cm-proxy/proxy-role.yaml at master · causematch/cm-proxy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
AWSTemplateFormatVersion: '2010-09-09'
Description: managed policy and permissions boundary for cm-proxy

# deployment requires CAPABILITY_NAMED_IAM

Resources:
  CMProxyPermissionsBoundary:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: Permissions boundary for cm-proxy cloud resources
      ManagedPolicyName: cm-proxy-permissions-boundary
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - sqs:SendMessage
              - sqs:GetQueueUrl
              - sqs:GetQueueAttributes
            Resource: !Sub "arn:aws:sqs:${AWS::Region}:${AWS::AccountId}:*-CMProxyRequestQueue-*"
          - Effect: Allow
            Action:
              - states:StartExecution
            Resource: !Sub "arn:aws:states:${AWS::Region}:${AWS::AccountId}:stateMachine:CMProxyStateMachine-*"
          - Effect: Allow
            Action:
              - states:DescribeExecution
            Resource: !Sub "arn:aws:states:${AWS::Region}:${AWS::AccountId}:execution:CMProxyStateMachine-*:*"
          - Effect: Allow
            Action:
              - logs:CreateLogGroup
            Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*-CMProxyFunction-*"
          - Effect: Allow
            Action:
              - logs:CreateLogStream
              - logs:PutLogEvents
            Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*-CMProxyFunction-*:log-stream:*"

  CMProxyPermissionsBoundaryParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Description: Arn of permissions boundary to use when creating roles
      Name: /cm-proxy/permissions-boundary
      Type: String
      Value: !Ref CMProxyPermissionsBoundary

  CMProxyCloudformationServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: cloudformation.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: cloudformation-permissions
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - 'iam:CreateRole'
                  - 'iam:DeleteRole'
                  - 'iam:UpdateRole'
                  - 'iam:GetRole'
                  - 'iam:PutRolePermissionsBoundary'
                  - 'iam:DeleteRolePermissionsBoundary'
                  - 'iam:AttachRolePolicy'
                  - 'iam:DetachRolePolicy'
                  - 'iam:PutRolePolicy'
                  - 'iam:DeleteRolePolicy'
                Resource:
                  - !Sub 'arn:aws:iam::${AWS::AccountId}:role/cm-proxy/*'
                Condition:
                  StringEquals:
                    'iam:PermissionsBoundary': !Ref CMProxyPermissionsBoundary
              - Effect: Allow
                Action:
                  - 'iam:PassRole'
                Resource:
                  - !Sub 'arn:aws:iam::${AWS::AccountId}:role/cm-proxy/*'
                Condition:
                  ArnLike:
                    "iam:AssociatedResourceARN":
                      - !Sub 'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:*-CMProxyFunction-*'
                      - !Sub "arn:aws:states:${AWS::Region}:${AWS::AccountId}:stateMachine:CMProxyStateMachine-*"
              - Effect: Allow
                Action:
                  - 'iam:TagRole'
                  - 'iam:UntagRole'
                  - 'iam:ListAttachedRolePolicies'
                  - 'iam:GetRolePolicy'
                  - 'iam:ListRolePolicies'
                Resource:
                  - !Sub 'arn:aws:iam::${AWS::AccountId}:role/cm-proxy/*'
              - Effect: Allow
                Action:
                  - 'iam:GetPolicy'
                  - 'iam:GetPolicyVersion'
                  - 'iam:ListPolicyVersions'
                Resource: '*'
              - Effect: Allow
                Action:
                  - 'lambda:CreateFunction'
                  - 'lambda:DeleteFunction'
                  - 'lambda:UpdateFunctionCode'
                  - 'lambda:UpdateFunctionConfiguration'
                  - 'lambda:GetFunction'
                  - 'lambda:GetFunctionConfiguration'
                  - 'lambda:ListTags'
                  - 'lambda:TagResource'
                  - 'lambda:UntagResource'
                  - 'lambda:AddPermission'
                  - 'lambda:RemovePermission'
                  - 'lambda:GetPolicy'
                  - 'lambda:CreateFunctionUrlConfig'
                  - 'lambda:DeleteFunctionUrlConfig'
                  - 'lambda:UpdateFunctionUrlConfig'
                  - 'lambda:GetFunctionUrlConfig'
                Resource: !Sub 'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:*-CMProxyFunction-*'
              - Effect: Allow
                Action:
                  - 'sqs:CreateQueue'
                  - 'sqs:DeleteQueue'
                  - 'sqs:GetQueueAttributes'
                  - 'sqs:SetQueueAttributes'
                  - 'sqs:GetQueueUrl'
                  - 'sqs:ListQueueTags'
                  - 'sqs:TagQueue'
                  - 'sqs:UntagQueue'
                Resource: !Sub "arn:aws:sqs:${AWS::Region}:${AWS::AccountId}:*-CMProxyRequestQueue-*"
              - Effect: Allow
                Action:
                  - 'states:CreateStateMachine'
                  - 'states:DeleteStateMachine'
                  - 'states:UpdateStateMachine'
                  - 'states:DescribeStateMachine'
                  - 'states:ListTagsForResource'
                  - 'states:TagResource'
                  - 'states:UntagResource'
                Resource: !Sub "arn:aws:states:${AWS::Region}:${AWS::AccountId}:stateMachine:CMProxyStateMachine-*"
              - Effect: Allow
                Action:
                  - 'logs:CreateLogGroup'
                  - 'logs:DeleteLogGroup'
                  - 'logs:DescribeLogGroups'
                  - 'logs:PutRetentionPolicy'
                  - 'logs:DeleteRetentionPolicy'
                Resource: !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*-CMProxyFunction-*'

  CMProxyCloudformationServiceRoleParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Description: Arn of service role to use with cloudformation
      Name: /cm-proxy/cloudformation-service-role
      Type: String
      Value: !GetAtt CMProxyCloudformationServiceRole.Arn

  CMProxyPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: Permissions for cm-proxy
      ManagedPolicyName: cm-proxy-policy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: 'ssm:GetParameters'
            Resource:
              - !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter${CMProxyPermissionsBoundaryParameter}'
              - !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter${CMProxyCloudformationServiceRoleParameter}'
          - Effect: Allow
            Action:
              - 'cloudformation:CreateStack'
              - 'cloudformation:UpdateStack'
              - 'cloudformation:DeleteStack'
              - 'cloudformation:DescribeStacks'
            Resource:
              - !Sub 'arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/cm-proxy*'
          - Effect: Allow
            Action:
              - 'iam:PassRole'
            Resource: !GetAtt CMProxyCloudformationServiceRole.Arn
            Condition:
              StringEquals:
                'iam:PassedToService': 'cloudformation.amazonaws.com'
          - Effect: Allow
            Action:
              - sqs:ReceiveMessage
              - sqs:DeleteMessage
              - sqs:GetQueueUrl
              - sqs:GetQueueAttributes
            Resource: !Sub "arn:aws:sqs:${AWS::Region}:${AWS::AccountId}:*-CMProxyRequestQueue-*"
          - Effect: Allow
            Action:
              - states:SendTaskSuccess
            Resource: "*"

Outputs:
  CMProxyPolicy:
    Description: Arn of managed policy for cm-proxy
    Value: !Ref CMProxyPolicy
    Export:
      Name: cm-proxy-managed-policy-arn