search

cds-snc / cloud-based-sensor

Infrastructure configuration to manage CCCS's Cloud Based Sensor in AWS accounts
https://cyber.gc.ca/en/host-based-sensors
MIT License
0 stars 0 forks source link

fix: remove the unnecessary iam policy #350

Closed gcharest closed 5 months ago

gcharest commented 5 months ago

Summary | Résumé

Remove unnecessary policy

github-actions[bot] commented 5 months ago

Central account

✅   Terraform Init: success ✅   Terraform Validate: success ✅   Terraform Format: success ✅   Terraform Plan: success ✅   Conftest: success 

Plan: 0 to add, 1 to change, 0 to destroy
Show summary | CHANGE | NAME | |--------|---------------------------------------------| | update | `module.gh_oidc_roles.aws_iam_role.this[0]` |
Show plan ```terraform Resource actions are indicated with the following symbols: ~ update in-place Terraform will perform the following actions: # module.gh_oidc_roles.aws_iam_role.this[0] will be updated in-place ~ resource "aws_iam_role" "this" { ~ assume_role_policy = jsonencode( ~ { ~ Statement = [ { Action = "sts:AssumeRoleWithWebIdentity" Condition = { StringLike = { token.actions.githubusercontent.com:sub = "repo:cds-snc/cloud-based-sensor:*" } } Effect = "Allow" Principal = { Federated = "arn:aws:iam::871282759583:oidc-provider/token.actions.githubusercontent.com" } }, - { - Action = "sts:AssumeRole" - Effect = "Allow" - Principal = { - AWS = [ - "arn:aws:iam::283582579564:role/ConfigTerraformAdminExecutionRole", - "arn:aws:iam::066023111852:role/ConfigTerraformAdminExecutionRole", - "arn:aws:iam::687401027353:role/ConfigTerraformAdminExecutionRole", - "arn:aws:iam::472286471787:role/ConfigTerraformAdminExecutionRole", - "arn:aws:iam::239043911459:role/ConfigTerraformAdminExecutionRole", - "arn:aws:iam::296255494825:role/ConfigTerraformAdminExecutionRole", - "arn:aws:iam::637287734259:role/ConfigTerraformAdminExecutionRole", - "arn:aws:iam::975050085632:role/ConfigTerraformAdminExecutionRole", - "arn:aws:iam::729164266357:role/ConfigTerraformAdminExecutionRole", - "arn:aws:iam::957818836222:role/ConfigTerraformAdminExecutionRole", - "arn:aws:iam::723936812785:role/ConfigTerraformAdminExecutionRole", - "arn:aws:iam::806545929748:role/ConfigTerraformAdminExecutionRole", - "arn:aws:iam::730335533085:role/ConfigTerraformAdminExecutionRole", - "arn:aws:iam::767397913019:role/ConfigTerraformAdminExecutionRole", - "arn:aws:iam::414662622316:role/ConfigTerraformAdminExecutionRole", - "arn:aws:iam::762579868088:role/ConfigTerraformAdminExecutionRole", - "arn:aws:iam::307395567143:role/ConfigTerraformAdminExecutionRole", - "arn:aws:iam::767397971970:role/ConfigTerraformAdminExecutionRole", - "arn:aws:iam::866996500832:role/ConfigTerraformAdminExecutionRole", - "arn:aws:iam::794722365809:role/ConfigTerraformAdminExecutionRole", - "arn:aws:iam::521732289257:role/ConfigTerraformAdminExecutionRole", - "arn:aws:iam::127893201980:role/ConfigTerraformAdminExecutionRole", - "arn:aws:iam::800095993820:role/ConfigTerraformAdminExecutionRole", - "arn:aws:iam::796730610681:role/ConfigTerraformAdminExecutionRole", ] } }, ] # (1 unchanged element hidden) } ) id = "ConfigTerraformAdministratorRole" name = "ConfigTerraformAdministratorRole" tags = { "CostCentre" = "cbs-871282759583" "Terraform" = "true" } # (8 unchanged attributes hidden) # (1 unchanged block hidden) } Plan: 0 to add, 1 to change, 0 to destroy. Warning: Argument is deprecated with module.log_archive_access_bucket.aws_s3_bucket.this, on .terraform/modules/log_archive_access_bucket/S3_log_bucket/main.tf line 8, in resource "aws_s3_bucket" "this": 8: resource "aws_s3_bucket" "this" { Use the aws_s3_bucket_server_side_encryption_configuration resource instead (and 7 more similar warnings elsewhere) ───────────────────────────────────────────────────────────────────────────── Saved the plan to: plan.tfplan To perform exactly these actions, run the following command to apply: terraform apply "plan.tfplan" Releasing state lock. This may take a few moments... ```
Show Conftest results ```sh WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_event_rule.cbs"] WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.event_bus_invoke_remote_event_bus"] WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.log_archive_read"] WARN - plan.json - main - Missing Common Tags: ["aws_iam_role.event_bus_invoke_remote_event_bus"] WARN - plan.json - main - Missing Common Tags: ["aws_iam_role.log_archive_read"] WARN - plan.json - main - Missing Common Tags: ["aws_kms_key.log_archive_encrypt"] WARN - plan.json - main - Missing Common Tags: ["aws_sns_topic.log_archive"] 26 tests, 19 passed, 7 warnings, 0 failures, 0 exceptions ```