Automate IAM User Role Policies

.github/workflows/run-ci-cd.yaml

@@ -476,6 +476,10 @@ jobs:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-region: ${{ vars.AWS_REGION }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-duration-seconds: 1200
+          role-external-id: nest-staging-terraform
+          role-session-name: GitHubActions-BuildStagingImages
+          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/nest-staging-terraform
 
       - name: Login to Amazon ECR
         uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076
@@ -618,6 +622,73 @@ jobs:
             frontend-sbom-${{ env.RELEASE_VERSION }}.cdx.json
     timeout-minutes: 5
 
+  bootstrap-staging-nest:
+    name: Bootstrap Nest Staging
+    env:
+      TF_INPUT: false
+      TF_IN_AUTOMATION: true
+    environment: staging
+    if: |
+      github.repository == 'OWASP/Nest' &&
+      github.ref == 'refs/heads/main'
+    needs:
+      - scan-staging-images
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708
+        with:
+          aws-access-key-id: ${{ secrets.BOOTSTRAP_AWS_ACCESS_KEY_ID }}
+          aws-region: ${{ vars.AWS_REGION }}
+          aws-secret-access-key: ${{ secrets.BOOTSTRAP_AWS_SECRET_ACCESS_KEY }}
+
+      - name: Install Terraform
+        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd
+        with:
+          terraform_version: 1.14.0
+
+      - name: Prepare terraform backend
+        env:
+          AWS_REGION: ${{ vars.AWS_REGION }}
+          TF_STATE_BUCKET_NAME: ${{ secrets.BOOTSTRAP_TF_STATE_BUCKET_NAME }}
+          TF_STATE_DYNAMODB_TABLE_NAME: ${{ secrets.BOOTSTRAP_TF_STATE_DYNAMODB_TABLE_NAME }}
+        run: |
+          umask 377
+          cat > infrastructure/bootstrap/terraform.tfbackend <<-EOF
+          bucket="$TF_STATE_BUCKET_NAME"
+          dynamodb_table="$TF_STATE_DYNAMODB_TABLE_NAME"
+          region="$AWS_REGION"
+          EOF
+
+      - name: Prepare terraform variables
+        env:
+          AWS_REGION: ${{ vars.AWS_REGION }}
+          PROJECT_NAME: 'nest'
+        run: |
+          umask 377
+          cat > infrastructure/bootstrap/terraform.tfvars <<-EOF
+          aws_region="$AWS_REGION"
+          project_name="$PROJECT_NAME"
+          EOF
+
+      - name: Terraform Init
+        working-directory: infrastructure/bootstrap
+        run: terraform init -backend-config=terraform.tfbackend
+
+      - name: Terraform Validate
+        working-directory: infrastructure/bootstrap
+        run: terraform validate
+
+      - name: Terraform Apply
+        working-directory: infrastructure/bootstrap
+        run: terraform apply -auto-approve
+    timeout-minutes: 10
+
   plan-staging-nest:
     name: Plan Nest Staging
     env:
@@ -628,6 +699,7 @@ jobs:
       github.repository == 'OWASP/Nest' &&
       github.ref == 'refs/heads/main'
     needs:
+      - bootstrap-staging-nest
       - scan-staging-images
       - set-release-version
     permissions:
@@ -643,6 +715,10 @@ jobs:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-region: ${{ vars.AWS_REGION }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-duration-seconds: 1200
+          role-external-id: nest-staging-terraform
+          role-session-name: GitHubActions-StagingPlan
+          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/nest-staging-terraform
 
       - name: Install Terraform
         uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd
@@ -740,6 +816,10 @@ jobs:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-region: ${{ vars.AWS_REGION }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-duration-seconds: 1200
+          role-external-id: nest-staging-terraform
+          role-session-name: GitHubActions-StagingDeploy
+          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/nest-staging-terraform
 
       - name: Install Terraform
         uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd
@@ -800,7 +880,7 @@ jobs:
 
       - name: Install backend dependencies
         working-directory: backend
-        run: poetry sync --no-root --without dev --without test --without video
+        run: poetry sync --no-root --without test --without video
 
       - name: Prepare Zappa settings
         env:

infrastructure/README.md

@@ -9,7 +9,8 @@ Ensure you have the following setup/installed:
 - Setup Project: [CONTRIBUTING.md](https://github.com/OWASP/Nest/blob/main/CONTRIBUTING.md)
 - Terraform: [Terraform Documentation](https://developer.hashicorp.com/terraform/docs)
 - AWS CLI: [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html)
-- An AWS account with credentials configured locally.
+- An AWS account with credentials configured locally:
+Note: Refer to the respective `README.md` files and [Required Policies](#required-policies) for more information.
 
 ## Setting up the infrastructure
 
@@ -44,7 +45,60 @@ Follow these steps to set up the infrastructure:
   > [!NOTE]
   > It is recommended to not destroy the backend resources unless absolutely necessary.
 
-2. **Setup Main Infrastructure (staging)**:
+2. **Bootstrap IAM Role**:
+
+  - Navigate to the bootstrap directory:
+
+    ```bash
+    cd infrastructure/bootstrap/
+    ```
+
+  - Create a local terraform variables file:
+
+    ```bash
+    touch terraform.tfvars
+    ```
+
+  - Copy the contents from the example file:
+
+    ```bash
+    cat terraform.tfvars.example > terraform.tfvars
+    ```
+
+  - Create a local backend configuration file:
+
+    ```bash
+    touch terraform.tfbackend
+    ```
+
+  - Copy the contents from the example file:
+
+    ```bash
+    cat terraform.tfbackend.example > terraform.tfbackend
+    ```
+
+  > [!NOTE]
+  > Update the state bucket name in `terraform.tfbackend` with the name of the state bucket (bootstrap) created in the previous step.
+
+  > [!NOTE]
+  > Update defaults (e.g. `region`) as needed.
+
+  > [!NOTE]
+  > Optionally change the region: set `aws_region` in a `.tfvars` file.
+
+  - Initialize Terraform if needed:
+
+    ```bash
+    terraform init -backend-config=terraform.tfbackend
+    ```
+
+  - Apply the changes to create the backend resources:
+
+    ```bash
+    terraform apply
+    ```
+
+3. **Setup Main Infrastructure (staging)**:
 
   - Navigate to the main infrastructure directory. If you are in `infrastructure/backend`, you can use:
 
@@ -94,7 +148,7 @@ Follow these steps to set up the infrastructure:
     terraform apply
     ```
 
-3. **Populate Secrets**
+4. **Populate Secrets**
 
   - Visit the AWS Console > Systems Manager > Parameter Store.
   - Populate all `DJANGO_*` secrets that have `to-be-set-in-aws-console` value.
@@ -299,8 +353,8 @@ Migrate and load data into the new database.
 
     ```bash
     aws ecs update-service \
-        --cluster owasp-nest-staging-frontend-cluster \
-        --service owasp-nest-staging-frontend-service \
+        --cluster nest-staging-frontend-cluster \
+        --service nest-staging-frontend-service \
         --force-new-deployment \
         --region us-east-2
     ```
@@ -337,3 +391,65 @@ Migrate and load data into the new database.
   ```bash
   zappa update staging
   ```
+
+## Required Policies
+
+- All users (`nest-staging`, `nest-bootstrap`, etc) require these minumum policies to use the terraform remote backend:
+Note: Replace ${...} variables appropriately.
+
+```json
+  {
+	"Version": "2012-10-17",
+	"Statement": [
+		{
+            "Sid": "S3StateManagement",
+			"Effect": "Allow",
+			"Action": [
+				"s3:GetObject",
+				"s3:PutObject",
+				"s3:ListBucket"
+			],
+			"Resource": [
+				"arn:aws:s3:::${TERRAFORM_STATE_BUCKET_NAME}",
+				"arn:aws:s3:::${TERRAFORM_STATE_BUCKET_NAME}/*"
+			]
+		},
+		{
+            "Sid": "DynamoDBStateManagement",
+            "Effect": "Allow",
+            "Action": [
+                "dynamodb:GetItem",
+                "dynamodb:PutItem",
+                "dynamodb:DeleteItem"
+            ],
+            "Resource": "arn:aws:dynamodb:${AWS_REGION}:${AWS_ACCOUNT_ID}:table/${TERRAFORM_DYNAMODB_TABLE_NAME}"
+        },
+        {
+            "Sid": "KMSStateManagement",
+            "Effect": "Allow",
+            "Action": [
+                "kms:Decrypt"
+            ],
+            "Resource": "${AWS_BACKEND_KMS_KEY_ARN}"
+        }
+    ]
+}
+```
+
+Additionally, the `nest-staging` IAM User requires the following policy to assume it's own role:
+```json
+{
+  {
+	"Version": "2012-10-17",
+	"Statement": [
+    "Sid": "STSManagement",
+        "Effect": "Allow",
+        "Action": [
+            "sts:AssumeRole",
+            "sts:TagSession"
+        ],
+        "Resource": "arn:aws:iam::${AWS_ACCOUNT_ID}:role/nest-staging-terraform"
+    ]
+  }
+}
+```

infrastructure/backend/README.md

@@ -0,0 +1,89 @@
+## Inline Permissions
+Use the following inline permissions for the `nest-backend` IAM User
+*Note*: replace ${AWS_ACCOUNT_ID} and ${AWS_BACKEND_KMS_KEY_ARN} with appropriate values.
+
+```json
+{
+	"Version": "2012-10-17",
+	"Statement": [
+		{
+			"Sid": "S3Management",
+			"Effect": "Allow",
+			"Action": [
+				"s3:CreateBucket",
+				"s3:DeleteBucket",
+				"s3:GetAccelerateConfiguration",
+				"s3:GetBucketAcl",
+				"s3:GetBucketCors",
+				"s3:GetBucketLogging",
+				"s3:GetBucketObjectLockConfiguration",
+				"s3:GetBucketPolicy",
+				"s3:GetBucketPublicAccessBlock",
+				"s3:GetBucketRequestPayment",
+				"s3:GetBucketTagging",
+				"s3:GetBucketVersioning",
+				"s3:GetBucketWebsite",
+				"s3:GetEncryptionConfiguration",
+				"s3:GetLifecycleConfiguration",
+				"s3:GetObject",
+				"s3:GetReplicationConfiguration",
+				"s3:ListBucket",
+				"s3:PutBucketLogging",
+				"s3:PutBucketObjectLockConfiguration",
+				"s3:PutBucketPolicy",
+				"s3:PutBucketPublicAccessBlock",
+				"s3:PutBucketTagging",
+				"s3:PutBucketVersioning",
+				"s3:PutEncryptionConfiguration",
+				"s3:PutLifecycleConfiguration",
+				"s3:PutObject"
+			],
+			"Resource": [
+				"arn:aws:s3:::nest-terraform-state-*",
+				"arn:aws:s3:::nest-terraform-state-*/*"
+			]
+		},
+		{
+			"Sid": "DynamoDBManagement",
+			"Effect": "Allow",
+			"Action": [
+				"dynamodb:CreateTable",
+				"dynamodb:DeleteTable",
+				"dynamodb:DescribeContinuousBackups",
+				"dynamodb:DescribeTable",
+				"dynamodb:DescribeTimeToLive",
+				"dynamodb:ListTagsOfResource",
+				"dynamodb:TagResource",
+				"dynamodb:UntagResource",
+				"dynamodb:UpdateContinuousBackups",
+				"dynamodb:UpdateTable"
+			],
+			"Resource": "arn:aws:dynamodb:*:${AWS_ACCOUNT_ID}:table/nest-terraform-state-lock-*"
+		},
+		{
+			"Sid": "KMSManagement",
+			"Effect": "Allow",
+			"Action": [
+				"kms:CreateAlias",
+				"kms:CreateGrant",
+				"kms:CreateKey",
+				"kms:DeleteAlias",
+				"kms:DescribeKey",
+				"kms:DisableKeyRotation",
+				"kms:EnableKeyRotation",
+				"kms:GetKeyPolicy",
+				"kms:GetKeyRotationStatus",
+				"kms:ListAliases",
+				"kms:ListResourceTags",
+				"kms:PutKeyPolicy",
+				"kms:ScheduleKeyDeletion",
+				"kms:TagResource",
+				"kms:UntagResource",
+				"kms:UpdateAlias",
+				"kms:UpdateKeyDescription"
+			],
+			"Resource": "${AWS_BACKEND_KMS_KEY_ARN}"
+		}
+	]
+}
+```