From 96d2531fbb127baa6af6fb92a89e3ac3bd37134c Mon Sep 17 00:00:00 2001
From: Ryan Cragun <me@ryan.ec>
Date: Fri, 7 Jul 2023 12:12:17 -0600
Subject: [PATCH] chore: [QT-587] Update service and demo user IAM policies
 (#3398)

* Update the service user IAM policies to allow for managing S3 buckets.
* Update the demo user to allow for managing S3 objects.

Signed-off-by: Ryan Cragun <me@ryan.ec>
---
 enos/ci/service-user-iam/main.tf | 52 ++++++++++++++++++++++++++------
 1 file changed, 43 insertions(+), 9 deletions(-)

diff --git a/enos/ci/service-user-iam/main.tf b/enos/ci/service-user-iam/main.tf
index 2453dab37..af87ab7e0 100644
--- a/enos/ci/service-user-iam/main.tf
+++ b/enos/ci/service-user-iam/main.tf
@@ -218,9 +218,13 @@ data "aws_iam_policy_document" "enos_policy_document" {
       "rds:ModifyDBSubnetGroup",
       "rds:RemoveTagsFromResource",
       "s3:ListAllMyBuckets",
-      "s3:CreateBucket",
-      "s3:DeleteBucket",
+      "s3:CreateBucket*",
+      "s3:DeleteBucket*",
+      "s3:GetBucket*",
+      "s3:HeadBucket",
+      "s3:PutBucket*"
     ]
+
     resources = ["*"]
   }
 }
@@ -228,6 +232,7 @@ data "aws_iam_policy_document" "enos_policy_document" {
 
 data "aws_iam_policy_document" "aws_nuke_policy_document" {
   provider = aws.us_east_1
+
   statement {
     effect = "Allow"
     actions = [
@@ -247,9 +252,12 @@ data "aws_iam_policy_document" "aws_nuke_policy_document" {
       "iam:ListUsers",
       "iam:UntagUser",
       "servicequotas:ListServiceQuotas",
-      "s3:ListAllMyBuckets",
-      "s3:DeleteBucket",
+      "s3:Head*",
+      "s3:List*",
+      "s3:Get*",
+      "s3:Delete*"
     ]
+
     resources = ["*"]
   }
 }
@@ -263,23 +271,45 @@ resource "aws_iam_policy" "demo_user" {
 
 data "aws_iam_policy_document" "demo_user_policy_document" {
   statement {
-    sid = "DemoUserEC2Permissions"
+    sid = "BoundaryHostPlugin"
     actions = [
       "ec2:DescribeInstances*"
     ]
+
     resources = ["*"]
   }
+
   statement {
-    sid = "DemoUserIAMPermissions"
+    sid = "BoundarySessionS3OnlyMyAccount"
+    effect = "Allow"
+    actions = [
+      "s3:DeleteObject",
+      "s3:GetObject",
+      "s3:GetObjectAttributes",
+      "s3:PutObject",
+    ]
+
+    condition {
+      test = "StringEquals"
+      variable = "s3:ResourceAccount"
+      values = [data.aws_caller_identity.current.account_id]
+    }
+
+    resources = ["*"]
+  }
+
+  statement {
+    sid = "IAMAKRotate"
     actions = [
       "iam:CreateAccessKey",
       "iam:DeleteAccessKey",
       "iam:ListAccessKeys",
       "iam:UpdateAccessKey"
     ]
-    resources = ["arn:aws:iam::147451547303:user/&{aws:username}"]
 
+    resources = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:user/&{aws:username}"]
   }
+
   statement {
     sid       = "ExplicitDeny"
     effect    = "Deny"
@@ -289,7 +319,11 @@ data "aws_iam_policy_document" "demo_user_policy_document" {
       "iam:CreateAccessKey",
       "iam:DeleteAccessKey",
       "iam:ListAccessKeys",
-      "iam:UpdateAccessKey"
-    ]
+      "iam:UpdateAccessKey",
+      "s3:DeleteObject",
+      "s3:GetObject",
+      "s3:GetObjectAttributes",
+      "s3:PutObject",
+     ]
   }
 }