From e441c492e3cdec7d7aaf53446cc471546913b89f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Arturo=20Filast=C3=B2?= <arturo@filasto.net>
Date: Wed, 3 Jul 2024 14:47:26 +0200
Subject: [PATCH] Add new user and role for ansible

---
 tf/modules/adm_iam_roles/main.tf    | 39 ++++++++++++++++++++++++++++-
 tf/modules/adm_iam_roles/outputs.tf |  9 +++++++
 2 files changed, 47 insertions(+), 1 deletion(-)

diff --git a/tf/modules/adm_iam_roles/main.tf b/tf/modules/adm_iam_roles/main.tf
index 78504275..d1f875e1 100644
--- a/tf/modules/adm_iam_roles/main.tf
+++ b/tf/modules/adm_iam_roles/main.tf
@@ -8,6 +8,44 @@ data "aws_iam_policy_document" "assume_role" {
   }
 }
 
+resource "aws_iam_policy" "ooniansible" {
+  name        = "OONIAnsiblePolicy"
+  path        = "/"
+  description = "Policy used by the ansible"
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "ec2:DescribeInstances",
+      ],
+      "Resource": "*"
+    }
+  ]
+}
+EOF
+
+  tags = var.tags
+}
+
+resource "aws_iam_user" "ooniansible" {
+  name = "ooniansible"
+  path = "/"
+}
+
+resource "aws_iam_access_key" "ooniansible_key" {
+  user = aws_iam_user.ooniansible.name
+}
+
+
+resource "aws_iam_user_policy_attachment" "ooniansible_user_policy_attach" {
+  user       = aws_iam_user.ooniansible.name
+  policy_arn = aws_iam_policy.ooniansible.arn
+}
+
 resource "aws_iam_policy" "oonidevops" {
   name        = "OONIDevopsPolicy"
   path        = "/"
@@ -60,7 +98,6 @@ EOF
 
   tags = var.tags
 }
-
 resource "aws_iam_role" "oonidevops" {
   name                = "oonidevops"
   assume_role_policy  = data.aws_iam_policy_document.assume_role.json
diff --git a/tf/modules/adm_iam_roles/outputs.tf b/tf/modules/adm_iam_roles/outputs.tf
index a99f7905..6b83b090 100644
--- a/tf/modules/adm_iam_roles/outputs.tf
+++ b/tf/modules/adm_iam_roles/outputs.tf
@@ -10,3 +10,12 @@ output "oonidevops_deploy_key_arn" {
   value = aws_secretsmanager_secret.oonidevops_deploy_key.id
 }
 
+output "ooniansible_access_key_id" {
+  value = aws_iam_access_key.ooniansible_key.id
+}
+
+output "secret_access_key" {
+  value = aws_iam_access_key.ooniansible_key.secret
+  sensitive = true
+}
+