initial commit of replacement infrastructure automation
[awsible] / infrastructure / modules / management-stack / iam.tf
1 data "aws_iam_policy_document" "instance_trust" {
2 statement {
3 effect = "Allow"
4 actions = [
5 "sts:AssumeRole"
6 ]
7 principals {
8 type = "Service"
9 identifiers = [
10 "ec2.amazonaws.com"
11 ]
12 }
13 }
14 }
15
16 resource "aws_iam_role" "management" {
17 name = "${var.management_service_name}-role"
18 assume_role_policy = "${data.aws_iam_policy_document.instance_trust.json}"
19 }
20
21 data "aws_iam_policy_document" "management" {
22 statement {
23 sid = "AWSControl"
24 actions = [
25 "autoscaling:*",
26 "ec2:*",
27 "elasticloadbalancing:*",
28 "iam:PassRole",
29 "iam:GetServerCertificate"
30 ]
31 resources = [
32 "*"
33 ]
34 }
35 statement {
36 sid = "EventQueue"
37 actions = [
38 "sqs:*"
39 ]
40 resources = [ "${aws_sqs_queue.management-events-queue.arn}" ]
41 }
42 statement {
43 sid = "AlertTopic"
44 actions = [
45 "sns:*"
46 ]
47 resources = [ "${aws_sns_topic.management-events.arn}" ]
48 }
49 }
50
51 resource "aws_iam_policy" "management" {
52 name = "${var.management_service_name}"
53 description = "${var.management_service_name}"
54 path = "/"
55 policy = "${data.aws_iam_policy_document.management.json}"
56 }
57
58 resource "aws_iam_role_policy_attachment" "management" {
59 role = "${aws_iam_role.management.id}"
60 policy_arn = "${aws_iam_policy.management.arn}"
61 }
62
63 resource "aws_iam_instance_profile" "management" {
64 name = "${var.management_service_name}-instance-profile"
65 role = "${aws_iam_role.management.name}"
66 }