BAU: reduce lamba policies

ci/terraform/account-management/authenticate.tf

@@ -1,15 +1,17 @@
 module "account_management_api_authenticate_role" {
-  source      = "../modules/lambda-role"
+  source      = "../modules/lambda-role-policy-reduction"
   environment = var.environment
   role_name   = "account-management-api-authenticate-role"
   vpc_arn     = local.vpc_arn
 
-  policies_to_attach = [
-    aws_iam_policy.dynamo_am_user_read_access_policy.arn,
-    aws_iam_policy.audit_signing_key_lambda_kms_signing_policy.arn,
-    aws_iam_policy.parameter_policy.arn,
-    module.account_management_txma_audit.access_policy_arn
-  ]
+  policy_documents_to_attach = {
+    additional = [
+      data.aws_iam_policy_document.dynamo_user_read_policy_document.json,
+      data.aws_iam_policy_document.account_management_audit_payload_kms_signing_policy_document.json,
+      data.aws_iam_policy_document.redis_parameter_policy.json,
+      module.account_management_txma_audit.access_policy_document.json
+    ]
+  }
 }
 
 module "authenticate" {

ci/terraform/modules/lambda-role-policy-reduction/output.tf

@@ -0,0 +1,7 @@
+output "arn" {
+  value = aws_iam_role.lambda_role.arn
+}
+
+output "name" {
+  value = aws_iam_role.lambda_role.name
+}

ci/terraform/modules/lambda-role-policy-reduction/policy.tf

@@ -0,0 +1,73 @@
+data "aws_iam_policy_document" "logging_policy_document" {
+  statement {
+    effect = "Allow"
+
+    actions = [
+      "logs:CreateLogStream",
+      "logs:PutLogEvents"
+    ]
+
+    resources = [
+      "arn:aws:logs:*:*:*",
+    ]
+  }
+}
+
+data "aws_iam_policy_document" "endpoint_xray_policy" {
+  statement {
+    effect = "Allow"
+    actions = [
+      "xray:*"
+    ]
+
+    resources = [
+      "*",
+    ]
+  }
+}
+
+data "aws_iam_policy_document" "networking_policy_document" {
+  count = var.vpc_arn == "" ? 0 : 1
+  statement {
+    effect = "Allow"
+
+    actions = [
+      "ec2:DescribeNetworkInterfaces",
+      "ec2:CreateNetworkInterface",
+      "ec2:DeleteNetworkInterface"
+    ]
+    resources = [
+      "*"
+    ]
+    condition {
+      test     = "ArnLikeIfExists"
+      variable = "ec2:Vpc"
+      values   = [var.vpc_arn]
+    }
+  }
+}
+
+locals {
+  policy_documents_to_attach = merge({
+    base = concat([
+      data.aws_iam_policy_document.logging_policy_document.json,
+      data.aws_iam_policy_document.endpoint_xray_policy.json,
+      ],
+    var.vpc_arn == "" ? [] : [data.aws_iam_policy_document.networking_policy_document[0].json]),
+  }, var.policy_documents_to_attach)
+}
+
+data "aws_iam_policy_document" "iam-policy-document" {
+  for_each                = local.policy_documents_to_attach
+  source_policy_documents = each.value
+}
+
+resource "aws_iam_policy" "iam-policy" {
+  for_each = local.policy_documents_to_attach
+
+  name_prefix = "${var.role_name}-${each.key}-policy"
+  path        = "/${var.environment}/${var.role_name}/"
+  description = "Combined IAM policy ${each.key} for ${var.role_name}"
+
+  policy = data.aws_iam_policy_document.iam-policy-document[each.key].json
+}

ci/terraform/modules/lambda-role-policy-reduction/role.tf

@@ -0,0 +1,40 @@
+resource "aws_iam_role" "lambda_role" {
+  name_prefix        = "execution-role"
+  path               = "/${var.environment}/${var.role_name}/"
+  assume_role_policy = data.aws_iam_policy_document.lambda_can_assume_role.json
+
+  tags = var.default_tags
+}
+
+data "aws_iam_policy_document" "lambda_can_assume_role" {
+  version = "2012-10-17"
+
+  statement {
+    effect = "Allow"
+    principals {
+      identifiers = [
+        "lambda.amazonaws.com"
+      ]
+      type = "Service"
+    }
+
+    actions = [
+      "sts:AssumeRole"
+    ]
+  }
+}
+
+resource "aws_iam_role_policy_attachment" "provided_policies" {
+  for_each = aws_iam_policy.iam-policy
+
+  role       = aws_iam_role.lambda_role.name
+  policy_arn = each.value.arn
+
+  depends_on = [
+    aws_iam_role.lambda_role
+  ]
+}
+resource "aws_iam_role_policy_attachments_exclusive" "exclusively_managed_policies" {
+  role_name   = aws_iam_role.lambda_role.name
+  policy_arns = aws_iam_policy.iam-policy[*].arn
+}

ci/terraform/modules/lambda-role-policy-reduction/variables.tf

@@ -0,0 +1,33 @@
+variable "role_name" {
+  type = string
+}
+
+variable "environment" {
+  type = string
+}
+
+variable "default_tags" {
+  default     = {}
+  type        = map(string)
+  description = "Default tags to apply to all resources"
+}
+
+variable "policy_documents_to_attach" {
+  type        = map(list(string))
+  default     = {}
+  description = "Policy documents to combine and attach to the role"
+
+  validation {
+    condition     = !contains(keys(var.policy_documents_to_attach), "base")
+    error_message = "policy_documents_to_attach cannot contain a key named 'base'"
+  }
+  validation {
+    condition     = length(keys(var.policy_documents_to_attach)) <= 20
+    error_message = "policy_documents_to_attach cannot contain more than 20 keys"
+  }
+}
+
+variable "vpc_arn" {
+  default = ""
+  type    = string
+}

ci/terraform/modules/txma-audit-queue/output.tf

@@ -13,3 +13,7 @@ output "kms_key_arn" {
 output "access_policy_arn" {
   value = aws_iam_policy.txma_audit_queue_access_policy.arn
 }
+
+output "access_policy_document" {
+  value = data.aws_iam_policy_document.txma_audit_queue_access_policy_document
+}