fix: S3 scan object role assume

[patheard]

Summary

1. Update the S3 scan object lambda to properly handle the
   assumed role's temporary credentials.

2. Update Scan API lambda IAM policy to allow publishing
   to the SNS topic.

Related

• feat: move S3 scan object lambda into Scan Files #165
• Add S3 scan object Terraform module to Vault file storage forms-terraform#224

[github-actions]

Plan for s3_scan_object

✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

Plan: 2 to add, 1 to change, 0 to destroy

Show plan

Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # aws_iam_policy.api_sns_publish will be created
  + resource "aws_iam_policy" "api_sns_publish" {
      + arn       = (known after apply)
      + id        = (known after apply)
      + name      = "scan-files-sns-publish"
      + path      = "/"
      + policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "kms:GenerateDataKey*",
                          + "kms:Decrypt",
                        ]
                      + Effect   = "Allow"
                      + Resource = "arn:aws:kms:ca-central-1:806545929748:key/221c5101-9162-43cd-bb4e-0a37835f82c5"
                      + Sid      = ""
                    },
                  + {
                      + Action   = "sns:Publish"
                      + Effect   = "Allow"
                      + Resource = "arn:aws:sns:ca-central-1:806545929748:s3-scan-object-complete"
                      + Sid      = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id = (known after apply)
      + tags      = {
          + "CostCentre" = "scan-files-production"
          + "Terraform"  = "true"
        }
      + tags_all  = {
          + "CostCentre" = "scan-files-production"
          + "Terraform"  = "true"
        }
    }

  # aws_iam_role_policy_attachment.api_sns_publish will be created
  + resource "aws_iam_role_policy_attachment" "api_sns_publish" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = "scan-files-api"
    }

  # module.s3_scan_object.aws_lambda_function.this will be updated in-place
  ~ resource "aws_lambda_function" "this" {
      - description                    = "Trigger restart" -> null
        id                             = "s3-scan-object"
        tags                           = {
            "CostCentre" = "scan-files-production"
            "Terraform"  = "true"
        }
        # (18 unchanged attributes hidden)



        # (3 unchanged blocks hidden)
    }

Plan: 2 to add, 1 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"

Show Conftest results

18 tests, 18 passed, 0 warnings, 0 failures, 0 exceptions

[github-actions]

Plan for api

✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

Plan: 0 to add, 2 to change, 0 to destroy

Show plan

Resource actions are indicated with the following symbols:
  ~ update in-place
 <= read (data resources)

Terraform will perform the following actions:

  # data.aws_iam_policy_document.api_get_secrets will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "api_get_secrets"  {
      ~ id      = "408582664" -> (known after apply)
      ~ json    = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = "secretsmanager:GetSecretValue"
                      - Effect   = "Allow"
                      - Resource = "arn:aws:secretsmanager:ca-central-1:806545929748:secret:/scan-files/api_auth_token-1tLf9T"
                      - Sid      = ""
                    },
                  - {
                      - Action   = "kms:Decrypt"
                      - Effect   = "Allow"
                      - Resource = "arn:aws:kms:ca-central-1:806545929748:key/c71bf0dd-721d-4f36-be85-5bea7927ad43"
                      - Sid      = ""
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> (known after apply)
      - version = "2012-10-17" -> null

      ~ statement {
          - not_actions   = [] -> null
          - not_resources = [] -> null
            # (3 unchanged attributes hidden)
        }
      ~ statement {
          - not_actions   = [] -> null
          - not_resources = [] -> null
            # (3 unchanged attributes hidden)
        }
    }

  # aws_secretsmanager_secret.api_auth_token will be updated in-place
  ~ resource "aws_secretsmanager_secret" "api_auth_token" {
        id                             = "arn:aws:secretsmanager:ca-central-1:806545929748:secret:/scan-files/api_auth_token-1tLf9T"
      ~ kms_key_id                     = "arn:aws:kms:ca-central-1:806545929748:key/cf3b0a97-39ff-472c-af74-2ca568ae5308" -> "aws/secretsmanager"
        name                           = "/scan-files/api_auth_token"
        tags                           = {
            "CostCentre" = "scan-files-production"
            "Terraform"  = "true"
        }
        # (5 unchanged attributes hidden)
    }

  # module.api.aws_iam_policy.policies[1] will be updated in-place
  ~ resource "aws_iam_policy" "policies" {
        id        = "arn:aws:iam::806545929748:policy/scan-files-api-1"
        name      = "scan-files-api-1"
      ~ policy    = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = "secretsmanager:GetSecretValue"
                      - Effect   = "Allow"
                      - Resource = "arn:aws:secretsmanager:ca-central-1:806545929748:secret:/scan-files/api_auth_token-1tLf9T"
                      - Sid      = ""
                    },
                  - {
                      - Action   = "kms:Decrypt"
                      - Effect   = "Allow"
                      - Resource = "arn:aws:kms:ca-central-1:806545929748:key/c71bf0dd-721d-4f36-be85-5bea7927ad43"
                      - Sid      = ""
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> (known after apply)
        tags      = {
            "CostCentre" = "scan-files-production"
            "Terraform"  = "true"
        }
        # (4 unchanged attributes hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

Warning: Argument is deprecated

  with module.clamav-defs.aws_s3_bucket.this,
  on .terraform/modules/clamav-defs/S3/main.tf line 7, in resource "aws_s3_bucket" "this":
   7: resource "aws_s3_bucket" "this" {

Use the aws_s3_bucket_versioning resource instead

(and 23 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"
Releasing state lock. This may take a few moments...

Show Conftest results

18 tests, 18 passed, 0 warnings, 0 failures, 0 exceptions

[mohdnr]

🚀 ✅