Skip to content

Commit eac53e5

Browse files
hadiqurhadiqur
authored
Merge pull request #78 from ONS-Innovation/KEH-2171-Assume-Service-Role-SSO
KEH-2171: Assume Service Role via SSO
2 parents dd72eb2 + 29363b8 commit eac53e5

4 files changed

Lines changed: 61 additions & 95 deletions

File tree

‎README.md‎

Lines changed: 42 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -95,23 +95,39 @@ To run the Lambda function outside of a container, we need to execute the `handl
9595

9696
**Please Note:** If uncommenting the above in `main.py`, make sure you re-comment the code _before_ pushing back to GitHub.
9797

98-
2. Export the required environment variables:
98+
2. Sign in with AWS SSO, and export the correct profile for this service:
9999

100-
```bash
101-
export AWS_ACCESS_KEY_ID=<aws_access_key_id>
102-
export AWS_SECRET_ACCESS_KEY=<aws_secret_access_key>
103-
export AWS_DEFAULT_REGION=eu-west-2
104-
export AWS_SECRET_NAME=<aws_secret_name>
105-
export GITHUB_ORG=ONSDigital
106-
export GITHUB_APP_CLIENT_ID=<github_app_client_id>
107-
export AWS_ACCOUNT_NAME=<sdp-dev/sdp-prod>
108-
```
100+
```bash
101+
aws sso login
109102

110-
3. Run the script.
103+
export AWS_PROFILE=github-copilot-usage-lambda
104+
```
111105

112-
```bash
113-
python3 src/main.py
114-
```
106+
This allows you to assume the AWS IAM role for the service, enabling the most secure development experience. This also means you will have limited permissions until you exit out of the profile.
107+
108+
**Note:** See the Developer Onboarding Guide on the "Using AWS SSO for Local Development" page on Confluence to set up service profile selection on your local machine.
109+
110+
3. Export the required environment variables:
111+
112+
```bash
113+
export AWS_DEFAULT_REGION=eu-west-2
114+
export AWS_SECRET_NAME=<aws_secret_name>
115+
export AWS_ACCOUNT_NAME=<sdp-dev/sdp-prod>
116+
export GITHUB_ORG=ONSDigital
117+
export GITHUB_APP_CLIENT_ID=<github_app_client_id>
118+
```
119+
120+
4. Run the script.
121+
122+
```bash
123+
python3 src/main.py
124+
```
125+
126+
5. To exit the profile:
127+
128+
```bash
129+
unset AWS_PROFILE
130+
```
115131

116132
### Running in a container
117133

@@ -133,14 +149,20 @@ To run the Lambda function outside of a container, we need to execute the `handl
133149
| --------------------------- | ------ | ------------ | -------------- | ----- |
134150
| copilot-usage-lambda-script | latest | 0bbe73d9256f | 11 seconds ago | 224MB |
135151

136-
3. Run the image locally mapping local host port (9000) to container port (8080) and passing in AWS credentials to download a .pem file from the AWS Secrets Manager to the running container. These credentials will also be used to upload and download `historic_usage_data.json` to and from S3.
152+
3. Sign in with AWS SSO:
153+
154+
```bash
155+
aws sso login
156+
```
157+
158+
**Note:** See the Developer Onboarding Guide on the "Using AWS SSO for Local Development" page on Confluence to set up service profile selection on your local machine. This is essential as the `~/.aws` directory is mounted to the container, so it can use the SSO session for AWS authentication.
137159

138-
The credentials used in the below command are for a user in AWS that has permissions to retrieve secrets from AWS Secrets Manager and upload and download files from AWS S3.
160+
4. Run the image locally mapping local host port (9000) to container port (8080).
139161

140162
```bash
141163
docker run --platform linux/amd64 -p 9000:8080 \
142-
-e AWS_ACCESS_KEY_ID=<aws_access_key_id> \
143-
-e AWS_SECRET_ACCESS_KEY=<aws_secret_access_key> \
164+
-v ~/.aws:/root/.aws \
165+
-e AWS_PROFILE=github-copilot-usage-lambda \
144166
-e AWS_DEFAULT_REGION=eu-west-2 \
145167
-e AWS_SECRET_NAME=<aws_secret_name> \
146168
-e GITHUB_ORG=ONSDigital \
@@ -151,15 +173,15 @@ To run the Lambda function outside of a container, we need to execute the `handl
151173

152174
Once the container is running, a local endpoint is created at `localhost:9000/2015-03-31/functions/function/invocations`.
153175

154-
4. Post to the endpoint to trigger the function
176+
5. Post to the endpoint to trigger the function
155177

156178
```bash
157179
curl "http://localhost:9000/2015-03-31/functions/function/invocations" -d '{}'
158180
```
159181

160182
This should return a message if successful.
161183

162-
5. Once testing is finished, stop the running container
184+
6. Once testing is finished, stop the running container
163185

164186
To check the container is running
165187

‎poetry.lock‎

Lines changed: 5 additions & 5 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎terraform/main.tf‎

Lines changed: 14 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,20 @@ resource "aws_iam_role" "lambda_function_role" {
7373
Principal = {
7474
Service = "lambda.amazonaws.com"
7575
}
76+
},
77+
{
78+
Action = "sts:AssumeRole"
79+
Effect = "Allow"
80+
Principal = {
81+
AWS = "arn:aws:iam::${var.aws_account_id}:root"
82+
}
83+
Condition = {
84+
ArnLike = {
85+
"aws:PrincipalArn" = [
86+
"arn:aws:iam::${var.aws_account_id}:role/aws-reserved/sso.amazonaws.com/eu-west-2/AWSReservedSSO_Standard_Administrator_Access_*"
87+
]
88+
}
89+
}
7690
}
7791
]
7892
})
@@ -138,59 +152,3 @@ resource "aws_cloudwatch_log_group" "loggroup" {
138152
name = "/aws/lambda/${aws_lambda_function.lambda_function.function_name}"
139153
retention_in_days = var.log_retention_days
140154
}
141-
142-
# IAM User Group
143-
resource "aws_iam_group" "group" {
144-
name = "${var.env_name}-${var.lambda_name}-user-group"
145-
path = "/"
146-
}
147-
148-
resource "aws_iam_group_policy_attachment" "group_vpc_permissions_attachment" {
149-
group = aws_iam_group.group.name
150-
policy_arn = aws_iam_policy.vpc_permissions.arn
151-
}
152-
153-
resource "aws_iam_group_policy_attachment" "group_lambda_logging_attachment" {
154-
group = aws_iam_group.group.name
155-
policy_arn = aws_iam_policy.lambda_logging.arn
156-
}
157-
158-
resource "aws_iam_group_policy_attachment" "group_lambda_s3_policy_attachment" {
159-
group = aws_iam_group.group.name
160-
policy_arn = aws_iam_policy.lambda_s3_policy.arn
161-
}
162-
163-
resource "aws_iam_group_policy_attachment" "group_lambda_secret_manager_policy_attachment" {
164-
group = aws_iam_group.group.name
165-
policy_arn = aws_iam_policy.lambda_secret_manager_policy.arn
166-
}
167-
168-
resource "aws_iam_group_policy_attachment" "group_lambda_eventbridge_policy_attachment" {
169-
group = aws_iam_group.group.name
170-
policy_arn = aws_iam_policy.lambda_eventbridge_policy.arn
171-
}
172-
173-
# IAM User
174-
resource "aws_iam_user" "user" {
175-
name = "${var.env_name}-${var.lambda_name}"
176-
path = "/"
177-
}
178-
179-
# Assign IAM User to group
180-
resource "aws_iam_user_group_membership" "user_group_attach" {
181-
user = aws_iam_user.user.name
182-
183-
groups = [
184-
aws_iam_group.group.name
185-
]
186-
}
187-
188-
# IAM Key Rotation Module
189-
module "iam_key_rotation" {
190-
source = "git::https://github.com/ONS-Innovation/keh-aws-iam-key-rotation.git?ref=v0.1.1"
191-
192-
iam_username = aws_iam_user.user.name
193-
access_key_secret_arn = aws_secretsmanager_secret.access_key.arn
194-
secret_key_secret_arn = aws_secretsmanager_secret.secret_key.arn
195-
rotation_in_days = 45
196-
}

‎terraform/secrets.tf‎

Lines changed: 0 additions & 14 deletions
This file was deleted.

0 commit comments

Comments
 (0)