversation as resolved.
}
17 changes: 17 additions & 0 deletions infrastructure/stacks/iams-developer-roles/github_actions_role.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,3 +107,20 @@ data "aws_iam_policy_document" "github_actions_iam_bootstrap_assume_role" {
}
}
}

resource "aws_iam_role" "regression_test_role" {
name = "Eligibility-API-E2E-Regression-Tests"
description = "Role for regression testing"
permissions_boundary = aws_iam_policy.permissions_boundary.arn
path = "/service-roles/"

# Trust policy allowing GitHub Actions to assume the role
assume_role_policy = data.aws_iam_policy_document.regression_repo_assume_role.json

tags = merge(
local.tags,
{
Name = "Eligibility-API-E2E-Regression-Tests"
}
)
}
6 changes: 6 additions & 0 deletions infrastructure/stacks/iams-developer-roles/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,3 +9,9 @@ variable "github_repo" {
description = "GitHub repository"
type = string
}

variable "regression_repo" {
default = "eligibility-signposting-api-regression-tests"
description = "GitHub repository"
type = string
}
Loading