Download this file
| 1 | mock_provider "aws" {} |
| 2 | |
| 3 | variables { |
| 4 | name = "carloku-ie-fence-writer" |
| 5 | deployment_bucket_arn = "arn:aws:s3:::deployment" |
| 6 | } |
| 7 | |
| 8 | run "root_bootstrap_only" { |
| 9 | command = plan |
| 10 | assert { |
| 11 | condition = jsondecode(aws_iam_role.writer.assume_role_policy).Statement[0].Principal.AWS == aws_iam_user.bootstrap.arn |
| 12 | error_message = "Only the dedicated root bootstrap principal may assume the writer role." |
| 13 | } |
| 14 | assert { |
| 15 | condition = jsondecode(aws_iam_user_policy.assume.policy).Statement[0].Resource == aws_iam_role.writer.arn |
| 16 | error_message = "The bootstrap user may assume only its box writer role." |
| 17 | } |
| 18 | assert { |
| 19 | condition = jsondecode(aws_iam_role_policy.fences.policy).Statement[0].Resource == "arn:aws:s3:::deployment/control/box-fences/*" |
| 20 | error_message = "The writer role must be restricted to fence creation." |
| 21 | } |
| 22 | assert { |
| 23 | condition = jsondecode(aws_iam_role_policy.fences.policy).Statement[0].Condition.StringEquals["s3:if-none-match"] == "*" |
| 24 | error_message = "A fence write must be create-only." |
| 25 | } |
| 26 | assert { |
| 27 | condition = jsonencode([ |
| 28 | for s in jsondecode(aws_iam_role_policy.fences.policy).Statement : s.Action |
| 29 | ]) == jsonencode(["s3:PutObject", "s3:GetObject"]) |
| 30 | error_message = "Fence roles must grant no delete, tagging or unrelated service action." |
| 31 | } |
| 32 | assert { |
| 33 | condition = length(jsondecode(aws_iam_user_policy.assume.policy).Statement) == 1 && jsondecode(aws_iam_user_policy.assume.policy).Statement[0].Action == "sts:AssumeRole" |
| 34 | error_message = "The bootstrap identity must hold only its one assume-role grant." |
| 35 | } |
| 36 | |
| 37 | } |
| 38 | |
amadan