TDRD-22 - Add "condition" to the trust polices

modules/consignment-api/ecs.tf

@@ -157,6 +157,11 @@ data "aws_iam_policy_document" "consignment_api_ecs_execution" {
       "arn:aws:ecr:eu-west-2:${local.ecr_account_number}:repository/consignment-api",
       var.aws_guardduty_ecr_arn
     ]
+    condition {
+      test     = "StringEquals"
+      values   = [local.ecr_account_number]
+      variable = "AWS:SourceAccount"
+    }
   }
   statement {
     actions   = ["ecr:GetAuthorizationToken"]

modules/consignment-api/templates/allow_iam_db_auth.json.tpl

@@ -6,7 +6,12 @@
       "Action": "rds-db:connect",
       "Resource": [
         "arn:aws:rds-db:eu-west-2:${account_id}:dbuser:${resource_id}/consignment_api_user"
-      ]
+      ],
+      "Condition": {
+        "StringEquals": {
+          "AWS:SourceAccount": "${account_id}"
+        }
+      }
     }
   ]
 }

modules/database-migrations/templates/migration_lambda.json.tpl

@@ -6,7 +6,12 @@
       "Action": "rds-db:connect",
       "Resource": [
         "arn:aws:rds-db:eu-west-2:${account_id}:dbuser:${instance_id}/migrations_user"
-      ]
+      ],
+      "Condition": {
+        "StringEquals": {
+          "AWS:SourceAccount": "${account_id}"
+        }
+      }
     },
     {
       "Effect": "Allow",
@@ -20,7 +25,12 @@
         "arn:aws:s3:::tdr-database-migrations/*",
         "arn:aws:s3:::tdr-database-migrations",
         "${log_group_arn}"
-      ]
+      ],
+      "Condition": {
+        "StringEquals": {
+          "AWS:SourceAccount": "${account_id}"
+        }
+      }
     },
     {
       "Effect": "Allow",
@@ -32,7 +42,12 @@
         "ec2:DescribeNetworkInterfaces",
         "autoscaling:CompleteLifecycleAction"
       ],
-      "Resource": ["*"]
+      "Resource": ["*"],
+      "Condition": {
+        "StringEquals": {
+          "AWS:SourceAccount": "${account_id}"
+        }
+      }
     }
   ]
-}
+}

modules/shared-vpc/flowlogs.tf

@@ -56,6 +56,11 @@ data "aws_iam_policy_document" "tdr_flowlog_policy" {
     resources = [
       "arn:aws:logs:*:*:log-group:/flowlogs/tdr-vpc-*"
     ]
+    condition {
+      test     = "StringEquals"
+      values   = [data.aws_caller_identity.current.account_id]
+      variable = "AWS:SourceAccount"
+    }
   }
 }
 

modules/transfer-frontend/ecs.tf

@@ -127,6 +127,11 @@ data "aws_iam_policy_document" "sns_notifications_publish" {
   statement {
     actions   = ["sns:Publish"]
     resources = [var.notification_sns_topic_arn]
+    condition {
+      test     = "StringEquals"
+      values   = [data.aws_caller_identity.current.account_id]
+      variable = "AWS:SourceAccount"
+    }
   }
 }
 
@@ -147,6 +152,11 @@ data "aws_iam_policy_document" "frontend_kms_key_use" {
       "kms:GenerateDataKey"
     ]
     resources = [var.notifications_topic_kms_key_arn]
+    condition {
+      test     = "StringEquals"
+      values   = [data.aws_caller_identity.current.account_id]
+      variable = "AWS:SourceAccount"
+    }
   }
 }
 
@@ -193,7 +203,7 @@ resource "aws_iam_policy" "frontend_draft_metadata" {
     "modules/transfer-frontend/templates/draft_metadata_policy.json.tpl", {
       environment         = var.environment,
       titleEnvironment    = title(var.environment),
-      account             = data.aws_caller_identity.current.account_id,
+      account_id          = data.aws_caller_identity.current.account_id,
       kms_bucket_key_arns = var.draft_metadata_s3_kms_keys
   })
 }
@@ -225,6 +235,11 @@ data "aws_iam_policy_document" "frontend_ecs_execution" {
       "arn:aws:logs:eu-west-2:${data.aws_caller_identity.current.account_id}:log-group:/aws/events/ecs-task-events-${var.environment}:*",
       var.aws_guardduty_ecr_arn
     ]
+    condition {
+      test     = "StringEquals"
+      values   = [data.aws_caller_identity.current.account_id]
+      variable = "AWS:SourceAccount"
+    }
   }
   statement {
     actions   = ["ecr:GetAuthorizationToken"]

modules/transfer-frontend/templates/draft_metadata_policy.json.tpl

@@ -7,6 +7,11 @@
         "kms:GenerateDataKey"
       ],
       "Effect": "Allow",
+      "Condition": {
+        "StringEquals": {
+          "AWS:SourceAccount": "${account_id}"
+        }
+      },
       "Resource": ${kms_bucket_key_arns}
     },
     {
@@ -20,7 +25,12 @@
       "Resource": [
         "arn:aws:s3:::tdr-draft-metadata-${environment}/*",
         "arn:aws:s3:::tdr-draft-metadata-${environment}"
-      ]
+      ],
+      "Condition": {
+        "StringEquals": {
+          "AWS:SourceAccount": "${account_id}"
+        }
+      }
     }
   ],
   "Version": "2012-10-17"

root_backend_checks.tf

@@ -339,5 +339,6 @@ module "backend_checks_step_function" {
     notification_lambda_arn     = module.notification_lambda.ecr_scan_notification_lambda_arn[0],
     backend_checks_bucket_arn   = module.backend_lambda_function_bucket.s3_bucket_arn
     state_machine_arn           = module.backend_checks_step_function.state_machine_arn
+    account_id                  = data.aws_caller_identity.current.account_id
   })
 }

root_consignment_export.tf

@@ -15,7 +15,7 @@ module "consignment_export_cloudwatch" {
 
 module "consignment_export_execution_role" {
   source             = "./tdr-terraform-modules/iam_role"
-  assume_role_policy = templatefile("./templates/iam_policy/ecs_assume_role_policy.json.tpl", {})
+  assume_role_policy = templatefile("./templates/iam_policy/ecs_assume_role_policy.json.tpl", { account_id = data.aws_caller_identity.current.account_id })
   common_tags        = local.common_tags
   name               = "TDRConsignmentExportECSExecutionRole${title(local.environment)}"
   policy_attachments = {
@@ -41,7 +41,8 @@ module "consignment_export_execution_policy" {
     log_group_arn             = "${module.consignment_export_cloudwatch.log_group_arn}:*",
     file_system_arn           = module.export_efs.file_system_arn,
     management_account_number = data.aws_ssm_parameter.mgmt_account_number.value,
-    aws_guardduty_ecr_arn     = local.aws_guardduty_ecr_arn
+    aws_guardduty_ecr_arn     = local.aws_guardduty_ecr_arn,
+    account_id                = data.aws_caller_identity.current.account_id
     }
   )
 }
@@ -51,6 +52,7 @@ module "consignment_export_task_policy" {
   name   = "TDRConsignmentExportECSTaskPolicy${title(local.environment)}"
   policy_string = templatefile(
     "${path.module}/templates/iam_policy/consignment_export_task_policy.json.tpl", {
+      account_id           = data.aws_caller_identity.current.account_id
       environment          = local.environment,
       titleEnvironment     = title(local.environment),
       aws_region           = local.region,

root_github.tf

@@ -58,6 +58,7 @@ module "run_update_keycloak_execution_policy" {
   source = "./tdr-terraform-modules/iam_policy"
   name   = "TDRKeycloakUpdateECSExecutionPolicy${title(local.environment)}"
   policy_string = templatefile("${path.module}/templates/iam_policy/keycloak_update_execution_policy.json.tpl", {
+    account_id                = data.aws_caller_identity.current.account_id
     log_group_arn             = module.keycloak_update_cloudwatch.log_group_arn,
     management_account_number = data.aws_ssm_parameter.mgmt_account_number.value,
     aws_guardduty_ecr_arn     = local.aws_guardduty_ecr_arn

root_keycloak.tf

@@ -10,7 +10,8 @@ module "keycloak_ecs_execution_policy" {
   policy_string = templatefile("${path.module}/templates/iam_policy/keycloak_ecs_execution_policy.json.tpl", {
     cloudwatch_log_group  = module.keycloak_cloudwatch.log_group_arn,
     ecr_account_number    = local.ecr_account_number,
-    aws_guardduty_ecr_arn = local.aws_guardduty_ecr_arn
+    aws_guardduty_ecr_arn = local.aws_guardduty_ecr_arn,
+    account_id            = data.aws_caller_identity.current.account_id
   })
 }
 

root_transfer_service.tf

@@ -11,7 +11,7 @@ locals {
 module "transfer_service_execution_role" {
   count              = local.transfer_service_count
   source             = "./da-terraform-modules/iam_role"
-  assume_role_policy = templatefile("./templates/iam_policy/ecs_assume_role_policy.json.tpl", {})
+  assume_role_policy = templatefile("./templates/iam_policy/ecs_assume_role_policy.json.tpl", { account_id = data.aws_caller_identity.current.account_id })
   tags               = local.common_tags
   name               = "TDRTransferServiceECSExecutionRole${title(local.environment)}"
   policy_attachments = {
@@ -23,7 +23,7 @@ module "transfer_service_execution_role" {
 module "transfer_service_task_role" {
   count              = local.transfer_service_count
   source             = "./da-terraform-modules/iam_role"
-  assume_role_policy = templatefile("./templates/iam_policy/ecs_assume_role_policy.json.tpl", {})
+  assume_role_policy = templatefile("./templates/iam_policy/ecs_assume_role_policy.json.tpl", { account_id = data.aws_caller_identity.current.account_id })
   tags               = local.common_tags
   name               = "TDRTransferServiceECSTaskRole${title(local.environment)}"
   policy_attachments = {

templates/iam_policy/allow_iam_db_auth.json.tpl

@@ -10,7 +10,12 @@
       "Resource": [
         "arn:aws:logs:eu-west-2:${account_id}:log-group:/aws/lambda/${function_name}",
         "arn:aws:logs:eu-west-2:${account_id}:log-group:/aws/lambda/${function_name}:log-stream:*"
-      ]
+      ],
+      "Condition": {
+        "StringEquals": {
+          "AWS:SourceAccount": "${account_id}"
+        }
+      }
     },
     {
       "Effect": "Allow",
@@ -19,14 +24,24 @@
         "ec2:DeleteNetworkInterface",
         "ec2:DescribeNetworkInterfaces"
       ],
-      "Resource": "*"
+      "Resource": "*",
+      "Condition": {
+        "StringEquals": {
+          "AWS:SourceAccount": "${account_id}"
+        }
+      }
     },
     {
       "Effect": "Allow",
       "Action": "rds-db:connect",
       "Resource": [
         "arn:aws:rds-db:eu-west-2:${account_id}:dbuser:${resource_id}/${user_name}"
-      ]
+      ],
+      "Condition": {
+        "StringEquals": {
+          "AWS:SourceAccount": "${account_id}"
+        }
+      }
     },
     {
       "Effect": "Allow",
@@ -38,14 +53,24 @@
       "Resource": [
         "arn:aws:s3:::${bucket_name}",
         "arn:aws:s3:::${bucket_name}/*"
-      ]
+      ],
+      "Condition": {
+        "StringEquals": {
+          "AWS:SourceAccount": "${account_id}"
+        }
+      }
     },
     {
       "Effect": "Allow",
       "Action": [
         "ssm:GetParameter"
       ],
-      "Resource": "arn:aws:ssm:eu-west-2:${account_id}:parameter${parameter_name}"
+      "Resource": "arn:aws:ssm:eu-west-2:${account_id}:parameter${parameter_name}",
+      "Condition": {
+        "StringEquals": {
+          "AWS:SourceAccount": "${account_id}"
+        }
+      }
     }
   ]
 }

templates/iam_policy/api_gateway_state_machine_policy.json.tpl

@@ -10,7 +10,12 @@
       "Resource": [
         "arn:aws:logs:eu-west-2:${account_id}:log-group:*",
         "arn:aws:logs:eu-west-2:${account_id}:log-group:*:*"
-      ]
+      ],
+      "Condition": {
+        "StringEquals": {
+          "AWS:SourceAccount": "${account_id}"
+        }
+      }
     },
     {
       "Effect": "Allow",
@@ -19,7 +24,12 @@
       ],
       "Resource": [
         "${state_machine_arn}"
-      ]
+      ],
+      "Condition": {
+        "StringEquals": {
+          "AWS:SourceAccount": "${account_id}"
+        }
+      }
     }
   ]
 }

templates/iam_policy/backend_check_policy.json.tpl

@@ -16,7 +16,12 @@
         "${redacted_files_lambda_arn}",
         "${statuses_lambda_arn}",
         "${yara_av_v2_lambda_arn}"
-      ]
+      ],
+      "Condition": {
+        "StringEquals": {
+          "AWS:SourceAccount": "${account_id}"
+        }
+      }
     },
     {
       "Effect": "Allow",
@@ -32,7 +37,12 @@
         "${backend_checks_bucket_arn}/*",
         "${backend_checks_bucket_arn}",
         "${state_machine_arn}"
-      ]
+      ],
+      "Condition": {
+        "StringEquals": {
+          "AWS:SourceAccount": "${account_id}"
+        }
+      }
     },
     {
       "Effect": "Allow",
@@ -42,7 +52,12 @@
         "xray:GetSamplingRules",
         "xray:GetSamplingTargets"
       ],
-      "Resource": "*"
+      "Resource": "*",
+      "Condition": {
+        "StringEquals": {
+          "AWS:SourceAccount": "${account_id}"
+        }
+      }
     }
   ]
 }