Skip to content

Commit 9ba7b73

Browse files
diodonfrostdiodonfrost
committed
refactor(permissions): move iam resources in dedicated file
Move all IAM-related resources into a dedicated iam.tf file to improve code organization and maintainability. No functional changes, purely organizational improvement.
1 parent 169bd23 commit 9ba7b73

File tree

2 files changed

+237
-250
lines changed

2 files changed

+237
-250
lines changed

‎iam.tf

+237
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,237 @@
1+
resource "aws_iam_role" "this" {
2+
count = var.custom_iam_role_arn == null ? 1 : 0
3+
name = "${var.name}-scheduler-lambda"
4+
description = "Allows Lambda functions to stop and start ec2 and rds resources"
5+
assume_role_policy = data.aws_iam_policy_document.this.json
6+
tags = var.tags
7+
}
8+
9+
data "aws_iam_policy_document" "this" {
10+
statement {
11+
actions = ["sts:AssumeRole"]
12+
13+
principals {
14+
type = "Service"
15+
identifiers = ["lambda.amazonaws.com"]
16+
}
17+
}
18+
}
19+
20+
resource "aws_iam_role_policy" "autoscaling_group_scheduler" {
21+
count = var.custom_iam_role_arn == null ? 1 : 0
22+
name = "${var.name}-autoscaling-custom-policy-scheduler"
23+
role = aws_iam_role.this[0].id
24+
policy = data.aws_iam_policy_document.autoscaling_group_scheduler.json
25+
}
26+
27+
data "aws_iam_policy_document" "autoscaling_group_scheduler" {
28+
statement {
29+
actions = [
30+
"autoscaling:DescribeScalingProcessTypes",
31+
"autoscaling:DescribeAutoScalingGroups",
32+
"autoscaling:DescribeTags",
33+
"autoscaling:SuspendProcesses",
34+
"autoscaling:ResumeProcesses",
35+
"autoscaling:UpdateAutoScalingGroup",
36+
"autoscaling:DescribeAutoScalingInstances",
37+
"autoscaling:TerminateInstanceInAutoScalingGroup",
38+
"ec2:TerminateInstances",
39+
]
40+
41+
resources = [
42+
"*",
43+
]
44+
}
45+
}
46+
47+
resource "aws_iam_role_policy" "spot_instance_scheduler" {
48+
count = var.custom_iam_role_arn == null ? 1 : 0
49+
name = "${var.name}-spot-custom-policy-scheduler"
50+
role = aws_iam_role.this[0].id
51+
policy = data.aws_iam_policy_document.spot_instance_scheduler.json
52+
}
53+
54+
data "aws_iam_policy_document" "spot_instance_scheduler" {
55+
statement {
56+
actions = [
57+
"ec2:DescribeInstances",
58+
"ec2:TerminateSpotInstances",
59+
]
60+
61+
resources = [
62+
"*",
63+
]
64+
}
65+
}
66+
67+
resource "aws_iam_role_policy" "instance_scheduler" {
68+
count = var.custom_iam_role_arn == null ? 1 : 0
69+
name = "${var.name}-ec2-custom-policy-scheduler"
70+
role = aws_iam_role.this[0].id
71+
policy = data.aws_iam_policy_document.instance_scheduler.json
72+
}
73+
74+
data "aws_iam_policy_document" "instance_scheduler" {
75+
statement {
76+
actions = [
77+
"ec2:StopInstances",
78+
"ec2:StartInstances",
79+
"autoscaling:DescribeAutoScalingInstances",
80+
]
81+
82+
resources = [
83+
"*",
84+
]
85+
}
86+
}
87+
88+
resource "aws_iam_role_policy" "rds_scheduler" {
89+
count = var.custom_iam_role_arn == null ? 1 : 0
90+
name = "${var.name}-rds-custom-policy-scheduler"
91+
role = aws_iam_role.this[0].id
92+
policy = data.aws_iam_policy_document.rds_scheduler.json
93+
}
94+
95+
data "aws_iam_policy_document" "rds_scheduler" {
96+
statement {
97+
actions = [
98+
"rds:StartDBCluster",
99+
"rds:StopDBCluster",
100+
"rds:StartDBInstance",
101+
"rds:StopDBInstance",
102+
"rds:DescribeDBClusters",
103+
]
104+
105+
resources = [
106+
"*",
107+
]
108+
}
109+
}
110+
111+
resource "aws_iam_role_policy" "ecs_scheduler" {
112+
count = var.custom_iam_role_arn == null ? 1 : 0
113+
name = "${var.name}-ecs-custom-policy-scheduler"
114+
role = aws_iam_role.this[0].id
115+
policy = data.aws_iam_policy_document.ecs_scheduler.json
116+
}
117+
118+
data "aws_iam_policy_document" "ecs_scheduler" {
119+
statement {
120+
actions = [
121+
"ecs:UpdateService",
122+
"ecs:DescribeService",
123+
]
124+
125+
resources = [
126+
"*",
127+
]
128+
}
129+
}
130+
131+
resource "aws_iam_role_policy" "redshift_scheduler" {
132+
count = var.custom_iam_role_arn == null ? 1 : 0
133+
name = "${var.name}-redshift-custom-policy-scheduler"
134+
role = aws_iam_role.this[0].id
135+
policy = data.aws_iam_policy_document.redshift_scheduler.json
136+
}
137+
138+
data "aws_iam_policy_document" "redshift_scheduler" {
139+
statement {
140+
actions = [
141+
"redshift:ResumeCluster",
142+
"redshift:PauseCluster",
143+
]
144+
145+
resources = [
146+
"*",
147+
]
148+
}
149+
}
150+
151+
resource "aws_iam_role_policy" "cloudwatch_alarm_scheduler" {
152+
count = var.custom_iam_role_arn == null ? 1 : 0
153+
name = "${var.name}-cloudwatch-custom-policy-scheduler"
154+
role = aws_iam_role.this[0].id
155+
policy = data.aws_iam_policy_document.cloudwatch_alarm_scheduler.json
156+
}
157+
158+
data "aws_iam_policy_document" "cloudwatch_alarm_scheduler" {
159+
statement {
160+
actions = [
161+
"cloudwatch:DisableAlarmActions",
162+
"cloudwatch:EnableAlarmActions",
163+
]
164+
165+
resources = [
166+
"*",
167+
]
168+
}
169+
}
170+
171+
resource "aws_iam_role_policy" "resource_groups_tagging_api" {
172+
count = var.custom_iam_role_arn == null ? 1 : 0
173+
name = "${var.name}-resource-groups-tagging-api-scheduler"
174+
role = aws_iam_role.this[0].id
175+
policy = data.aws_iam_policy_document.resource_groups_tagging_api.json
176+
}
177+
178+
data "aws_iam_policy_document" "resource_groups_tagging_api" {
179+
statement {
180+
actions = [
181+
"tag:GetResources",
182+
]
183+
184+
resources = [
185+
"*",
186+
]
187+
}
188+
}
189+
190+
resource "aws_iam_role_policy" "lambda_logging" {
191+
count = var.custom_iam_role_arn == null ? 1 : 0
192+
name = "${var.name}-lambda-logging"
193+
role = aws_iam_role.this[0].id
194+
policy = var.kms_key_arn == null ? jsonencode(local.lambda_logging_policy) : jsonencode(local.lambda_logging_and_kms_policy)
195+
}
196+
197+
# Local variables are used for make iam policy because
198+
# resources cannot have a null value in aws_iam_policy_document.
199+
locals {
200+
lambda_logging_policy = {
201+
"Version" : "2012-10-17",
202+
"Statement" : [
203+
{
204+
"Action" : [
205+
"logs:CreateLogStream",
206+
"logs:PutLogEvents"
207+
],
208+
"Resource" : "${aws_cloudwatch_log_group.this.arn}:*",
209+
"Effect" : "Allow"
210+
}
211+
]
212+
}
213+
lambda_logging_and_kms_policy = {
214+
"Version" : "2012-10-17",
215+
"Statement" : [
216+
{
217+
"Action" : [
218+
"logs:CreateLogStream",
219+
"logs:PutLogEvents"
220+
],
221+
"Resource" : "${aws_cloudwatch_log_group.this.arn}:*",
222+
"Effect" : "Allow"
223+
},
224+
{
225+
"Action" : [
226+
"kms:Encrypt",
227+
"kms:Decrypt",
228+
"kms:CreateGrant"
229+
],
230+
"Resource" : var.kms_key_arn,
231+
"Effect" : "Allow"
232+
}
233+
]
234+
}
235+
# Backward compatibility with the former scheduler variable name.
236+
scheduler_tag = var.resources_tag == null ? var.scheduler_tag : var.resources_tag
237+
}

0 commit comments

Comments
 (0)