git.squeep.com Git - awsible/blob - infrastructure/modules/management-stack/iam.tf

   1 data "aws_iam_policy_document" "instance_trust" {
   2         statement {
   3                 effect = "Allow"
   4                 actions = [
   5                         "sts:AssumeRole"
   6                 ]
   7                 principals {
   8                         type = "Service"
   9                         identifiers = [
  10                                 "ec2.amazonaws.com"
  11                         ]
  12                 }
  13         }
  14 }
  15
  16 resource "aws_iam_role" "management" {
  17         name = "${var.management_service_name}-role"
  18         assume_role_policy = "${data.aws_iam_policy_document.instance_trust.json}"
  19 }
  20
  21 data "aws_iam_policy_document" "management" {
  22         statement {
  23                 sid = "AWSControl"
  24                 actions = [
  25                         "autoscaling:*",
  26                         "ec2:*",
  27                         "elasticloadbalancing:*",
  28                         "iam:PassRole",
  29                         "iam:GetServerCertificate"
  30                 ]
  31                 resources = [
  32                         "*"
  33                 ]
  34         }
  35         statement {
  36                 sid = "EventQueue"
  37                 actions = [
  38                         "sqs:*"
  39                 ]
  40                 resources = [ "${aws_sqs_queue.management-events-queue.arn}" ]
  41         }
  42         statement {
  43                 sid = "AlertTopic"
  44                 actions = [
  45                         "sns:*"
  46                 ]
  47                 resources = [ "${aws_sns_topic.management-events.arn}" ]
  48         }
  49 }
  50
  51 resource "aws_iam_policy" "management" {
  52         name = "${var.management_service_name}"
  53         description = "${var.management_service_name}"
  54         path = "/"
  55         policy = "${data.aws_iam_policy_document.management.json}"
  56 }
  57
  58 resource "aws_iam_role_policy_attachment" "management" {
  59         role = "${aws_iam_role.management.id}"
  60         policy_arn = "${aws_iam_policy.management.arn}"
  61 }
  62
  63 resource "aws_iam_instance_profile" "management" {
  64         name = "${var.management_service_name}-instance-profile"
  65         role = "${aws_iam_role.management.name}"
  66 }