iam.yml

AWSTemplateFormatVersion: 2010-09-09
Description: >-
  Define IAM Roles utilized to build, deploy, and operate the Javabuilder service.
  Note: CAPABILITY_IAM capability is required to deploy this stack.

Parameters:
  ArtifactBucket:
    Type: String
    Description: Name of existing S3 bucket for storing pipeline artifacts
  TemplateBucket:
    Type: String
    Description: Name of existing S3 bucket for storing CloudFormation template artifacts
  JavabuilderApiId:
    Type: String
    Description: The API ID of the Javabuilder API Gateway V2 Api
    Default: "*"

Resources:
  # Permissions for the long-running lambda that compiles/runs student projects
  BuildAndRunLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Statement:
          - Action: ['sts:AssumeRole']
            Effect: Allow
            Principal: {Service: [lambda.amazonaws.com]}
      ManagedPolicyArns:
        - !Ref JavabuilderLoggingPolicy
      Policies:
        - PolicyName: BuildAndRunLambdaExecutionPolicy
          PolicyDocument:
            Statement:
              # BuildAndRunJavaProject Lambda needs to put objects to the content bucket.
              - Effect: Allow
                Action:
                  - 's3:PutObject'
                  - 's3:GetObject'
                Resource: 'arn:aws:s3:::cdo-*javabuilder*-content/*'
              # Read from Javabuilder SQS Queue
              - Effect: Allow
                Action:
                  - "sqs:ReceiveMessage"
                  - "sqs:DeleteMessage"
                  # May need the following
                  # - "sqs:GetQueueAttributes"
                  # - "sqs:GetQueueUrl"
                  # - "sqs:ListDeadLetterSourceQueues"
                  # - "sqs:ListQueues"
                Resource:
                  # TODO: limit this
                  - '*' 
              - Effect: Allow
                Action:
                  - "execute-api:Invoke"
                  - "execute-api:ManageConnections"
                Resource:
                  - !Sub "arn:aws:execute-api:*:${AWS::AccountId}:${JavabuilderApiId}/*"
              # Build and Run Lambdas need to be able to write metrics to CloudWatch
              - Effect: Allow
                Action:
                  - 'cloudwatch:PutMetricData'
                Resource:
                  - '*'
              # Build and Run lambdas need read and delete DynamoDB records to check container health status
              - Effect: Allow
                Action:
                  - 'dynamodb:GetItem'
                  - 'dynamodb:Query'
                  - 'dynamodb:DeleteItem'
                Resource:
                  - !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/*_unhealthy_containers"

  # Permissions for the synchronous Lambda that invokes the long-running Lambda
  # and then relays web messages to it
  SessionManagerMessageRelayLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Statement:
          - Action: ['sts:AssumeRole']
            Effect: Allow
            Principal: {Service: [lambda.amazonaws.com]}
      ManagedPolicyArns:
        - !Ref JavabuilderLoggingPolicy
      Policies:
        - PolicyName: SessionManagerMessageRelayLambdaRole
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - "sqs:CreateQueue"
                  - "sqs:DeleteQueue"
                  - "sqs:SendMessage"
                  # May need the following
                  # - "sqs:ReceiveMessage"
                  # - "sqs:DeleteMessage"
                  # - "sqs:GetQueueAttributes"
                Resource: '*'
              # Allow invoking of the Build & Run Lambda
              - Effect: Allow
                Action:
                  - "lambda:InvokeFunction"
                Resource:
                  # TODO: limit this
                  - "*"
              # Allow posting to API Gateway
              - Effect: Allow
                Action:
                  - "execute-api:Invoke"
                  - "execute-api:ManageConnections"
                Resource: !Sub "arn:aws:execute-api:*:${AWS::AccountId}:${JavabuilderApiId}/*"
  
  # Permissions for the Lambda Authorizer
  AuthorizerLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Statement:
          - Action: ['sts:AssumeRole']
            Effect: Allow
            Principal: {Service: [lambda.amazonaws.com]}
      ManagedPolicyArns:
        - !Ref JavabuilderLoggingPolicy
      Policies:
        - PolicyName: AuthorizerLambdaExecutionPolicy
          PolicyDocument:
            Statement:
              # Authorizer lambdas need to create, read, and update dynamodb records for throttling.
              - Effect: Allow
                Action:
                  - 'dynamodb:GetItem'
                  - 'dynamodb:PutItem'
                  - 'dynamodb:Query'
                  - 'dynamodb:UpdateItem'
                Resource:
                  - !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/*_blocked_users"
                  - !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/*_teacher_associated_requests"
                  - !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/*_tokens"
                  - !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/*_user_requests"
              # Allow monitoring of throttling in CloudWatch.
              - Effect: Allow
                Action:
                  - 'cloudwatch:PutMetricData'
                Resource:
                  - '*'

  # Permissions for the lambda that uploads student code to S3
  PutSourcesLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Statement:
          - Action: ['sts:AssumeRole']
            Effect: Allow
            Principal: {Service: [lambda.amazonaws.com]}
      ManagedPolicyArns:
        - !Ref JavabuilderLoggingPolicy
      Policies:
        - PolicyName: named
          PolicyDocument:
            Statement:
              # Put objects to the content bucket.
              - Effect: Allow
                Action:
                  - 's3:putObject'
                Resource: 'arn:aws:s3:::cdo-*javabuilder*-content/*'

  # Shared permissions that several lambdas need
  JavabuilderLoggingPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: JavabuilderLoggingPolicy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - "logs:CreateLogGroup"
            Resource: !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:*
          - Effect: Allow
            Action:
              - "logs:CreateLogStream"
              - "logs:PutLogEvents"
            Resource:
              - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/javabuilder*
          - Effect: Allow
            Action:
              - "xray:PutTraceSegments"
              - "xray:PutTelemetryRecords"
              - "xray:GetSamplingRules"
              - "xray:GetSamplingTargets"
              - "xray:GetSamplingStatisticSummaries"
            Resource: '*'

  # Original shared lambda execution role, replaced by the roles above
  # TODO: remove all usages and delete this role
  JavabuilderLambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: ['sts:AssumeRole']
            Effect: Allow
            Principal: {Service: [lambda.amazonaws.com]}
      Path: /
      Policies:
        - PolicyName: JavabuilderLambdaExecutionPolicy
          PolicyDocument:
            Statement:
              # CodePipeline Slack Approval Lambda
              - Effect: Allow
                Action:
                  - "codepipeline:GetPipelineState"
                  - "codepipeline:GetPipelineExecution"
                  - "codepipeline:PutApprovalResult"
                  - "cloudformation:DescribeStacks"
                Resource: '*'

              # BuildAndRunJavaProject Lambda needs to put objects to the content bucket.
              - Effect: Allow
                Action:
                  - 's3:PutObject'
                Resource: 'arn:aws:s3:::cdo-*javabuilder*-content/*'

              # All Lambdas need logging permissions.
              - Effect: Allow
                Action:
                  - "logs:CreateLogGroup"
                Resource: '*'
              - Effect: Allow
                Action:
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
                Resource:
                  - 'arn:aws:logs:::log-group:/aws/lambda/javabuilder*'
              - Effect: Allow
                Action:
                  - "xray:PutTraceSegments"
                  - "xray:PutTelemetryRecords"
                Resource: '*'

              # Authorizer lambdas need to create, read, and update dynamodb records for throttling.
              - Effect: Allow
                Action:
                  - 'dynamodb:GetItem'
                  - 'dynamodb:PutItem'
                  - 'dynamodb:UpdateItem'
                  - 'dynamodb:Query'
                Resource:
                  - !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/*_tokens"
                  - !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/*_user_requests"
                  - !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/*_teacher_associated_requests"
                  - !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/*_blocked_users"
      ManagedPolicyArns:
        # Invoke and relay messages to Project Lambda.
        - "arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess"
        - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
        - "arn:aws:iam::aws:policy/service-role/AWSLambdaRole"
        # TODO: Restrict SQS permissions to minimum required.
        - "arn:aws:iam::aws:policy/AmazonSQSFullAccess"

        # Compile and Run Project Lambda.
        # TODO: Restrict SQS permissions to minimum required.
        - "arn:aws:iam::aws:policy/service-role/AWSLambdaSQSQueueExecutionRole"
        - "arn:aws:iam::aws:policy/AmazonAPIGatewayInvokeFullAccess"

  JavabuilderAPIGatewayRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: ['sts:AssumeRole']
            Effect: Allow
            Principal: {Service: [apigateway.amazonaws.com]}
      Path: /
      Policies:
        - PolicyName: JavabuilderAPIGatewayPolicy
          PolicyDocument:
            Statement:
              # Grant the Javabuilder API Gateway permission to invoke its Lambda Authorizer.
              - Effect: Allow
                Action:
                  - "lambda:InvokeFunction"
                Resource:
                  - !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:javabuilder*" #TODO: Restrict this further to just Lambda Authorizers?
              # Grant API Gateway permission to publish CloudWatch Logs
              - Effect: Allow
                Action:
                  - 'logs:CreateLogGroup'
                  - 'logs:CreateLogStream'
                  - 'logs:PutRetentionPolicy'
                  - 'logs:PutLogEvents'
                Resource:
                  - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/apigateway/*"
                  - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/apigateway/"
                  - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/apigateway/*:log-stream:*"
                  # TODO: Restrict to just Javabuilder log-groups and log-streams.
                  - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*"
                  - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*:log-stream:*"

  JavabuilderCloudFormationRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: ['sts:AssumeRole']
            Effect: Allow
            Principal: {Service: [cloudformation.amazonaws.com]}
        Version: '2012-10-17'
      Path: /
      Policies:
        - PolicyName: ManageResourcesAccess
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - "apigateway:*"
                  - "lambda:*"
                  - "cloudformation:*"
                  - "acm:*"
                  - "route53:*"
                  - "cloudfront:*"
                Resource: '*'
              - Effect: Allow
                Action:
                  - "s3:GetObject"
                Resource:
                  - !Sub "arn:aws:s3:::${TemplateBucket}/*"
              - Effect: Allow
                Action:
                  - "s3:*"
                Resource:
                  - "arn:aws:s3:::cdo-*javabuilder*-content"
              - Effect: Allow
                Action:
                  - "iam:PassRole"
                Resource:
                  - !GetAtt JavabuilderLambdaExecutionRole.Arn
                  - !GetAtt BuildAndRunLambdaRole.Arn
                  - !GetAtt SessionManagerMessageRelayLambdaRole.Arn
                  - !GetAtt AuthorizerLambdaRole.Arn
                  - !GetAtt PutSourcesLambdaRole.Arn
              # Grant CloudFormation permission to create CloudWatch Log Group for API Gateway.
              - Effect: Allow
                Action:
                  - 'logs:CreateLogGroup'
                  - 'logs:CreateLogStream'
                  - 'logs:PutRetentionPolicy'
                Resource:
                  - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/apigateway/*"
                  - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/apigateway/"
                  - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/apigateway/*:log-stream:*"
              - Effect: Allow
                Action:
                  - 'dynamodb:CreateTable'
                Resource:
                  - !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/*"

  JavabuilderCodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: ['sts:AssumeRole']
            Effect: Allow
            Principal: {Service: [codebuild.amazonaws.com]}
        Version: '2012-10-17'
      Path: /service-role/
      Policies:
        - PolicyName: CodeBuildResourcesAccess
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - "logs:CreateLogGroup"
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
                Resource:
                  - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/*"
              - Effect: Allow
                Action:
                  - "s3:*"
                Resource:
                  - !Sub "arn:aws:s3:::${ArtifactBucket}/*"
                  - !Sub "arn:aws:s3:::${ArtifactBucket}"
                  - !Sub "arn:aws:s3:::${TemplateBucket}/*"
                  - !Sub "arn:aws:s3:::${TemplateBucket}"
              - Effect: Allow
                Action:
                  - "cloudformation:DescribeStacks"
                Resource: '*'
              - Effect: Allow
                Action:
                  - "route53:ListHostedZonesByName"
                Resource: '*'

Outputs:
  JavabuilderLambdaExecutionRole:
    Description: Javabuilder Lambda Execution Role ARN
    Value: !GetAtt JavabuilderLambdaExecutionRole.Arn
    Export: {Name: JavabuilderLambdaExecutionRole}
  BuildAndRunLambdaRole:
    Description: Javabuilder BuildAndRun Lambda Execution Role ARN
    Value: !GetAtt BuildAndRunLambdaRole.Arn
    Export: {Name: JavabuilderBuildAndRunLambdaRole}
  SessionManagerMessageRelayLambdaRole:
    Description: Javabuilder BuildAndRun Lambda Execution Role ARN
    Value: !GetAtt SessionManagerMessageRelayLambdaRole.Arn
    Export: {Name: JavabuilderSessionManagerMessageRelayLambdaRole}
  AuthorizerLambdaRole:
    Description: Javabuilder BuildAndRun Lambda Execution Role ARN
    Value: !GetAtt AuthorizerLambdaRole.Arn
    Export: {Name: JavabuilderAuthorizerLambdaRole}
  PutSourcesLambdaRole:
    Description: Javabuilder PutSources Lambda Execution Role ARN
    Value: !GetAtt PutSourcesLambdaRole.Arn
    Export: {Name: JavabuilderPutSourcesLambdaRole}
  JavabuilderAPIGatewayRole:
    Description: Javabuilder API Gateway Role ARN
    Value: !GetAtt JavabuilderAPIGatewayRole.Arn
    Export: {Name: JavabuilderAPIGatewayRole}
  JavabuilderCloudFormationRole:
    Description: Javabuilder CloudFormation Role ARN
    Value: !GetAtt JavabuilderCloudFormationRole.Arn
    Export: {Name: JavabuilderCloudFormationRole}
  JavabuilderCodeBuildRole:
    Description: Javabuilder CodeBuild Role ARN
    Value: !GetAtt JavabuilderCodeBuildRole.Arn
    Export: {Name: JavabuilderCodeBuildRole}