Skip to content

Commit f60f6a4

Browse files
SMillerDevSMillerDev
committed
feat: add AWS import
Issue GH-2
1 parent b662b4a commit f60f6a4

File tree

8 files changed

+257
-6
lines changed

8 files changed

+257
-6
lines changed

‎.terraform.lock.hcl

Lines changed: 17 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎aws/iam-sso.tf

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
data "aws_ssoadmin_instances" "main" {}
2+
3+
resource "aws_identitystore_group" "group" {
4+
for_each = var.teams
5+
display_name = each.key
6+
identity_store_id = tolist(data.aws_ssoadmin_instances.main.identity_store_ids)[0]
7+
}
8+
9+
resource "aws_identitystore_user" "main" {
10+
for_each = merge(nonsensitive(var.teams.PLC), nonsensitive(var.teams.Ops), nonsensitive(var.teams.Security), nonsensitive(var.teams.Analytics))
11+
identity_store_id = tolist(data.aws_ssoadmin_instances.main.identity_store_ids)[0]
12+
13+
display_name = each.key
14+
user_name = each.key
15+
nickname = each.key
16+
17+
name {
18+
given_name = each.key
19+
family_name = "Brew"
20+
}
21+
22+
emails {
23+
value = sensitive(each.value)
24+
}
25+
26+
lifecycle {
27+
ignore_changes = [name, display_name]
28+
}
29+
}
30+
31+
resource "aws_identitystore_group_membership" "plc" {
32+
for_each = nonsensitive(var.teams.PLC)
33+
34+
identity_store_id = tolist(data.aws_ssoadmin_instances.main.identity_store_ids)[0]
35+
group_id = aws_identitystore_group.group["PLC"].group_id
36+
member_id = aws_identitystore_user.main[each.key].user_id
37+
}
38+
39+
resource "aws_identitystore_group_membership" "ops" {
40+
for_each = nonsensitive(var.teams.Ops)
41+
42+
identity_store_id = tolist(data.aws_ssoadmin_instances.main.identity_store_ids)[0]
43+
group_id = aws_identitystore_group.group["Ops"].group_id
44+
member_id = aws_identitystore_user.main[each.key].user_id
45+
}
46+
47+
resource "aws_identitystore_group_membership" "security" {
48+
for_each = nonsensitive(var.teams.Security)
49+
50+
identity_store_id = tolist(data.aws_ssoadmin_instances.main.identity_store_ids)[0]
51+
group_id = aws_identitystore_group.group["Security"].group_id
52+
member_id = aws_identitystore_user.main[each.key].user_id
53+
}
54+
55+
resource "aws_identitystore_group_membership" "analytics" {
56+
for_each = nonsensitive(var.teams.Analytics)
57+
58+
identity_store_id = tolist(data.aws_ssoadmin_instances.main.identity_store_ids)[0]
59+
group_id = aws_identitystore_group.group["Analytics"].group_id
60+
member_id = aws_identitystore_user.main[each.key].user_id
61+
}
62+
63+
resource "aws_ssoadmin_permission_set" "OpsAccess" {
64+
name = "OpsAccess"
65+
description = "Access for Ops"
66+
instance_arn = tolist(data.aws_ssoadmin_instances.main.arns)[0]
67+
}
68+
resource "aws_ssoadmin_managed_policy_attachment" "OpsAccess" {
69+
depends_on = [aws_ssoadmin_account_assignment.Ops]
70+
71+
instance_arn = tolist(data.aws_ssoadmin_instances.main.arns)[0]
72+
managed_policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
73+
permission_set_arn = aws_ssoadmin_permission_set.OpsAccess.arn
74+
}
75+
76+
resource "aws_ssoadmin_permission_set" "SecurityTeam" {
77+
name = "SecurityTeam"
78+
description = "Access for the security team"
79+
instance_arn = tolist(data.aws_ssoadmin_instances.main.arns)[0]
80+
}
81+
resource "aws_ssoadmin_managed_policy_attachment" "SecurityTeam" {
82+
depends_on = [aws_ssoadmin_account_assignment.security]
83+
84+
instance_arn = tolist(data.aws_ssoadmin_instances.main.arns)[0]
85+
managed_policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
86+
permission_set_arn = aws_ssoadmin_permission_set.SecurityTeam.arn
87+
}
88+
89+
resource "aws_ssoadmin_permission_set" "Billing" {
90+
name = "Billing"
91+
description = "Access for the PLC"
92+
instance_arn = tolist(data.aws_ssoadmin_instances.main.arns)[0]
93+
}
94+
resource "aws_ssoadmin_managed_policy_attachment" "Billing" {
95+
depends_on = [aws_ssoadmin_account_assignment.billing]
96+
97+
instance_arn = tolist(data.aws_ssoadmin_instances.main.arns)[0]
98+
managed_policy_arn = "arn:aws:iam::aws:policy/job-function/Billing"
99+
permission_set_arn = aws_ssoadmin_permission_set.Billing.arn
100+
}
101+
102+
data "aws_caller_identity" "current" {}
103+
104+
resource "aws_ssoadmin_account_assignment" "billing" {
105+
instance_arn = tolist(data.aws_ssoadmin_instances.main.arns)[0]
106+
permission_set_arn = aws_ssoadmin_permission_set.Billing.arn
107+
108+
principal_id = aws_identitystore_group.group["PLC"].group_id
109+
principal_type = "GROUP"
110+
111+
target_id = data.aws_caller_identity.current.account_id
112+
target_type = "AWS_ACCOUNT"
113+
}
114+
115+
resource "aws_ssoadmin_account_assignment" "security" {
116+
instance_arn = tolist(data.aws_ssoadmin_instances.main.arns)[0]
117+
permission_set_arn = aws_ssoadmin_permission_set.SecurityTeam.arn
118+
119+
principal_id = aws_identitystore_group.group["Security"].group_id
120+
principal_type = "GROUP"
121+
122+
target_id = data.aws_caller_identity.current.account_id
123+
target_type = "AWS_ACCOUNT"
124+
}
125+
126+
resource "aws_ssoadmin_account_assignment" "Ops" {
127+
instance_arn = tolist(data.aws_ssoadmin_instances.main.arns)[0]
128+
permission_set_arn = aws_ssoadmin_permission_set.OpsAccess.arn
129+
130+
principal_id = aws_identitystore_group.group["Ops"].group_id
131+
principal_type = "GROUP"
132+
133+
target_id = data.aws_caller_identity.current.account_id
134+
target_type = "AWS_ACCOUNT"
135+
}

‎aws/main.tf

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
provider "aws" {
2+
region = "us-east-1"
3+
}
4+
5+
resource "aws_iam_openid_connect_provider" "github_actions" {
6+
url = "https://token.actions.githubusercontent.com"
7+
8+
client_id_list = ["sts.amazonaws.com"]
9+
10+
thumbprint_list = ["1c58a3a8518e8759bf075b76b750d4f2df264fcd"]
11+
}

‎aws/roles.tf

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
data "aws_iam_policy_document" "codebuild_policy_document" {
2+
statement {
3+
actions = [
4+
"s3:List*",
5+
"s3:Get*",
6+
"s3:Put*",
7+
"s3:DeleteObject",
8+
"s3:DeleteObjectVersion"
9+
]
10+
resources = [
11+
"arn:aws:s3:::homebrew-terraform-state/*",
12+
"arn:aws:s3:::homebrew-terraform-state"
13+
]
14+
effect = "Allow"
15+
}
16+
statement {
17+
effect = "Allow"
18+
actions = [
19+
"iam:*",
20+
]
21+
resources = ["*"]
22+
}
23+
}
24+
25+
resource "aws_iam_policy" "policy" {
26+
name = "OpentofuPolicy"
27+
path = "/"
28+
description = "Policy to allow Opentofu to do it's thing"
29+
30+
policy = data.aws_iam_policy_document.codebuild_policy_document.json
31+
}
32+
33+
resource "aws_iam_role" "github_tf" {
34+
name = "GitHubActionsS3Role"
35+
description = "Allow GitHub actions access to S3 to store TF state"
36+
assume_role_policy = jsonencode({
37+
Statement = [
38+
{
39+
Action = "sts:AssumeRoleWithWebIdentity"
40+
Effect = "Allow"
41+
Condition = {
42+
StringEquals = {
43+
"token.actions.githubusercontent.com:aud" = "sts.amazonaws.com"
44+
}
45+
StringLike = {
46+
"token.actions.githubusercontent.com:sub" = "repo:Homebrew/homebrew-user-management:*"
47+
}
48+
}
49+
Principal = {
50+
Federated = aws_iam_openid_connect_provider.github_actions.arn
51+
}
52+
},
53+
]
54+
Version = "2012-10-17"
55+
})
56+
managed_policy_arns = [
57+
"arn:aws:iam::aws:policy/AmazonS3FullAccess",
58+
"arn:aws:iam::aws:policy/AWSSSOReadOnly",
59+
"arn:aws:iam::aws:policy/IAMReadOnlyAccess",
60+
]
61+
}

‎aws/vars.tf

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
variable "teams" {
2+
type = map(map(string))
3+
}

‎dnsimple/contacts.tf

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,12 @@ resource "dnsimple_contact" "ocf" {
44
last_name = "Maintainers"
55
email = "ops@brew.sh"
66

7-
phone = "+1 555 1234"
8-
address1 = "123 Homebrew Street"
9-
city = "Homebrew"
10-
state_province = "HB"
11-
postal_code = "00001"
12-
country = "United States"
7+
phone = sensitive("+1 555 1234")
8+
address1 = sensitive("123 Homebrew Street")
9+
city = sensitive("Homebrew")
10+
state_province = sensitive("HB")
11+
postal_code = sensitive("00001")
12+
country = "US"
1313

1414
lifecycle {
1515
ignore_changes = [address1, city, state_province, postal_code, phone]

‎import.tf

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,3 +56,13 @@ import {
5656
to = module.dnsimple.dnsimple_contact.ocf
5757
id = 52414
5858
}
59+
60+
import {
61+
to = module.aws.aws_iam_openid_connect_provider.github_actions
62+
id = "arn:aws:iam::765021812025:oidc-provider/token.actions.githubusercontent.com"
63+
}
64+
65+
import {
66+
to = module.aws.aws_iam_role.github_tf
67+
id = "GitHubActionsS3Role"
68+
}

‎main.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,20 @@ module "github" {
3131
unmanagable_members = local.unmanagable_members
3232
}
3333

34+
locals {
35+
emails = nonsensitive({ for username, email in module.github.member_emails : username => lookup(var.email_overrides, username, email) })
36+
}
37+
38+
module "aws" {
39+
source = "./aws"
40+
teams = {
41+
Ops = { for username in var.teams.maintainers.ops : username => local.emails[username] if lookup(local.emails, username, "") != "" }
42+
Security = { for username in var.teams.security : username => local.emails[username] if lookup(local.emails, username, "") != "" }
43+
PLC = { for username in var.teams.plc : username => local.emails[username] if lookup(local.emails, username, "") != "" }
44+
Analytics = { for username in var.teams.maintainers.analytics : username => local.emails[username] if lookup(local.emails, username, "") != "" }
45+
}
46+
}
47+
3448
module "google-cloud" {
3549
source = "./google-cloud"
3650
ops = module.github.ops

0 commit comments

Comments
 (0)