Adding assume role permissions to Control Panel Role

ministryofjustice · Oct 16, 2024 · eb4e257 · eb4e257
1 parent 7a9bd3c
commit eb4e257
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/terraform/aws/analytical-platform-development/cluster/iam-policies.tf b/terraform/aws/analytical-platform-development/cluster/iam-policies.tf
@@ -515,6 +515,18 @@ data "aws_iam_policy_document" "control_panel_api" {
     ]
     resources = ["arn:aws:lakeformation:*:${var.account_ids["analytical-platform-development"]}:*"]
   }
+  statement {
+    sid    = "AssumeRoleComputeAccounnt"
+    effect = "Allow"
+    actions = [
+      "sts:AssumeRole",
+      "sts:TagSession"
+    ]
+    resources = [
+      "arn:aws:iam::${var.account_ids["analytical-platform-compute-development"]}:role/analytical-platform-control-panel",
+      "arn:aws:iam::${var.account_ids["analytical-platform-compute-test"]}:role/analytical-platform-control-panel"
+    ]
+  }
 }
 
 resource "aws_iam_policy" "control_panel_api" {

diff --git a/terraform/aws/analytical-platform-development/cluster/terraform.tfvars b/terraform/aws/analytical-platform-development/cluster/terraform.tfvars
@@ -6,6 +6,8 @@ account_ids = {
   analytical-platform-development           = "525294151996"
   analytical-platform-management-production = "042130406152"
   analytical-platform-production            = "312423030077"
+  analytical-platform-compute-development   = "381491960855"
+  analytical-platform-compute-test          = "767397661611"
 }
 
 environment     = "development"