Document required AWS permissions to run policy

[segmentio]

Document required AWS permissions to run policy

[eriksw]

FYI: The parameters are encrypted with a PARAMETER_ARN encryption context key. You should take advantage of this to restrict which ciphertext blobs can be decrypted, instead of allowing decryption of every ciphertext blob encrypted using the key.

Add this to the statement allowing decryption:

condition {
  test     = "StringLike"
  variable = "kms:EncryptionContext:PARAMETER_ARN"

  values = [
    "arn:aws:ssm:${var.region}:${var.AccountID}:parameter/${var.ssm_prefix}.*",
  ]
}

[FernandoMiguel]

HTH

data "aws_iam_policy_document" "ssm-read-policy-document" {
  statement {
    sid = "SSMDescribeParameters"

    actions = [
      "ssm:DescribeParameters",
    ]

    resources = [
      "*",
    ]
  }

  statement {
    sid = "SSMGetParameters"

    actions = [
      "ssm:GetParameters",
    ]

    resources = [
      "arn:aws:ssm:${var.region}:${var.AccountID}:parameter/${var.ssm_prefix}.*",
    ]
  }

  statement {
    sid = "KMSDecrypt"

    actions = [
      "kms:Decrypt",
    ]

    resources = [
      "${aws_kms_key.kms-key.arn}",
    ]
  }
}

resource "aws_iam_policy" "STS-policy-SSM-read" {
  name   = "STS-SSM-read-${var.ssm_prefix}-${random_pet.random_pet.id}"
  policy = "${data.aws_iam_policy_document.ssm-read-policy-document.json}"
}

data "aws_iam_policy_document" "ssm-manage-policy-document" {
  statement {
    sid = "SSMDescribeParameters"

    actions = [
      "ssm:DescribeParameters",
    ]

    resources = [
      "*",
    ]
  }

  statement {
    sid = "SSMSetParameters"

    actions = [
      "ssm:GetParameters",
      "ssm:PutParameter",
      "ssm:DeleteParameter",
      "ssm:DeleteParameters",
    ]

    resources = [
      "arn:aws:ssm:${var.region}:${var.AccountID}:parameter/${var.ssm_prefix}.*",
    ]
  }

  statement {
    sid = "KMSEncrypt"

    actions = [
      "kms:Decrypt",
      "kms:Encrypt",
    ]

    resources = [
      "${aws_kms_key.kms-key.arn}",
    ]
  }
}

resource "aws_iam_policy" "STS-policy-SSM-manage" {
  name   = "STS-SSM-manage-${var.ssm_prefix}-${random_pet.random_pet.id}"
  policy = "${data.aws_iam_policy_document.ssm-manage-policy-document.json}"
}

https://aws.amazon.com/blogs/compute/managing-secrets-for-amazon-ecs-applications-using-parameter-store-and-iam-roles-for-tasks/
https://docs.aws.amazon.com/kms/latest/developerguide/iam-policies.html

[phantomwhale]

Commenting here as this seems to be the only attempt to document this (I am also searching around for the answer here).

Running chamber with similar permissions to those above, I get a message suggesting I should be granting the ssm:ssm:GetParametersByPath permission to my resources, but aside from seeing that in the code, it doesn't seem to appear to be documented?

[phantomwhale]

Have settled on:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:DescribeKey"
            ],
            "Resource": [
                "arn:aws:kms:us-east-1:$MY_ACCOUNT:key/$MY_KMS_KEY"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssm:GetParameters"
            ],
            "Resource": [
                "arn:aws:ssm:*:*:parameter/$APP_NAME/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssm:GetParametersByPath"
            ],
            "Resource": "*"
        }
    ]
}

As my "secret access for chamber" policy. Seems to be working, and got rid of the "GetParametersByPath" deprecation warning I was getting too

[nickatsegment]

That looks pretty good to me. I'd approve that PR ;)

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically marked stale because it has not had any activity in the last 60 days. If no further activity occurs within 7 days, it will be closed. Closed does not mean "never", just that it has no momentum to get accomplished any time soon.
See CONTRIBUTING.md for more info.

[stale]

Closing due to staleness. Closed does not mean "never", just that it has no momentum to get accomplished any time soon.
See CONTRIBUTING.md for more info.