Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: Minimise permissions when not needed. #2220

Merged
merged 11 commits into from
May 2, 2024
Merged

chore: Minimise permissions when not needed. #2220

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
bdc3959
chore: Minimise permissions when not needed.
marcosuma Apr 29, 2024
9738976
adds remaining changes.
marcosuma Apr 29, 2024
194db90
fixes TestAccFederatedDatabaseInstance_s3bucket.
marcosuma Apr 30, 2024
e5f0f69
fixes policy definition.
marcosuma Apr 30, 2024
3f6216d
fixes permission error.
marcosuma Apr 30, 2024
7bd98a0
tries new policy.
marcosuma Apr 30, 2024
8d1c1e5
adds more permissions.
marcosuma Apr 30, 2024
642caf9
fixes permissions on other tests.
marcosuma Apr 30, 2024
24df72d
fixes format.
marcosuma May 2, 2024
cbd6929
fixes S3 push-based logging test.
marcosuma May 2, 2024
b0e2975
fixes other policy.
marcosuma May 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion internal/service/cloudbackupschedule/resource_cloud_backup_schedule_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -790,7 +790,7 @@ func configExportPolicies(info *acc.ClusterInfo, policyName, roleName, awsAccess
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Effect": "Deny",
marcosuma marked this conversation as resolved.
Show resolved Hide resolved
"Action": "*",
"Resource": "*"
}
Expand Down
2 changes: 1 addition & 1 deletion internal/service/cloudprovideraccess/resource_cloud_provider_access_authorization_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@ resource "aws_iam_role_policy" "test_policy" {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Effect": "Deny",
marcosuma marked this conversation as resolved.
Show resolved Hide resolved
"Action": "*",
"Resource": "*"
}
Expand Down
2 changes: 1 addition & 1 deletion internal/service/encryptionatrest/resource_encryption_at_rest_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ resource "aws_iam_role_policy" "test_policy" {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Effect": "Deny",
"Action": "*",
"Resource": "*"
}
Expand Down
29 changes: 19 additions & 10 deletions internal/service/federateddatabaseinstance/data_source_federated_database_instance_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,6 @@ func TestAccFederatedDatabaseInstanceDS_s3Bucket(t *testing.T) {
policyName = acc.RandomName()
roleName = acc.RandomIAMRole()
testS3Bucket = os.Getenv("AWS_S3_BUCKET")
region = "VIRGINIA_USA"
federatedInstance = admin.DataLakeTenant{}
)

Expand All @@ -65,7 +64,7 @@ func TestAccFederatedDatabaseInstanceDS_s3Bucket(t *testing.T) {
{
ExternalProviders: acc.ExternalProvidersOnlyAWS(),
ProtoV6ProviderFactories: acc.TestAccProviderV6Factories,
Config: configDSWithS3Bucket(policyName, roleName, projectName, orgID, name, testS3Bucket, region),
Config: configDSWithS3Bucket(policyName, roleName, projectName, orgID, name, testS3Bucket),
Check: resource.ComposeTestCheckFunc(
checkExists(resourceName, &federatedInstance),
checkAttributes(&federatedInstance, name),
Expand Down Expand Up @@ -105,8 +104,9 @@ func checkAttributes(dataFederatedInstance *admin.DataLakeTenant, name string) r
}
}

func configDSWithS3Bucket(policyName, roleName, projectName, orgID, name, testS3Bucket, dataLakeRegion string) string {
func configDSWithS3Bucket(policyName, roleName, projectName, orgID, name, testS3Bucket string) string {
stepConfig := configDSFirstStepS3Bucket(name, testS3Bucket)
bucketResourceName := "arn:aws:s3:::" + testS3Bucket
return fmt.Sprintf(`
resource "aws_iam_role_policy" "test_policy" {
name = %[1]q
Expand All @@ -116,11 +116,20 @@ resource "aws_iam_role_policy" "test_policy" {
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
}
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:ListBucket",
"s3:GetObjectVersion"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": %[6]q
}
]
}
EOF
Expand Down Expand Up @@ -170,8 +179,8 @@ resource "mongodbatlas_cloud_provider_access_authorization" "auth_role" {
}
}

%s
`, policyName, roleName, projectName, orgID, stepConfig)
%[5]s
`, policyName, roleName, projectName, orgID, stepConfig, bucketResourceName)
}
func configDSFirstStepS3Bucket(name, testS3Bucket string) string {
return fmt.Sprintf(`
Expand Down
29 changes: 19 additions & 10 deletions internal/service/federateddatabaseinstance/data_source_federated_database_instances_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@ func TestAccFederatedDatabaseInstanceDSPlural_basic(t *testing.T) {
policyName = acc.RandomName()
roleName = acc.RandomIAMRole()
testS3Bucket = os.Getenv("AWS_S3_BUCKET")
region = "VIRGINIA_USA"
)

resource.ParallelTest(t, resource.TestCase{
Expand All @@ -29,7 +28,7 @@ func TestAccFederatedDatabaseInstanceDSPlural_basic(t *testing.T) {
{
ExternalProviders: acc.ExternalProvidersOnlyAWS(),
ProtoV6ProviderFactories: acc.TestAccProviderV6Factories,
Config: configDSPlural(policyName, roleName, projectName, orgID, firstName, secondName, testS3Bucket, region),
Config: configDSPlural(policyName, roleName, projectName, orgID, firstName, secondName, testS3Bucket),
Check: resource.ComposeTestCheckFunc(
resource.TestCheckResourceAttrSet(resourceName, "project_id"),
resource.TestCheckResourceAttrSet(resourceName, "results.#"),
Expand All @@ -39,8 +38,9 @@ func TestAccFederatedDatabaseInstanceDSPlural_basic(t *testing.T) {
})
}

func configDSPlural(policyName, roleName, projectName, orgID, firstName, secondName, testS3Bucket, dataLakeRegion string) string {
func configDSPlural(policyName, roleName, projectName, orgID, firstName, secondName, testS3Bucket string) string {
stepConfig := configDSPluralFirstStep(firstName, secondName, testS3Bucket)
bucketResourceName := "arn:aws:s3:::" + testS3Bucket
return fmt.Sprintf(`
resource "aws_iam_role_policy" "test_policy" {
name = %[1]q
Expand All @@ -50,11 +50,20 @@ resource "aws_iam_role_policy" "test_policy" {
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
}
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:ListBucket",
"s3:GetObjectVersion"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": %[6]q
}
]
}
EOF
Expand Down Expand Up @@ -104,8 +113,8 @@ resource "mongodbatlas_cloud_provider_access_authorization" "auth_role" {
}
}

%s
`, policyName, roleName, projectName, orgID, stepConfig)
%[5]s
`, policyName, roleName, projectName, orgID, stepConfig, bucketResourceName)
}
func configDSPluralFirstStep(firstName, secondName, testS3Bucket string) string {
return fmt.Sprintf(`
Expand Down
29 changes: 19 additions & 10 deletions internal/service/federateddatabaseinstance/resource_federated_database_instance_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,6 @@ func TestAccFederatedDatabaseInstance_s3bucket(t *testing.T) {
policyName = acc.RandomName()
roleName = acc.RandomIAMRole()
testS3Bucket = os.Getenv("AWS_S3_BUCKET")
region = "VIRGINIA_USA"
)

resource.ParallelTest(t, resource.TestCase{
Expand All @@ -87,7 +86,7 @@ func TestAccFederatedDatabaseInstance_s3bucket(t *testing.T) {
{
ExternalProviders: acc.ExternalProvidersOnlyAWS(),
ProtoV6ProviderFactories: acc.TestAccProviderV6Factories,
Config: configWithS3Bucket(policyName, roleName, projectName, orgID, name, testS3Bucket, region),
Config: configWithS3Bucket(policyName, roleName, projectName, orgID, name, testS3Bucket),
Check: resource.ComposeTestCheckFunc(
resource.TestCheckResourceAttrSet(resourceName, "project_id"),
resource.TestCheckResourceAttr(resourceName, "name", name),
Expand Down Expand Up @@ -269,8 +268,9 @@ func importStateIDFunc(resourceName string) resource.ImportStateIdFunc {
}
}

func configWithS3Bucket(policyName, roleName, projectName, orgID, name, testS3Bucket, dataLakeRegion string) string {
func configWithS3Bucket(policyName, roleName, projectName, orgID, name, testS3Bucket string) string {
stepConfig := configFirstStepS3Bucket(name, testS3Bucket)
bucketResourceName := "arn:aws:s3:::" + testS3Bucket
return fmt.Sprintf(`
resource "aws_iam_role_policy" "test_policy" {
name = %[1]q
Expand All @@ -280,11 +280,20 @@ resource "aws_iam_role_policy" "test_policy" {
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
}
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:ListBucket",
"s3:GetObjectVersion"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": %[6]q
}
]
}
EOF
Expand Down Expand Up @@ -334,8 +343,8 @@ resource "mongodbatlas_cloud_provider_access_authorization" "auth_role" {
}
}

%s
`, policyName, roleName, projectName, orgID, stepConfig)
%[5]s
`, policyName, roleName, projectName, orgID, stepConfig, bucketResourceName)
}

func configFirstStepS3Bucket(name, testS3Bucket string) string {
Expand Down
26 changes: 18 additions & 8 deletions internal/service/federatedquerylimit/resource_federated_query_limit_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,7 @@ func basicTestCase(tb testing.TB) *resource.TestCase {

func configBasic(policyName, roleName, projectName, orgID, name, testS3Bucket string) string {
stepConfig := configFirstStep(name, testS3Bucket)
bucketResourceName := "arn:aws:s3:::" + testS3Bucket
return fmt.Sprintf(`
resource "aws_iam_role_policy" "test_policy" {
name = %[1]q
Expand All @@ -80,11 +81,20 @@ resource "aws_iam_role_policy" "test_policy" {
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
}
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:ListBucket",
"s3:GetObjectVersion"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": %[6]q
}
]
}
EOF
Expand Down Expand Up @@ -134,8 +144,8 @@ resource "mongodbatlas_cloud_provider_access_authorization" "auth_role" {
}
}

%s
`, policyName, roleName, projectName, orgID, stepConfig)
%[5]s
`, policyName, roleName, projectName, orgID, stepConfig, bucketResourceName)
}

func configFirstStep(name, testS3Bucket string) string {
Expand Down Expand Up @@ -214,7 +224,7 @@ data "mongodbatlas_federated_query_limits" "test" {
project_id = mongodbatlas_project.test_project.id
tenant_name = mongodbatlas_federated_database_instance.db_instance.name
}
`, name, testS3Bucket)
`, name, testS3Bucket)
}

func importStateIDFunc(resourceName string) resource.ImportStateIdFunc {
Expand Down
28 changes: 21 additions & 7 deletions internal/service/pushbasedlogexport/resource_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,7 +122,7 @@ func configBasic(projectID, s3BucketName1, s3BucketName2, s3BucketPolicyName, aw

%[8]s
`, projectID, s3BucketName1, s3BucketName2, s3BucketPolicyName, awsIAMRoleName, awsIAMRolePolicyName,
awsIAMroleAuthAndS3Config(), pushBasedLogExportConfig(false, usePrefixPath, prefixPath))
awsIAMroleAuthAndS3Config(s3BucketName1, s3BucketName2), pushBasedLogExportConfig(false, usePrefixPath, prefixPath))
return test
}

Expand All @@ -141,7 +141,7 @@ func configBasicUpdated(projectID, s3BucketName1, s3BucketName2, s3BucketPolicyN

%[8]s
`, projectID, s3BucketName1, s3BucketName2, s3BucketPolicyName, awsIAMRoleName, awsIAMRolePolicyName,
awsIAMroleAuthAndS3Config(), pushBasedLogExportConfig(true, usePrefixPath, prefixPath)) // updating the S3 bucket to use for push-based log config
awsIAMroleAuthAndS3Config(s3BucketName1, s3BucketName2), pushBasedLogExportConfig(true, usePrefixPath, prefixPath)) // updating the S3 bucket to use for push-based log config
return test
}

Expand Down Expand Up @@ -184,8 +184,10 @@ func pushBasedLogExportDataSourceConfig() string {

// awsIAMroleAuthAndS3Config returns config for required IAM roles and authorizes them (sets up cloud provider access) with a mongodbatlas_project
// This method also creates two S3 buckets and sets up required access policy for them
func awsIAMroleAuthAndS3Config() string {
return `
func awsIAMroleAuthAndS3Config(firstBucketName, secondBucketName string) string {
firstBucketResourceName := "arn:aws:s3:::" + firstBucketName
secondBucketResourceName := "arn:aws:s3:::" + secondBucketName
return fmt.Sprintf(`
// Create IAM role & policy to authorize with Atlas
resource "aws_iam_role_policy" "test_policy" {
name = local.aws_iam_role_policy_name
Expand All @@ -197,8 +199,20 @@ resource "aws_iam_role_policy" "test_policy" {
"Statement": [
{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
"Action": [
"s3:GetObject",
"s3:ListBucket",
"s3:GetObjectVersion"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": [
%[1]q,
%[2]q
]
}
]
}
Expand Down Expand Up @@ -291,7 +305,7 @@ resource "aws_iam_role_policy" "s3_bucket_policy" {
}
EOF
}
`
`, firstBucketResourceName, secondBucketResourceName)
}

func checkDestroy(state *terraform.State) error {
Expand Down
1 change: 0 additions & 1 deletion scripts/generate-credentials-with-sts-assume-role.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@ set -Eeou pipefail

# This script uses aws sts assume-role to generate temporary credentials
# and outputs them in $GITHUB_OUTPUT so those can be used in other workflow jobs.
# role-arn = arn:aws:iam::358363220050:role/terraform-provider-mongodbatlas-acceptancetests
marcosuma marked this conversation as resolved.
Show resolved Hide resolved

# Define a function to convert a string to lowercase
function to_lowercase() {
Expand Down