⚠ This page is served via a proxy. Original site: https://github.com
This service does not collect credentials or authentication data.
Skip to content

NRL-1938 Add CI policies to mgmt account #1141

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mattdean3-nhs wants to merge 4 commits into
base: develop
Choose a base branch
from
Open

NRL-1938 Add CI policies to mgmt account #1141

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
e7b9d6a
[NRL-1938] WIP - Move NRLF-CI policies to acc-wide mgmt TF
mattdean3-nhs Feb 10, 2026
ecd80a8
[NRL-1938] Port CI policies over from NRLF-CI repo
mattdean3-nhs Feb 10, 2026
9f97bc7
[NRL-1938] Lockdown codebuild ECR perms. Rename ci-data bucket
mattdean3-nhs Feb 10, 2026
cff34d3
[NRL-1938] Add HTTPSOnly to policy for new ci-data bucket
mattdean3-nhs Feb 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions .github/workflows/deploy-account-wide-infra.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,9 +88,9 @@ jobs:
run: |
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} show -no-color tfplan > terraform/account-wide-infrastructure/$ACCOUNT_NAME/tfplan.txt

aws s3 cp terraform/account-wide-infrastructure/$ACCOUNT_NAME/tfplan s3://nhsd-nrlf--mgmt--github-ci-logging/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan
aws s3 cp terraform/account-wide-infrastructure/$ACCOUNT_NAME/tfplan.txt s3://nhsd-nrlf--mgmt--github-ci-logging/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan.txt
aws s3 cp terraform/account-wide-infrastructure/modules/glue/files/src.zip s3://nhsd-nrlf--mgmt--github-ci-logging/acc-$ACCOUNT_NAME/${{ github.run_id }}/glue-src.zip
aws s3 cp terraform/account-wide-infrastructure/$ACCOUNT_NAME/tfplan s3://nhsd-nrlf--mgmt--github-ci-data/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan
aws s3 cp terraform/account-wide-infrastructure/$ACCOUNT_NAME/tfplan.txt s3://nhsd-nrlf--mgmt--github-ci-data/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan.txt
aws s3 cp terraform/account-wide-infrastructure/modules/glue/files/src.zip s3://nhsd-nrlf--mgmt--github-ci-data/acc-$ACCOUNT_NAME/${{ github.run_id }}/glue-src.zip

terraform-apply:
name: Terraform Apply - ${{ inputs.environment }}
Expand Down Expand Up @@ -120,11 +120,11 @@ jobs:
env:
ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
run: |
aws s3 cp s3://nhsd-nrlf--mgmt--github-ci-logging/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan terraform/account-wide-infrastructure/${ACCOUNT_NAME}/tfplan
aws s3 cp s3://nhsd-nrlf--mgmt--github-ci-logging/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan.txt terraform/account-wide-infrastructure/${ACCOUNT_NAME}/tfplan.txt
aws s3 cp s3://nhsd-nrlf--mgmt--github-ci-data/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan terraform/account-wide-infrastructure/${ACCOUNT_NAME}/tfplan
aws s3 cp s3://nhsd-nrlf--mgmt--github-ci-data/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan.txt terraform/account-wide-infrastructure/${ACCOUNT_NAME}/tfplan.txt

mkdir -p terraform/account-wide-infrastructure/modules/glue/files
aws s3 cp s3://nhsd-nrlf--mgmt--github-ci-logging/acc-$ACCOUNT_NAME/${{ github.run_id }}/glue-src.zip terraform/account-wide-infrastructure/modules/glue/files/src.zip
aws s3 cp s3://nhsd-nrlf--mgmt--github-ci-data/acc-$ACCOUNT_NAME/${{ github.run_id }}/glue-src.zip terraform/account-wide-infrastructure/modules/glue/files/src.zip

- name: Retrieve Server Certificates
env:
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/persistent-environment.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,8 +143,8 @@ jobs:
ENVIRONMENT: ${{ inputs.environment }}
run: |
terraform -chdir=terraform/infrastructure show -no-color tfplan > terraform/infrastructure/tfplan.txt
aws s3 cp terraform/infrastructure/tfplan s3://nhsd-nrlf--mgmt--github-ci-logging/$ENVIRONMENT/${{ github.run_id }}/tfplan
aws s3 cp terraform/infrastructure/tfplan.txt s3://nhsd-nrlf--mgmt--github-ci-logging/$ENVIRONMENT/${{ github.run_id }}/tfplan.txt
aws s3 cp terraform/infrastructure/tfplan s3://nhsd-nrlf--mgmt--github-ci-data/$ENVIRONMENT/${{ github.run_id }}/tfplan
aws s3 cp terraform/infrastructure/tfplan.txt s3://nhsd-nrlf--mgmt--github-ci-data/$ENVIRONMENT/${{ github.run_id }}/tfplan.txt

terraform-apply:
name: Terraform Apply - ${{ inputs.environment }}
Expand Down Expand Up @@ -186,7 +186,7 @@ jobs:
- name: Download Terraform Plan artifact
env:
ENVIRONMENT: ${{ inputs.environment }}
run: aws s3 cp s3://nhsd-nrlf--mgmt--github-ci-logging/$ENVIRONMENT/${{ github.run_id }}/tfplan terraform/infrastructure/tfplan
run: aws s3 cp s3://nhsd-nrlf--mgmt--github-ci-data/$ENVIRONMENT/${{ github.run_id }}/tfplan terraform/infrastructure/tfplan

- name: Retrieve Server Certificates
env:
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/update-lambda-permissions.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,8 +220,8 @@ jobs:
ENVIRONMENT: ${{ inputs.environment }}
run: |
terraform -chdir=terraform/infrastructure show -no-color tfplan > terraform/infrastructure/tfplan.txt
aws s3 cp terraform/infrastructure/tfplan s3://nhsd-nrlf--mgmt--github-ci-logging/$ENVIRONMENT/${{ github.run_id }}/tfplan
aws s3 cp terraform/infrastructure/tfplan.txt s3://nhsd-nrlf--mgmt--github-ci-logging/$ENVIRONMENT/${{ github.run_id }}/tfplan.txt
aws s3 cp terraform/infrastructure/tfplan s3://nhsd-nrlf--mgmt--github-ci-data/$ENVIRONMENT/${{ github.run_id }}/tfplan
aws s3 cp terraform/infrastructure/tfplan.txt s3://nhsd-nrlf--mgmt--github-ci-data/$ENVIRONMENT/${{ github.run_id }}/tfplan.txt

terraform-apply:
name: Apply permissions
Expand Down Expand Up @@ -265,7 +265,7 @@ jobs:
- name: Download Terraform Plan artifact
env:
ENVIRONMENT: ${{ inputs.environment }}
run: aws s3 cp s3://nhsd-nrlf--mgmt--github-ci-logging/$ENVIRONMENT/${{ github.run_id }}/tfplan terraform/infrastructure/tfplan
run: aws s3 cp s3://nhsd-nrlf--mgmt--github-ci-data/$ENVIRONMENT/${{ github.run_id }}/tfplan terraform/infrastructure/tfplan

- name: Terraform Init
env:
Expand Down
4 changes: 3 additions & 1 deletion terraform/account-wide-infrastructure/mgmt/codebuild.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,9 @@ data "aws_iam_policy_document" "codebuild_policy" {
statement {
effect = "Allow"
actions = [
"ecr:*"
"ecr:GetDownloadUrlForLayer",
"ecr:BatchGetImage",
"ecr:BatchCheckLayerAvailability"
]
resources = [
"${aws_ecr_repository.repository.arn}",
Expand Down
8 changes: 4 additions & 4 deletions terraform/account-wide-infrastructure/mgmt/data.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,6 @@ data "aws_s3_bucket" "terraform_state" {
bucket = "${local.project}--terraform-state"
}

data "aws_s3_bucket" "ci_logging" {
bucket = "${local.project}--mgmt--github-ci-logging"
}

data "aws_s3_bucket" "truststore" {
bucket = "${local.project}--truststore"
}
Expand Down Expand Up @@ -53,3 +49,7 @@ data "aws_secretsmanager_secret_version" "test_backup_account_id" {
data "aws_secretsmanager_secret_version" "test_restore_account_id" {
secret_id = data.aws_secretsmanager_secret.test_restore_account_id.name
}

data "aws_secretsmanager_secret_version" "prod_account_id" {
secret_id = data.aws_secretsmanager_secret.prod_account_id.name
}
110 changes: 0 additions & 110 deletions terraform/account-wide-infrastructure/mgmt/iam.tf
View file
Open in desktop

This file was deleted.

117 changes: 117 additions & 0 deletions terraform/account-wide-infrastructure/mgmt/iam_developer.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,117 @@
resource "aws_iam_policy" "developer_policy" {
name = "${local.prefix}--developer-policy"

policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Action = [
"s3:PutObject",
"s3:DeleteObject",
"s3:GetObject",
"dynamodb:PutItem",
"dynamodb:GetItem",
"dynamodb:DeleteItem",
"s3:ListBucket"
]
Effect = "Allow"
Resource = [
data.aws_dynamodb_table.terraform_state_lock.arn,
data.aws_s3_bucket.terraform_state.arn,
"${data.aws_s3_bucket.terraform_state.arn}/*"
]
},
{
Action = [
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObject"
]
Effect = "Deny"
Resource = [
"${data.aws_s3_bucket.terraform_state.arn}/${local.project}/prod/*",
"${data.aws_s3_bucket.terraform_state.arn}/${local.project}/mgmt/*",
]
},
{
Action = [
"s3:DeleteObject"
]
Effect = "Deny"
Resource = [
"${data.aws_s3_bucket.terraform_state.arn}/${local.project}/dev/*"
]
},
{
Action = "sts:AssumeRole"
Effect = "Allow"
Resource = [
"arn:aws:iam::${data.aws_secretsmanager_secret_version.dev_account_id.secret_string}:role/terraform",
"arn:aws:iam::${data.aws_secretsmanager_secret_version.test_account_id.secret_string}:role/terraform",
"arn:aws:iam::${data.aws_secretsmanager_secret_version.test_backup_account_id.secret_string}:role/terraform",
"arn:aws:iam::${data.aws_secretsmanager_secret_version.test_restore_account_id.secret_string}:role/terraform"
]
},
{
Action = [
"secretsmanager:GetResourcePolicy",
"secretsmanager:GetSecretValue",
"secretsmanager:DescribeSecret",
"secretsmanager:ListSecretVersionIds"
]
Effect = "Allow"
Resource = [
data.aws_secretsmanager_secret.dev_account_id.arn,
data.aws_secretsmanager_secret.test_account_id.arn
]
},
{
Action = [
"s3:ListAllMyBuckets"
]
Effect = "Allow"
Resource = [
"arn:aws:s3:::*"
]
},
{
Action = [
"s3:GetObject",
"s3:ListBucket"
]
Effect = "Allow"
Resource = [
aws_s3_bucket.ci_data.arn,
"${aws_s3_bucket.ci_data.arn}/*"
]
},
{
Action = [
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObject"
]
Effect = "Deny"
Resource = [
"${data.aws_s3_bucket.truststore.arn}/ca/prod*",
"${data.aws_s3_bucket.truststore.arn}/client/prod*",
"${data.aws_s3_bucket.truststore.arn}/server/prod*"
]
},
{
Action = [
"s3:GetObject"
]
Effect = "Allow"
Resource = [
"${data.aws_s3_bucket.truststore.arn}/*"
]
}
]
})
}

resource "aws_iam_role_policy_attachment" "developer_policy_attachment" {
role = var.developer_role_name
policy_arn = aws_iam_policy.developer_policy.arn
}
Loading