KEH-2460 - Concourse IAM Refactor (#87)

* chore: bump deps

* docs: update README

* chore: remove unused tfvars

* refactor(concourse): Use IAM Roles instead of users

Author: TotalDwarf03

README.md

@@ -215,7 +215,7 @@ changes to Concourse instance itself. Make sure to export all necessary environm
 
 #### Setting up a pipeline
 
-When setting up our pipelines, we use ecs-infra-user on sdp-dev to be able to interact with our infrastructure on AWS. The credentials for this are stored on
+When setting up our pipelines, we use IAM roles to be able to interact with our infrastructure on AWS. The credentials for this are stored on
 AWS Secrets Manager so you do not need to set up anything yourself.
 
 To set the pipeline, run the following script:

concourse/ci.yml

@@ -57,6 +57,7 @@ terraform-task: &terraform-task
       secrets: ((sdp_((env))_copilot_usage_lambda_secrets))
       # kics-scan ignore-line
       github_access_token: ((github_access_token))
+      aws_role_arn: arn:aws:iam::((aws_account_sdp_((env)))):role/sdp-concourse-((env))
       env: ((env))
       branch: ((branch))
     run:
@@ -76,7 +77,9 @@ terraform-task: &terraform-task
             echo "ERROR: Tag '$tag' is not in semantic versioning format (vX.Y.Z)"
             exit 1
           fi
+          chmod u+x ./resource-repo/concourse/scripts/assume_role.sh
           chmod u+x ./resource-repo/concourse/scripts/terraform_infra.sh
+          source ./resource-repo/concourse/scripts/assume_role.sh
           ./resource-repo/concourse/scripts/terraform_infra.sh
     timeout: 30m
 

concourse/scripts/terraform_infra.sh

@@ -6,23 +6,15 @@ set -euo pipefail
 
 apk add --no-cache jq
 
-aws_account_id=$(echo "$secrets" | jq -r .aws_account_id)
-aws_access_key_id=$(echo "$secrets" | jq -r .aws_access_key_id)
-aws_secret_access_key=$(echo "$secrets" | jq -r .aws_secret_access_key)
-
 lambda_name=$(echo "$secrets" | jq -r .lambda_name)
 env_name=$(echo "$secrets" | jq -r .env_name)
-ecr_repository=$(echo "$secrets" | jq -r .ecr_repository)
 
 lambda_timeout=$(echo "$secrets" | jq -r .lambda_timeout)
 
 github_app_client_id=$(echo "$secrets" | jq -r .github_app_client_id)
 aws_secret_name=$(echo "$secrets" | jq -r .aws_secret_name)
 github_org=$(echo "$secrets" | jq -r .github_org)
 
-export AWS_ACCESS_KEY_ID="$aws_access_key_id"
-export AWS_SECRET_ACCESS_KEY="$aws_secret_access_key"
-
 # kingfisher:ignore
 git config --global url."https://x-access-token:$github_access_token@github.com/".insteadOf "https://github.com/"
 
@@ -39,15 +31,11 @@ terraform init -backend-config=env/"${env}"/backend-"${env}".tfbackend -reconfig
 # The following terraform-apply may need to change if the environment variables change
 
 terraform apply \
-	-var "aws_account_id=$aws_account_id" \
-	-var "aws_access_key_id=$aws_access_key_id" \
-	-var "aws_secret_access_key=$aws_secret_access_key" \
 	-var "env_name=$env_name" \
 	-var "lambda_name=${lambda_name}" \
 	-var "github_app_client_id=$github_app_client_id" \
 	-var "aws_secret_name=$aws_secret_name" \
 	-var "github_org=$github_org" \
 	-var "lambda_timeout=${lambda_timeout}" \
-	-var "ecr_repository=${ecr_repository}" \
 	-var "container_ver=${tag}" \
 	-auto-approve

poetry.lock

@@ -2,6 +2,8 @@ data "aws_ecr_repository" "profile_lambda_ecr_repo" {
   name = local.lambda_repo
 }
 
+data "aws_caller_identity" "current" {}
+
 data "aws_ecr_image" "lambda_image" {
   repository_name = data.aws_ecr_repository.profile_lambda_ecr_repo.name
   image_tag       = var.container_ver

terraform/data.tf

@@ -1,14 +1,15 @@
 # Do NOT commit the real tfvars file to GitHub
-aws_account_id          = "99999999999"
-aws_access_key_id       = "AWSACCCESSKEYID"
-aws_secret_access_key   = "AWSSECRETASSOCIATEDWITHACCESSKEY"
 aws_secret_name         = "sdp/pem"
 env_name                = "sdp-dev"
 lambda_name             = "copilot-usage-lambda"
 lambda_arch             = "x86_64"
 lambda_timeout          = 300
 schedule                = "cron(0 6 ? * 2 *)"
+log_retention_days      = 30
 github_org              = "ONS-Innovation"
 github_app_client_id    = "123456789"
-ecr_repository          = "sdp-dev-address-book-lambda"
-container_ver           = "v1.0.0"
+region                  = "eu-west-2"
+container_ver           = "v1.0.0"
+project_tag             = "SDP"
+team_owner_tag          = "Knowledge Exchange Hub"
+business_owner_tag      = "DST"

terraform/env/dev/example_tfvars.txt

@@ -0,0 +1,15 @@
+# Do NOT commit the real tfvars file to GitHub
+aws_secret_name         = "sdp/pem"
+env_name                = "sdp-prod"
+lambda_name             = "copilot-usage-lambda"
+lambda_arch             = "x86_64"
+lambda_timeout          = 300
+schedule                = "cron(0 6 ? * 2 *)"
+log_retention_days      = 30
+github_org              = "ONS-Innovation"
+github_app_client_id    = "123456789"
+region                  = "eu-west-2"
+container_ver           = "v1.0.0"
+project_tag             = "SDP"
+team_owner_tag          = "Knowledge Exchange Hub"
+business_owner_tag      = "DST"

terraform/env/prod/example_tfvars.txt

@@ -80,12 +80,12 @@ resource "aws_iam_role" "lambda_function_role" {
         Action = "sts:AssumeRole"
         Effect = "Allow"
         Principal = {
-          AWS = "arn:aws:iam::${var.aws_account_id}:root"
+          AWS = "arn:aws:iam::${local.aws_account_id}:root"
         }
         Condition = {
           ArnLike = {
             "aws:PrincipalArn" = [
-              "arn:aws:iam::${var.aws_account_id}:role/aws-reserved/sso.amazonaws.com/eu-west-2/AWSReservedSSO_Standard_Administrator_Access_*"
+              "arn:aws:iam::${local.aws_account_id}:role/aws-reserved/sso.amazonaws.com/eu-west-2/AWSReservedSSO_Standard_Administrator_Access_*"
             ]
           }
         }

terraform/main.tf

@@ -1,18 +1,3 @@
-variable "aws_account_id" {
-  description = "AWS Account ID"
-  type        = string
-}
-
-variable "aws_access_key_id" {
-  description = "AWS Access Key ID"
-  type        = string
-}
-
-variable "aws_secret_access_key" {
-  description = "AWS Secret Access Key"
-  type        = string
-}
-
 variable "aws_secret_name" {
   description = "The path to the AWS Secret Manager resource which contains the Github App .pem file"
   type        = string
@@ -71,11 +56,6 @@ variable "region" {
   default     = "eu-west-2"
 }
 
-variable "ecr_repository" {
-  description = "Name of the ECR repository containing the Lambda image"
-  type        = string
-}
-
 variable "container_ver" {
   description = "Container tag"
   type        = string
@@ -100,5 +80,6 @@ variable "business_owner_tag" {
 }
 
 locals {
-  lambda_repo = "${var.env_name}-${var.lambda_name}"
+  aws_account_id = data.aws_caller_identity.current.account_id
+  lambda_repo    = "${var.env_name}-${var.lambda_name}"
 }