Merge back to stsci - IGNORE THIS

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "aws-codecommit-secret"]
+	path = aws-codecommit-secret
+	url = https://github.com/yuvipanda/aws-codecommit-secret.git

aws-creds/iam.tf

@@ -3,6 +3,24 @@
 # https://github.com/terraform-aws-modules/terraform-aws-eks/blob/master/docs/iam-permissions.md
 # Here are a few implementations
 
+terraform {
+  required_version = ">= 0.12.6"
+}
+
+provider "aws" {
+  version = ">= 2.28.1"
+  region  = var.region
+}
+
+variable "region" {
+  type = string
+  default = "us-east-1"
+}
+
+variable "iam_prefix" {
+  type = string
+  default = ""
+}
 
 # Create a new user named terraform-bot
 # Create policy in IAM and attach to terraform-bot
@@ -14,17 +32,17 @@
 #  name = "terraform-bot"
 #}
 
-#resource "aws_iam_policy" "terraform_iam_policy" {
+# resource "aws_iam_policy" "terraform_iam_policy" {
 #    name = "terraform-policy"
 #    path = "/"
 #    description = "Permissions for Terraform-controlled EKS cluster creation and management"
 #    policy = data.aws_iam_policy_document.terraform_iam_policy_source.json
-#}
+# }
 
-#resource "aws_iam_user_policy_attachment" "attach-terraform-permissions" {
+# resource "aws_iam_user_policy_attachment" "attach-terraform-permissions" {
 #  user        = aws_iam_user.user.name
 #  policy_arn  = aws_iam_policy.terraform_iam_policy.arn
-#}
+# }
 
 
 # Create a role with the policy json
@@ -33,24 +51,31 @@
 # Probably want to make a standalone user like above
 # Probably not recommended
 
-#resource "aws_iam_role" "terraform_role" {
+# resource "aws_iam_role" "terraform_role" {
 #  name = "terraform-deployment-role"
 #  path = "/"
 #  assume_role_policy = data.aws_iam_policy_document.terraform_iam_policy_source.json
-#}
+# }
 
 
 # Create the policy in IAM
 # Attach the policy to the default awscli configuration profile
 # Will leave the policy on the user EVEN AFTER finishing the terraform configuration
 # For this reason, I think this is not recommended
 
-#resource "aws_iam_policy" "terraform_iam_policy" {
-#    name = "terraform-policy"
-#    path = "/"
-#    description = "Permissions for Terraform-controlled EKS cluster creation and management"
-#    policy = data.aws_iam_policy_document.terraform_iam_policy_source.json
-#}
+resource "aws_iam_policy" "terraform_iam_policy" {
+   name = "${var.iam_prefix}terraform-policy"
+   path = "/"
+   description = "Permissions for Terraform-controlled EKS cluster creation and management"
+   policy = data.aws_iam_policy_document.terraform_iam_policy_source.json
+}
+
+resource "aws_iam_policy" "terraform_iam_write_policy" {
+   name = "${var.iam_prefix}terraform-write-policy"
+   path = "/"
+   description = "Permissions for Terraform-controlled EKS cluster creation and management"
+   policy = data.aws_iam_policy_document.terraform_iam_write_policy_source.json
+}
 
 #resource "aws_iam_user_policy_attachment" "attach-terraform-permissions" {
 #  user        = split("/", data.aws_caller_identity.current.arn)[1]
@@ -59,6 +84,52 @@
 
 #data "aws_caller_identity" "current" {}
 
+resource "aws_iam_role" "terraform_architect_iam_role" {
+  name = "${var.iam_prefix}terraform-architect"
+  path = "/"
+  assume_role_policy = data.aws_iam_policy_document.terraform_user_assume_policy.json
+}
+
+resource "aws_iam_role_policy_attachment" "attach_iam"{
+  role = aws_iam_role.terraform_architect_iam_role.name
+  policy_arn = aws_iam_policy.terraform_iam_policy.arn
+}
+
+resource "aws_iam_role_policy_attachment" "attach_iam_write"{
+  role = aws_iam_role.terraform_architect_iam_role.name
+  policy_arn = aws_iam_policy.terraform_iam_write_policy.arn
+}
+
+resource "aws_iam_group" "terraform_architects_iam_group" {
+  name = "${var.iam_prefix}terraform-architects"
+  path = "/"
+}
+
+resource "aws_iam_policy" "terraform_assume_iam_policy" {
+  name = "${var.iam_prefix}terraform-assume-deployment-role"
+  policy = data.aws_iam_policy_document.terraform_iam_assume_policy_source.json
+}
+
+resource "aws_iam_group_policy_attachment" "terraform_architects" {
+  group = aws_iam_group.terraform_architects_iam_group.name
+  policy_arn = aws_iam_policy.terraform_assume_iam_policy.arn 
+}
+
+# This is the data for the policy to allow a user to assume the role to create an eks cluster
+data "aws_iam_policy_document" "terraform_iam_assume_policy_source" {
+  version = "2012-10-17"
+  statement {
+    sid   = "VisualEditor0"
+
+    effect = "Allow"
+
+    actions = ["sts:AssumeRole"]
+
+    resources = [aws_iam_role.terraform_architect_iam_role.arn]  
+  }
+}
+
+data "aws_caller_identity" "current" {}
 
 # This is the data for the policy needed to run terraform to create an eks cluster
 data "aws_iam_policy_document" "terraform_iam_policy_source" {
@@ -137,41 +208,86 @@ data "aws_iam_policy_document" "terraform_iam_policy_source" {
       "ec2:GetLaunchTemplateData",
       "ec2:ModifyLaunchTemplate",
       "ec2:RunInstances",
+      "ecr:CreateRepository",
+      "ecr:DescribeRepositories",
+      "ecr:*",
+      "elasticfilesystem:*",
       "eks:CreateCluster",
       "eks:DeleteCluster",
       "eks:DescribeCluster",
       "eks:ListClusters",
       "eks:UpdateClusterConfig",
       "eks:DescribeUpdate",
+      "eks:*",
+      "iam:GetInstanceProfile",
+      "iam:GetOpenIDConnectProvider",
+      "iam:GetPolicy",
+      "iam:GetPolicyVersion",
+      "iam:GetRole",
+      "iam:GetRolePolicy",
+      "iam:List*",
+      "iam:TagRole",
+    ]
+
+    resources = ["*"]
+  }
+}
+
+data "aws_iam_policy_document" "terraform_iam_write_policy_source" {
+	version = "2012-10-17"
+
+  statement {
+    sid     = "VisualEditor0"
+
+    effect  = "Allow"
+
+    actions = [
       "iam:AddRoleToInstanceProfile",
       "iam:AttachRolePolicy",
+      "iam:CreateGroup",
       "iam:CreateInstanceProfile",
-  	  "iam:CreateOpenIDConnectProvider",
+      "iam:CreateOpenIDConnectProvider",
       "iam:CreateServiceLinkedRole",
       "iam:CreatePolicy",
       "iam:CreatePolicyVersion",
       "iam:CreateRole",
+      "iam:DeleteAccessKey",
       "iam:DeleteInstanceProfile",
-		  "iam:DeleteOpenIDConnectProvider",
+      "iam:DeleteOpenIDConnectProvider",
       "iam:DeletePolicy",
+      "iam:DeletePolicyVersion",
       "iam:DeleteRole",
       "iam:DeleteRolePolicy",
       "iam:DeleteServiceLinkedRole",
+      "iam:DetachGroupPolicy",
       "iam:DetachRolePolicy",
-      "iam:GetInstanceProfile",
-		  "iam:GetOpenIDConnectProvider",
-      "iam:GetPolicy",
-      "iam:GetPolicyVersion",
-      "iam:GetRole",
-      "iam:GetRolePolicy",
-      "iam:List*",
       "iam:PassRole",
       "iam:PutRolePolicy",
       "iam:RemoveRoleFromInstanceProfile",
-      "iam:TagRole",
-      "iam:UpdateAssumeRolePolicy"
+      "iam:UpdateAssumeRolePolicy",
+      "iam:CreateGroup",
+      "iam:AddUserToGroup",
+      "iam:DeleteGroup",
+      "iam:AttachGroupPolicy",
+      "iam:DeleteUser",
+      "iam:GetGroupPolicy",
+      "iam:GetUser",
+      "iam:CreateUser",
+      "iam:GetGroup",
+      "iam:CreateAccessKey",
     ]
-
     resources = ["*"]
   }
-} 
+}
+
+data "aws_iam_policy_document" "terraform_user_assume_policy" {
+  version = "2012-10-17"
+  statement {
+      effect = "Allow"
+      principals {
+        type = "AWS"
+        identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
+      }
+      actions = ["sts:AssumeRole"]
+  }
+}

aws/autoscaler.tf

@@ -7,7 +7,7 @@ module "iam_assumable_role_admin" {
   source                        = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
   version                       = "~> v2.6.0"
   create_role                   = true
-  role_name                     = "cluster-autoscaler"
+  role_name                     = "${module.eks.cluster_id}-cluster-autoscaler"
   provider_url                  = replace(module.eks.cluster_oidc_issuer_url, "https://", "")
   role_policy_arns              = [aws_iam_policy.cluster_autoscaler.arn]
   oidc_fully_qualified_subjects = ["system:serviceaccount:kube-system:cluster-autoscaler-service-account"]
@@ -82,4 +82,4 @@ resource "helm_release" "cluster-autoscaler" {
     name = "autoDiscovery.clusterName"
     value = module.eks.cluster_id
   }
-}
+}

aws/ecr.tf

@@ -2,11 +2,6 @@ resource "aws_iam_user" "hubploy_ecr_user" {
   name = "${var.cluster_name}-hubploy-ecr-pusher"
 }
 
-resource "aws_iam_user_policy_attachment" "hubploy_ecr_image_pusher_policy_attachment" {
-  user = aws_iam_user.hubploy_ecr_user.name
-  policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser"
-}
-
 # FIXME: UHHHHHHHH, WHAT DOES THIS MEAN FOR OUR STATE FILES?!
 # FIXME: WE SHOULD DEFINITELY MAYBE PUT A PGP KEY IN HERE
 resource "aws_iam_access_key" "hubploy_ecr_user_secret_key" {

aws/file-output.tf

@@ -1,21 +1,3 @@
-resource "local_file" "hubploy_ecr_user_creds" {
-  filename = "aws-ecr-creds.cfg"
-  content = <<EOF
-[default]
-aws_access_key_id = ${aws_iam_access_key.hubploy_ecr_user_secret_key.id}
-aws_secret_access_key = ${aws_iam_access_key.hubploy_ecr_user_secret_key.secret}
-EOF
-}
-
-resource "local_file" "hubploy_eks_user_creds" {
-  filename = "aws-eks-creds.cfg"
-  content = <<EOF
-[default]
-aws_access_key_id = ${aws_iam_access_key.hubploy_eks_user_secret_key.id}
-aws_secret_access_key = ${aws_iam_access_key.hubploy_eks_user_secret_key.secret}
-EOF
-}
-
 resource "local_file" "hubploy_yaml" {
   filename = "hubploy.yaml"
   content = <<EOF
@@ -26,15 +8,15 @@ images:
     provider: aws
     aws:
       zone: ${var.region}
-      service_key: aws-ecr-creds.cfg
-      project: # FILL ME IN FOR NOW
+      service_key: # FIXME: Use role assumpmtions when hubploy supports them
+      project: ${data.aws_caller_identity.current.account_id}
 
 
 cluster:
   provider: aws
   aws:
       zone: ${var.region}
-      service_key: aws-eks-creds.cfg
+      service_key: # FIXME: Use role assumpmtions when hubploy supports them
       cluster: ${module.eks.cluster_id}
 EOF
 }