Merge pull request #113 from uktrade/feat/use-role-rather-than-creds-…

…for-data-flow-bucket-access feat: use role-based perms with temporary creds for data-flow bucket access
uktrade · Jul 25, 2024 · f4b673a · f4b673a
2 parents 4b92c1a + 6ed7c3b
commit f4b673a
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 64 deletions.
diff --git a/infra/airflow_dag_processor.tf b/infra/airflow_dag_processor.tf
@@ -225,4 +225,27 @@ data "aws_iam_policy_document" "airflow_team" {
       "arn:aws:secretsmanager:${data.aws_region.aws_region.name}:${data.aws_caller_identity.aws_caller_identity.account_id}:secret:${var.prefix}/airflow/${var.airflow_dag_processors[count.index]}-*"
     ]
   }
+
+  statement {
+    actions = [
+      "s3:PutObject",
+      "s3:GetObject",
+      "s3:DeleteObject"
+    ]
+
+    resources = [
+      "${aws_s3_bucket.airflow[count.index].arn}/*",
+    ]
+  }
+
+  statement {
+    actions = [
+      "s3:GetBucketLocation",
+      "s3:ListBucket",
+    ]
+
+    resources = [
+      "${aws_s3_bucket.airflow[count.index].arn}",
+    ]
+  }
 }
diff --git a/infra/airflow_s3.tf b/infra/airflow_s3.tf
@@ -55,67 +55,3 @@ data "aws_iam_policy_document" "airflow" {
     }
   }
 }
-
-resource "aws_iam_access_key" "airflow_s3" {
-  count = var.airflow_on ? length(var.airflow_dag_processors) : 0
-  user  = aws_iam_user.airflow_s3[count.index].name
-}
-
-resource "aws_iam_user" "airflow_s3" {
-  count = var.airflow_on ? length(var.airflow_dag_processors) : 0
-  name  = aws_s3_bucket.airflow[count.index].id
-}
-
-data "aws_iam_policy_document" "airflow_s3" {
-  count = var.airflow_on ? length(var.airflow_dag_processors) : 0
-  statement {
-    actions = [
-      "s3:PutObject",
-      "s3:GetObject",
-      "s3:DeleteObject"
-    ]
-
-    resources = [
-      "${aws_s3_bucket.airflow[count.index].arn}/*",
-    ]
-  }
-
-  statement {
-    actions = [
-      "s3:GetBucketLocation",
-      "s3:ListBucket",
-    ]
-
-    resources = [
-      "${aws_s3_bucket.airflow[count.index].arn}",
-    ]
-  }
-}
-
-resource "aws_iam_user_policy" "airflow_s3" {
-  count  = var.airflow_on ? length(var.airflow_dag_processors) : 0
-  name   = aws_s3_bucket.airflow[count.index].id
-  user   = aws_iam_user.airflow_s3[count.index].name
-  policy = data.aws_iam_policy_document.airflow_s3[count.index].json
-}
-
-output "airflow_s3_bucket_name" {
-  value       = aws_s3_bucket.airflow.*.id
-  description = "Name of the bucket used for Airflow ingest"
-}
-
-output "airflow_s3_bucket_region" {
-  value       = aws_s3_bucket.airflow.*.region
-  description = "Region of the bucket used for Airflow ingest"
-}
-
-output "airflow_s3_access_key_id" {
-  value       = aws_iam_access_key.airflow_s3.*.id
-  description = "Name of the Access key ID used for Airflow ingest"
-}
-
-output "airflow_s3_access_key_secret" {
-  value       = aws_iam_access_key.airflow_s3.*.secret
-  description = "Access key secret used for Airflow ingest"
-  sensitive   = true
-}