Merge pull request #1281 from Crown-Commercial-Service/dmp-1-0-cicd-i…

…nfra-allow Add IAM role to allow DMP 1.0 Jenkins to talk to DMP 1.0 accounts via…
Crown-Commercial-Service · Nov 20, 2023 · 31d5809 · 31d5809
2 parents 4cec863 + 4af907f
commit 31d5809
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 0 deletions.
diff --git a/terraform/accounts/main/jenkins_instance_profile.tf b/terraform/accounts/main/jenkins_instance_profile.tf
@@ -260,3 +260,20 @@ resource "aws_iam_role_policy" "jenkins_assume_cloudtrail_validate_logs" {
   policy = data.aws_iam_policy_document.jenkins_assume_cloudtrail_validate_logs.json
 }
 
+resource "aws_iam_policy" "dmp_1_0_jenkins_cicd_infrastructure_role_policy" {
+  name   = "dmp_1_0_jenkins_cicd_infrastructure_role_policy"
+  policy = data.aws_iam_policy_document.dmp_1_0_jenkins_cicd_infrastructure_role_policy.json
+}
+
+data "aws_iam_policy_document" "dmp_1_0_jenkins_cicd_infrastructure_role_policy" {
+  statement {
+    sid     = "Statement1"
+    actions = ["sts:AssumeRole"]
+
+    resources = [
+      "arn:aws:iam::${var.aws_sandbox_account_id}:role/cicd_infrastructure",
+      "arn:aws:iam::${var.aws_dev_account_id}:role/cicd_infrastructure",
+      "arn:aws:iam::${var.aws_staging_account_id}:role/cicd_infrastructure"
+    ]
+  }
+}
diff --git a/terraform/accounts/main/variables.tf b/terraform/accounts/main/variables.tf
@@ -18,6 +18,12 @@ variable "aws_sub_account_ids" {
 variable "aws_dev_account_id" {
 }
 
+variable "aws_sandbox_account_id" {
+}
+
+variable "aws_staging_account_id" {
+}
+
 variable "aws_backups_account_id" {
 }