We would like to take over managing notification.canada.ca using our own terraform rep

The policy code for part 1 will look similar to: <div class="snippet-clipboard-con

PR has been created to address this issue here - <a class="issue-link js-issue-link" d

Notification.Canada.Ca Write access about dns HOT 3 CLOSED

ben851 commented on July 28, 2024

Notification.Canada.Ca Write access

from dns.

Comments (3)

sylviamclaughlin commented on July 28, 2024

To accomplish the above, we will need to create an IAM role in the Canadian Digital Services AWS account. The IAM policy will need to have the following:

Have ability to mange notification.canada.ca hosted zone records but NOT the hosted zone itself.
Have a trust policy allowing the role to be asumed by the OIDC Github role running prod terraform apply.

from dns.

sylviamclaughlin commented on July 28, 2024

The policy code for part 1 will look similar to:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "route53:ListResourceRecordSets",
        "route53:ChangeResourceRecordSets",
        "route53:GetChange"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:route53:::hostedzone/HOSTED_ZONE_ID_FOR_NOTIFICATION_CANADA_CA"
    },
    {
      "Action": [
        "route53:ListHostedZones",
        "route53:GetHostedZoneCount",
        "route53:ListHostedZonesByName"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}

For the second part, we will need to modify the notification_apply_oidc role to contain the following:

data "aws_iam_policy_document" "assume_dns_manager" {
  statement {
    sid = "AssumeProdDNSManagerRoles"

    actions = [
      "sts:AssumeRole",
    ]

    resources = [
      "arn:aws:iam::CanadianDigitalServicesAWSAccountID:role/prod_dns_manager"
    ]
  }
}

resource "aws_iam_policy" "assume_prod_dns_manager" {
  name   = terrafrom_apply_oidc_role
  policy = data.aws_iam_policy_document.assume_dns_manager.json
}

resource "aws_iam_role_policy_attachment" "assume_prod_dns_manager" {
  role       = terrafrom_apply_oidc_role
  policy_arn = aws_iam_policy.assume_prod_dns_manager.arn
}

from dns.

sylviamclaughlin commented on July 28, 2024

PR has been created to address this issue here - #397

from dns.

Recommend Projects