feat: add OONI Dev User for GH actions

tf/environments/dev/main.tf

@@ -19,7 +19,6 @@ locals {
 ## AWS Setup
 
 provider "aws" {
- profile = "oonidevops_user"
  region = var.aws_region
  assume_role {
  role_arn = "arn:aws:iam::905418398257:role/oonidevops"
@@ -296,3 +295,9 @@ module "ooniapi_frontend" {
  )
 }
 
+module "oonidevops_github_user" {
+ source = "../../modules/oonidevops_github_user"
+
+ tags = local.tags
+}
+

tf/modules/oonidevops_github_user/main.tf

@@ -0,0 +1,189 @@
+resource "aws_iam_user" "oonidevops_github_user" {
+ name = "oonidevops-github"
+ path = "/"
+
+ tags = var.tags
+}
+
+data "aws_iam_policy_document" "oonidevops_github" {
+ statement {
+ effect = "Allow"
+ actions = [
+ "acm:Describe*",
+ "acm:Get*",
+ "acm:List*",
+ "application-autoscaling:Describe*",
+ "application-autoscaling:ListTagsForResource",
+ "appmesh:Describe*",
+ "appmesh:List*",
+ "autoscaling:Describe*",
+ "autoscaling:GetPredictiveScalingForecast",
+ "cloudformation:Describe*",
+ "cloudformation:Detect*",
+ "cloudformation:Estimate*",
+ "cloudformation:Get*",
+ "cloudformation:List*",
+ "cloudformation:ValidateTemplate",
+ "cloudtrail:Describe*",
+ "cloudtrail:Get*",
+ "cloudtrail:List*",
+ "cloudtrail:LookupEvents",
+ "cloudwatch:Describe*",
+ "cloudwatch:GenerateQuery",
+ "cloudwatch:Get*",
+ "cloudwatch:List*",
+ "codebuild:BatchGet*",
+ "codebuild:DescribeCodeCoverages",
+ "codebuild:DescribeTestCases",
+ "codebuild:List*",
+ "codedeploy:BatchGet*",
+ "codedeploy:Get*",
+ "codedeploy:List*",
+ "codepipeline:Get*",
+ "codepipeline:List*",
+ "codestar-connections:GetConnection",
+ "codestar-connections:GetHost",
+ "codestar-connections:GetRepositoryLink",
+ "codestar-connections:GetRepositorySyncStatus",
+ "codestar-connections:GetResourceSyncStatus",
+ "codestar-connections:GetSyncConfiguration",
+ "codestar-connections:ListConnections",
+ "codestar-connections:ListHosts",
+ "codestar-connections:ListRepositoryLinks",
+ "codestar-connections:ListRepositorySyncDefinitions",
+ "codestar-connections:ListSyncConfigurations",
+ "codestar-connections:ListTagsForResource",
+ "codestar-notifications:describeNotificationRule",
+ "codestar-notifications:listEventTypes",
+ "codestar-notifications:listNotificationRules",
+ "codestar-notifications:listTagsForResource",
+ "codestar-notifications:ListTargets",
+ "dynamodb:BatchGet*",
+ "dynamodb:Describe*",
+ "dynamodb:Get*",
+ "dynamodb:List*",
+ "dynamodb:PartiQLSelect",
+ "dynamodb:Query",
+ "dynamodb:Scan",
+ "ec2:Describe*",
+ "ec2:Get*",
+ "ec2:ListImagesInRecycleBin",
+ "ec2:ListSnapshotsInRecycleBin",
+ "ec2:SearchLocalGatewayRoutes",
+ "ec2:SearchTransitGatewayRoutes",
+ "ec2messages:Get*",
+ "ecr-public:BatchCheckLayerAvailability",
+ "ecr-public:DescribeImages",
+ "ecr-public:DescribeImageTags",
+ "ecr-public:DescribeRegistries",
+ "ecr-public:DescribeRepositories",
+ "ecr-public:GetAuthorizationToken",
+ "ecr-public:GetRegistryCatalogData",
+ "ecr-public:GetRepositoryCatalogData",
+ "ecr-public:GetRepositoryPolicy",
+ "ecr-public:ListTagsForResource",
+ "ecr:BatchCheck*",
+ "ecr:BatchGet*",
+ "ecr:Describe*",
+ "ecr:Get*",
+ "ecr:List*",
+ "ecs:Describe*",
+ "ecs:List*",
+ "elasticloadbalancing:Describe*",
+ "logs:Describe*",
+ "logs:FilterLogEvents",
+ "logs:Get*",
+ "logs:ListAnomalies",
+ "logs:ListLogAnomalyDetectors",
+ "logs:ListLogDeliveries",
+ "logs:ListTagsForResource",
+ "logs:ListTagsLogGroup",
+ "logs:StartLiveTail",
+ "logs:StartQuery",
+ "logs:StopLiveTail",
+ "logs:StopQuery",
+ "logs:TestMetricFilter",
+ "iam:Generate*",
+ "iam:Get*",
+ "iam:List*",
+ "iam:Simulate*",
+ "rds:Describe*",
+ "rds:Download*",
+ "rds:List*",
+ "route53-recovery-cluster:Get*",
+ "route53-recovery-cluster:ListRoutingControls",
+ "route53-recovery-control-config:Describe*",
+ "route53-recovery-control-config:GetResourcePolicy",
+ "route53-recovery-control-config:List*",
+ "route53-recovery-readiness:Get*",
+ "route53-recovery-readiness:List*",
+ "route53:Get*",
+ "route53:List*",
+ "route53:Test*",
+ "route53domains:Check*",
+ "route53domains:Get*",
+ "route53domains:List*",
+ "route53domains:View*",
+ "route53resolver:Get*",
+ "route53resolver:List*",
+ "s3:DescribeJob",
+ "s3:Get*",
+ "s3:List*",
+ "secretsmanager:Describe*",
+ "secretsmanager:GetResourcePolicy",
+ "secretsmanager:List*",
+ "servicediscovery:DiscoverInstances",
+ "servicediscovery:DiscoverInstancesRevision",
+ "servicediscovery:Get*",
+ "servicediscovery:List*",
+ "ssm:Describe*",
+ "ssm:Get*",
+ "ssm:List*",
+ "states:Describe*",
+ "states:GetExecutionHistory",
+ "states:List*",
+ "vpc-lattice:GetAccessLogSubscription",
+ "vpc-lattice:GetAuthPolicy",
+ "vpc-lattice:GetListener",
+ "vpc-lattice:GetResourcePolicy",
+ "vpc-lattice:GetRule",
+ "vpc-lattice:GetService",
+ "vpc-lattice:GetServiceNetwork",
+ "vpc-lattice:GetServiceNetworkServiceAssociation",
+ "vpc-lattice:GetServiceNetworkVpcAssociation",
+ "vpc-lattice:GetTargetGroup",
+ "vpc-lattice:ListAccessLogSubscriptions",
+ "vpc-lattice:ListListeners",
+ "vpc-lattice:ListRules",
+ "vpc-lattice:ListServiceNetworks",
+ "vpc-lattice:ListServiceNetworkServiceAssociations",
+ "vpc-lattice:ListServiceNetworkVpcAssociations",
+ "vpc-lattice:ListServices",
+ "vpc-lattice:ListTagsForResource",
+ "vpc-lattice:ListTargetGroups",
+ "vpc-lattice:ListTargets"
+ ]
+ resources = ["*"]
+ }
+}
+
+resource "aws_iam_user_policy" "oonidevops_github" {
+ name = "OONIDevopsGithubPolicy"
+ user = aws_iam_user.oonidevops_github_user.name
+ policy = data.aws_iam_policy_document.oonidevops_github.json
+}
+
+resource "aws_iam_access_key" "oonidevops_github_user" {
+ user = aws_iam_user.oonidevops_github_user.name
+} 
+
+resource "aws_secretsmanager_secret" "oonidevops_github_user_secrets" {
+ name = "oonidevops/github_user/access_key_json"
+
+ tags = var.tags
+}
+
+resource "aws_secretsmanager_secret_version" "oonidevops_github_user_secrets" {
+ secret_id = aws_secretsmanager_secret.oonidevops_github_user_secrets.id
+ secret_string = jsonencode({"AccessKey": aws_iam_access_key.oonidevops_github_user.id, "SecretAccessKey" = aws_iam_access_key.oonidevops_github_user.secret})
+}

tf/modules/oonidevops_github_user/outputs.tf

@@ -0,0 +1,7 @@
+output "oonidevops_github_user_arn" {
+ value = aws_iam_user.oonidevops_github_user.arn
+}
+
+output "oonidevops_github_user_secrets_id" {
+ value = aws_secretsmanager_secret.oonidevops_github_user_secrets.id
+}

tf/modules/oonidevops_github_user/variables.tf

@@ -0,0 +1,5 @@
+variable "tags" {
+ description = "tags to apply to the resources"
+ default = {}
+ type = map(string)
+}