Permissions boundary

infra/modules/deployer-access/permissions-boundary-policy.tf

@@ -0,0 +1,91 @@
+resource "aws_iam_policy" "permissions_boundary" {
+  name        = "deployer-${var.environment_name}-boundary"
+  policy      = data.aws_iam_policy_document.permissions_boundary.json
+  description = "Permissions boundary for non-human role"
+  path        = "/permissions_boundaries/"
+}
+
+data "aws_iam_policy_document" "permissions_boundary" {
+  #checkov:skip=CKV2_AWS_40:addressing in future commit
+  #checkov:skip=CKV_AWS_107:addressing in future commit
+  #checkov:skip=CKV_AWS_108:addressing in future commit
+  #checkov:skip=CKV_AWS_109:addressing in future commit
+  #checkov:skip=CKV_AWS_110:addressing in future commit
+  #checkov:skip=CKV_AWS_111:addressing in future commit
+  #checkov:skip=CKV_AWS_356:addressing in future commit
+  statement {
+    resources = ["*"]
+    effect    = "Allow"
+    actions = [
+      "acm:*",
+      "application-autoscaling:*",
+      "application-signals:*",
+      "cloudformation:*",
+      "cloudfront:*",
+      "cloudwatch:*",
+      "codebuild:*",
+      "codecommit:*",
+      "codepipeline:*",
+      "codestar-connections:*",
+      "ec2:*",
+      "ecr:*",
+      "ecs:*",
+      "elasticache:*",
+      "elasticloadbalancing:*",
+      "events:*",
+      "guardduty:*",
+      "iam:*",
+      "kms:*",
+      "lambda:*",
+      "logs:*",
+      "rds:*",
+      "route53:*",
+      "s3:*",
+      "secretsmanager:*",
+      "ses:*",
+      "shield:*",
+      "sns:*",
+      "sqs:*",
+      "ssm:*",
+      "wafv2:*",
+      "xray:*",
+    ]
+
+  }
+
+  statement {
+    sid    = "AllowAssumeRoleOnSpecificRoles"
+    effect = "Allow"
+    actions = [
+      "sts:AssumeRole"
+    ]
+    # forms-runner-ecs-task assumes submissions-to-s3; codebuild-e2e-tests assumes s3-end-to-end-test
+    resources = [
+      "arn:aws:iam::${var.account_id}:role/govuk-forms-submissions-to-s3-*",
+      "arn:aws:iam::${var.account_id}:role/govuk-s3-end-to-end-test-*",
+    ]
+  }
+
+  statement {
+    sid    = "DenyBoundaryPolicyModification"
+    effect = "Deny"
+    actions = [
+      "iam:CreatePolicyVersion",
+      "iam:DeletePolicy",
+      "iam:DeletePolicyVersion",
+      "iam:SetDefaultPolicyVersion"
+    ]
+    resources = [
+    "arn:aws:iam::${var.account_id}:policy/permissions_boundaries/deployer-${var.environment_name}-boundary"]
+  }
+
+  statement {
+    sid    = "DenyBoundaryRemoval"
+    effect = "Deny"
+    actions = [
+      "iam:DeleteRolePermissionsBoundary",
+      "iam:DeleteUserPermissionBoundary"
+    ]
+    resources = ["*"]
+  }
+}

infra/modules/deployer-access/policy.tf

@@ -489,6 +489,11 @@ data "aws_iam_policy_document" "iam" {
       "iam:PutRolePolicy",
       "iam:TagRole"
     ]
+    condition {
+      variable = "iam:PermissionsBoundary"
+      test     = "StringEquals"
+      values   = [aws_iam_policy.permissions_boundary.arn]
+    }
     effect = "Allow"
     resources = [
       "arn:aws:iam::${var.account_id}:policy/codebuild-*",
@@ -514,6 +519,11 @@ data "aws_iam_policy_document" "iam" {
       "iam:UpdateAssumeRolePolicy",
       "iam:TagRole"
     ]
+    condition {
+      variable = "iam:PermissionsBoundary"
+      test     = "StringEquals"
+      values   = [aws_iam_policy.permissions_boundary.arn]
+    }
     effect = "Allow"
     resources = [
       "arn:aws:iam::${var.account_id}:role/${var.environment_name}-forms-admin-ecs-task",
@@ -540,6 +550,11 @@ data "aws_iam_policy_document" "iam" {
       "iam:TagRole",
       "iam:UpdateRole"
     ]
+    condition {
+      variable = "iam:PermissionsBoundary"
+      test     = "StringEquals"
+      values   = [aws_iam_policy.permissions_boundary.arn]
+    }
     effect = "Allow"
     resources = [
       "arn:aws:iam::${var.account_id}:role/shield-response-team",
@@ -561,6 +576,11 @@ data "aws_iam_policy_document" "iam" {
       "iam:UpdateAssumeRolePolicy",
       "iam:UpdateRole"
     ]
+    condition {
+      variable = "iam:PermissionsBoundary"
+      test     = "StringEquals"
+      values   = [aws_iam_policy.permissions_boundary.arn]
+    }
     effect = "Allow"
     resources = [
       "arn:aws:iam::${var.account_id}:role/govuk-forms-submissions-to-s3-${var.environment_name}",

infra/modules/deployer-access/roles.tf

@@ -24,4 +24,6 @@ data "aws_iam_policy_document" "assume_role" {
 resource "aws_iam_role" "deployer" {
   name               = "deployer-${var.environment_name}"
   assume_role_policy = data.aws_iam_policy_document.assume_role.json
+
+  permissions_boundary = aws_iam_policy.permissions_boundary.arn
 }