From 0657ac2f455a293624cfc50af039cd5cec697be1 Mon Sep 17 00:00:00 2001 From: carlosescura Date: Tue, 13 Oct 2020 13:26:28 +0200 Subject: [PATCH 1/4] start restriction for more fine-grained control policies --- .gitignore | 3 + modules/iam/main.tf | 248 ++++++++++++++++++++++++++++++-------------- 2 files changed, 173 insertions(+), 78 deletions(-) diff --git a/.gitignore b/.gitignore index 98e2441..f88191c 100644 --- a/.gitignore +++ b/.gitignore @@ -127,3 +127,6 @@ override.tf.json # End of https://www.gitignore.io/api/osx,ruby,terraform,visualstudiocode .kitchen/ + +## IDEA based IDEs +.idea diff --git a/modules/iam/main.tf b/modules/iam/main.tf index e8884a1..8fb85ae 100644 --- a/modules/iam/main.tf +++ b/modules/iam/main.tf @@ -125,6 +125,36 @@ data "aws_iam_policy_document" "segment_data_lake_policy_document" { effect = "Allow" } + # Explicitly deny Segment to modify IAM or sensible configuration from the Data Lake S3 bucket. + statement { + sid = "Deny privileged operations" + actions = [ + "s3:BypassGovernanceRetention", + "s3:CreateAccessPoint", + "s3:DeleteAccessPoint", + "s3:DeleteAccessPointPolicy", + "s3:DeleteBucket", + "s3:DeleteBucketPolicy", + "s3:PutAccessPointPolicy", + "s3:PutAccountPublicAccessBlock", + "s3:PutBucketAcl", + "s3:PutBucketLogging", + "s3:PutBucketPolicy", + "s3:PutBucketPublicAccessBlock", + "s3:PutBucketVersioning", + "s3:PutBucketWebsite", + "s3:PutEncryptionConfiguration", + "s3:PutReplicationConfiguration" + ] + + resources = [ + "arn:aws:s3:::${var.s3_bucket}/*", + "arn:aws:s3:::${var.s3_bucket}", + ] + + effect = "Deny" + } + # Allows Segment to access Athena. statement { actions = [ @@ -182,84 +212,146 @@ EOF tags = "${local.tags}" } -resource "aws_iam_role_policy" "segment_emr_service_policy" { - name = "SegmentEMRServicePolicy${var.suffix}" - role = "${aws_iam_role.segment_emr_service_role.id}" +resource "aws_iam_policy" "segment_emr_service_role_policy" { + name = "SegmentEMRServicePolicy${var.suffix}" + path = "/" + policy = "${data.aws_iam_policy_document.segment_emr_service_policy_document.json}" + tags = "${local.tags}" +} - policy = < Date: Tue, 13 Oct 2020 17:07:45 +0200 Subject: [PATCH 2/4] Remove tags from policies --- modules/iam/main.tf | 2 -- 1 file changed, 2 deletions(-) diff --git a/modules/iam/main.tf b/modules/iam/main.tf index 8fb85ae..a4b45a7 100644 --- a/modules/iam/main.tf +++ b/modules/iam/main.tf @@ -44,7 +44,6 @@ resource "aws_iam_policy" "segment_data_lake_policy" { path = "/" description = "Gives access to resources in your Data Lake" policy = "${data.aws_iam_policy_document.segment_data_lake_policy_document.json}" - tags = "${local.tags}" } data "aws_iam_policy_document" "segment_data_lake_policy_document" { @@ -216,7 +215,6 @@ resource "aws_iam_policy" "segment_emr_service_role_policy" { name = "SegmentEMRServicePolicy${var.suffix}" path = "/" policy = "${data.aws_iam_policy_document.segment_emr_service_policy_document.json}" - tags = "${local.tags}" } data "aws_iam_policy_document" "segment_emr_service_policy_document" { From 3a128753cef41afe2f36ab9f320a6b07adaa2f6e Mon Sep 17 00:00:00 2001 From: carlosescura Date: Tue, 13 Oct 2020 17:26:27 +0200 Subject: [PATCH 3/4] Fix typo on policy SID --- modules/iam/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/iam/main.tf b/modules/iam/main.tf index a4b45a7..a244a01 100644 --- a/modules/iam/main.tf +++ b/modules/iam/main.tf @@ -126,7 +126,7 @@ data "aws_iam_policy_document" "segment_data_lake_policy_document" { # Explicitly deny Segment to modify IAM or sensible configuration from the Data Lake S3 bucket. statement { - sid = "Deny privileged operations" + sid = "DenyPrivilegedOperations" actions = [ "s3:BypassGovernanceRetention", "s3:CreateAccessPoint", From a298c01cb16c3d4c2c8a6df8c64c5f8ce53aed9c Mon Sep 17 00:00:00 2001 From: carlosescura Date: Wed, 14 Oct 2020 10:41:54 +0200 Subject: [PATCH 4/4] Migrate EMR InstanceProfile to data policy --- modules/iam/main.tf | 143 +++++++++++++++++++++++--------------------- 1 file changed, 75 insertions(+), 68 deletions(-) diff --git a/modules/iam/main.tf b/modules/iam/main.tf index a244a01..4b1208b 100644 --- a/modules/iam/main.tf +++ b/modules/iam/main.tf @@ -384,75 +384,82 @@ resource "aws_iam_role_policy" "segment_emr_instance_profile_policy" { name = "SegmentEMRInstanceProfilePolicy${var.suffix}" role = "${aws_iam_role.segment_emr_instance_profile_role.id}" - policy = <