assume-role-mfa.config.yaml

iam_policies:
  secretmanager:
    action:
      - secretsmanager:DescribeSecret
      - secretsmanager:GetSecretValue
      - secretsmanager:PutSecretValue
      - secretsmanager:TagResource
      - secretsmanager:UntagResource
      - secretsmanager:UpdateSecretVersionStage
    resource:
      - Fn::Sub: arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:/${EnvironmentName}/jenkins/mfa/*
    condition:
      StringLike:
        secretsmanager:resource/AllowRotationLambdaArn: 
          Fn::Sub: 'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${EnvironmentName}-ciinabox-mfa-iam-access-key-rotator'
  iam-manage-keys:
    action:
      - iam:CreateAccessKey
      - iam:DeleteAccessKey
      - iam:ListAccessKeys
    resource:
      - Fn::Sub: arn:aws:iam::${AWS::AccountId}:user/ciinabox/mfa/*
    condition:
      StringEquals:
        iam:ResourceTag/ciinabox:name:
          Ref: EnvironmentName
  logging:
    action:
      - logs:CreateLogGroup
      - logs:CreateLogStream
      - logs:PutLogEvents
      - logs:DescribeLogStreams
      - logs:DescribeLogGroups
    resource:
      - arn:aws:logs:*:*:*
    
key_rotator:
  roles: {}
  functions:
    CiinaboxKeyRotator:
      named: true
      function_name:
        Fn::Sub: ${EnvironmentName}-ciinabox-mfa-iam-access-key-rotator
      code: key_rotator
      handler: app.lambda_handler
      runtime: python3.11
      timeout: 30
      role: KeyRotator
      allowed_sources:
        - principal: secretsmanager.amazonaws.com