diff --git a/.gitignore b/.gitignore index cfe0671..a49b9cf 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ .terraform.lock.hcl -.terraform/ \ No newline at end of file +.terraform/ diff --git a/CHANGELOG.md b/CHANGELOG.md index d6637e0..a300a3a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,3 +3,8 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +# 1.0.0 + +* Striking 1.0.0 release +* Adding sqs flag diff --git a/README.md b/README.md index 97a7bea..944c307 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,2 @@ # batcave-tf-irsa -This repo is a Terraform module that contains the code to create IAM roles and policies for the implementation of [IRSA](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) in Batcave clusters. \ No newline at end of file +This repo is a Terraform module that contains the code to create IAM roles and policies for the implementation of [IRSA](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) in Batcave clusters. diff --git a/policies.tf b/policies.tf index 9f4dd19..9eb07ee 100644 --- a/policies.tf +++ b/policies.tf @@ -178,6 +178,8 @@ resource "aws_iam_role_policy_attachment" "secrets-manager" { role = aws_iam_role.this[0].name policy_arn = aws_iam_policy.secrets-manager[0].arn } + +################################################################################ # CloudWatch Policy for container insights ################################################################################ resource "aws_iam_role_policy_attachment" "insights_policy" { @@ -185,3 +187,41 @@ resource "aws_iam_role_policy_attachment" "insights_policy" { role = aws_iam_role.this[0].name policy_arn = "arn:${local.partition}:iam::aws:policy/CloudWatchAgentServerPolicy" } + +################################################################################ +# SQS Policy +################################################################################ +locals { + sqs_read_write_permissions = [ + "sqs:GetQueueUrl", + "sqs:DeleteMessage", + "sqs:ReceiveMessage", + "sqs:SendMessage", + "sqs:GetQueueAttributes" + ] +} +data "aws_iam_policy_document" "sqs_read_write" { + count = var.create_role && length(var.sqs_read_write_arns) > 0 ? 1 : 0 + + statement { + sid = "SQSReadWrite" + actions = local.sqs_read_write_permissions + resources = var.sqs_read_write_arns + } +} +resource "aws_iam_policy" "sqs_read_write" { + count = var.create_role && length(var.sqs_read_write_arns) > 0 ? 1 : 0 + + name_prefix = "${var.policy_name_prefix}${var.app_name}-" + path = var.role_path + description = "SQS Read/Write" + policy = data.aws_iam_policy_document.sqs_read_write[0].json + + tags = var.tags +} +resource "aws_iam_role_policy_attachment" "sqs_read_write" { + count = var.create_role && length(var.sqs_read_write_arns) > 0 ? 1 : 0 + + role = aws_iam_role.this[0].name + policy_arn = aws_iam_policy.sqs_read_write[0].arn +} diff --git a/variables.tf b/variables.tf index 4bd0d7c..7cf9e78 100644 --- a/variables.tf +++ b/variables.tf @@ -163,3 +163,8 @@ variable "attach_insights_policy" { type = bool default = false } +variable "sqs_read_write_arns" { + description = "List of SQS ARNs to allow read/write access to" + type = list(string) + default = [] +}