Skip to content

Commit c12ccfd

Browse files
VeetahaVeetaha
authored
Add missing kms permissions to ElastioAssetAccountDeployer (#108)
I forgot to add `kms` permissions to the deployer role, which are required if `encryptWithCmk` is enabled.
1 parent 2c72627 commit c12ccfd

8 files changed

Lines changed: 235 additions & 2 deletions

File tree

‎asset-account/terraform/cloudformation-stack/examples/advanced/.terraform.lock.hcl‎

Lines changed: 45 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎asset-account/terraform/cloudformation-stack/examples/advanced/main.tf‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
module "elastio_asset_account" {
2+
source = "../../"
3+
4+
template_url = var.template_url
5+
encrypt_with_cmk = true
6+
iam_role_arn = time_sleep.iam.triggers.deployer_role_arn
7+
}
8+
9+
resource "aws_iam_role" "deployer" {
10+
name = "ElastioAssetAccountDeployer"
11+
assume_role_policy = jsonencode(
12+
{
13+
"Version" : "2012-10-17",
14+
"Statement" : [
15+
{
16+
"Effect" : "Allow",
17+
"Principal" : {
18+
"Service" : "cloudformation.amazonaws.com"
19+
},
20+
"Action" : "sts:AssumeRole"
21+
}
22+
]
23+
}
24+
)
25+
}
26+
27+
resource "aws_iam_role_policy_attachment" "elastio_asset_account_deployer" {
28+
role = aws_iam_role.deployer.name
29+
policy_arn = module.elastio_policies.policies.ElastioAssetAccountDeployer.arn
30+
}
31+
32+
module "elastio_policies" {
33+
source = "../../../../../iam-policies/terraform"
34+
policies = ["ElastioAssetAccountDeployer"]
35+
}
36+
37+
# Wait for the IAM role and policies to propagate
38+
resource "time_sleep" "iam" {
39+
create_duration = "20s"
40+
41+
depends_on = [aws_iam_role_policy_attachment.elastio_asset_account_deployer]
42+
43+
triggers = {
44+
deployer_role_arn = aws_iam_role.deployer.arn
45+
}
46+
}

‎asset-account/terraform/cloudformation-stack/examples/advanced/variables.tf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
variable "template_url" {
2+
description = <<-DESCR
3+
The URL of the Elastio Asset Account CloudFormation template obtained from
4+
the Elastio Portal.
5+
6+
This parameter is sensitive, because anyone who knows this URL can deploy
7+
Elastio Account stack and linking it to your Elastio tenant.
8+
DESCR
9+
10+
sensitive = true
11+
type = string
12+
nullable = false
13+
}

‎asset-account/terraform/cloudformation-stack/examples/advanced/versions.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
terraform {
2+
required_version = "~> 1.0"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = "~> 5.0"
8+
}
9+
time = {
10+
source = "hashicorp/time"
11+
version = "~> 0.13"
12+
}
13+
}
14+
}

‎codegen/src/policies/ElastioAssetAccountDeployer.ts‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,5 +101,61 @@ export default {
101101
Action: "iam:PassRole",
102102
Resource: ["arn:*:iam::*:role/*Elastio*"],
103103
},
104+
105+
{
106+
Sid: "ElastioKmsRead",
107+
Action: [
108+
"kms:DescribeKey",
109+
"kms:GetKeyPolicy",
110+
"kms:GetKeyRotationStatus",
111+
"kms:ListResourceTags",
112+
],
113+
Resource: "*",
114+
},
115+
116+
{
117+
Sid: "ElastioKmsCreate",
118+
Action: ["kms:CreateKey"],
119+
Resource: "*",
120+
Condition: iam.hasRequestTag("elastio:resource"),
121+
},
122+
123+
{
124+
Sid: "ElastioKmsWrite",
125+
Action: [
126+
"kms:PutKeyPolicy",
127+
"kms:ScheduleKeyDeletion",
128+
"kms:EnableKeyRotation",
129+
"kms:DisableKeyRotation",
130+
131+
"kms:TagResource",
132+
"kms:UntagResource",
133+
134+
// Data-level KMS operations are required for example to encrypt/decrypt
135+
// lambda env vars for lambda deployed as part of the Asset Account stack.
136+
"kms:Decrypt",
137+
"kms:Encrypt",
138+
"kms:GenerateDataKey",
139+
"kms:CreateGrant",
140+
],
141+
Resource: "*",
142+
Condition: iam.hasResourceTag("elastio:resource"),
143+
},
144+
145+
// For KMS aliases we need separate permissions for the alias resource
146+
// restricting it with the `elastio-` prefix.
147+
{
148+
Action: ["kms:CreateAlias", "kms:DeleteAlias", "kms:UpdateAlias"],
149+
Resource: [`arn:aws:kms:*:*:alias/elastio-*`],
150+
},
151+
152+
// Aliases require the same permissions both on the alias resource and on
153+
// the KMS key resource. This is separate statement to use a condition
154+
// by `elastio:resource` tag.
155+
{
156+
Action: ["kms:CreateAlias", "kms:DeleteAlias", "kms:UpdateAlias"],
157+
Resource: [`arn:aws:kms:*:*:key/*`],
158+
Condition: iam.hasResourceTag("elastio:resource"),
159+
},
104160
],
105161
} satisfies iam.Policy;

‎iam-policies/terraform/.module.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,4 @@
22
name = "aws-elastio-iam-policies"
33
description = "A collection of AWS IAM policies for use with Elastio"
44
type = "terraform"
5-
version = "0.33.1"
5+
version = "0.33.2"

‎iam-policies/terraform/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ This Terraform module deploys additional Elastio IAM managed policies that you c
99
```tf
1010
module "elastio_policies" {
1111
source = "terraform.cloudsmith.io/public/elastio-iam-policies/aws"
12-
version = "0.33.1"
12+
version = "0.33.2"
1313
1414
// Provide input parameters
1515
}

‎iam-policies/terraform/policies/ElastioAssetAccountDeployer.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,65 @@
7878
"Action": "iam:PassRole",
7979
"Resource": ["arn:*:iam::*:role/*Elastio*"],
8080
"Effect": "Allow"
81+
},
82+
{
83+
"Sid": "ElastioKmsRead",
84+
"Action": [
85+
"kms:DescribeKey",
86+
"kms:GetKeyPolicy",
87+
"kms:GetKeyRotationStatus",
88+
"kms:ListResourceTags"
89+
],
90+
"Resource": "*",
91+
"Effect": "Allow"
92+
},
93+
{
94+
"Sid": "ElastioKmsCreate",
95+
"Action": ["kms:CreateKey"],
96+
"Resource": "*",
97+
"Condition": {
98+
"StringLike": {
99+
"aws:RequestTag/elastio:resource": "*"
100+
}
101+
},
102+
"Effect": "Allow"
103+
},
104+
{
105+
"Sid": "ElastioKmsWrite",
106+
"Action": [
107+
"kms:PutKeyPolicy",
108+
"kms:ScheduleKeyDeletion",
109+
"kms:EnableKeyRotation",
110+
"kms:DisableKeyRotation",
111+
"kms:TagResource",
112+
"kms:UntagResource",
113+
"kms:Decrypt",
114+
"kms:Encrypt",
115+
"kms:GenerateDataKey",
116+
"kms:CreateGrant"
117+
],
118+
"Resource": "*",
119+
"Condition": {
120+
"StringLike": {
121+
"aws:ResourceTag/elastio:resource": "*"
122+
}
123+
},
124+
"Effect": "Allow"
125+
},
126+
{
127+
"Action": ["kms:CreateAlias", "kms:DeleteAlias", "kms:UpdateAlias"],
128+
"Resource": ["arn:aws:kms:*:*:alias/elastio-*"],
129+
"Effect": "Allow"
130+
},
131+
{
132+
"Action": ["kms:CreateAlias", "kms:DeleteAlias", "kms:UpdateAlias"],
133+
"Resource": ["arn:aws:kms:*:*:key/*"],
134+
"Condition": {
135+
"StringLike": {
136+
"aws:ResourceTag/elastio:resource": "*"
137+
}
138+
},
139+
"Effect": "Allow"
81140
}
82141
]
83142
}

0 commit comments

Comments
 (0)