# terraform-iam-policies

## Overview

This repository includes modules to create IAM policies that encapsulate a collection of AWS services, providing expansive Read/Write access to them. This specifically does _not_ grant Create and Delete access to AWS services or resources, which should not be managed by hand, but instead via the [terraform-infra workflow](https://www.notion.so/Terraform-96ac3963a3cd4b6587a1504e1e31727c#ff2db5a5a9804f86b2c9d5e33cb173f1).

This repo supports the following policy modules:

### ABAC
This module uses the `application_family` tag to control access to resources tagged with a given application family. It includes services that The Orchard utilizes that support attribute-based access controls (ABAC). Due to AWS policy length limits, this module creates multiple policies named `"ABAC-${var.application_family}-tag-access-policy-part-N"`, where N is an auto-incrementing number starting with 1.

### RBAC
This module provides access to resources that do not support tag-based access. It includes services that The Orchard utilizes that support resource-based access controls. Due to AWS policy length limits, this module creates multiple policies named `"RBAC-${var.application_family}-resource-access-policy-part-N"`, where N is an auto-incrementing number starting with 1. The `application_family` tag is still required here, but is uses for naming and logical grouping, rather than permissions, which accept lists of resource names on a per-service basis. RBAC policies might be still required to exist, so if no resource is added to the module, a no-op dummy policy will be created.

TODO: Add more RBAC details once they exist

### `auth0-m2m-config`
This module enables Permissions Platform to configure standardized `M2M_AUTH0_CLIENT_CREDENTIALS` for machines (e.g. lambda functions) in each AWS Account. For each new AWS Account's `terraform-infra`, add `<aws account>/iam/auth0-m2m-config` directory[^1] containing:

* variables.tf
```
variable "aws_region" {
  type    = string
  default = "us-east-1"
}

variable "environment" {
  description = "Available values:  dev, qa, prod."
  type        = string
  default     = "qa"
}
```
* main.tf:
```
module "auth0_m2m_config" {
  source      = "git@github.com:theorchard/terraform-iam-policies.git//modules/auth0-m2m-config?ref=x.y.z"
  aws_region  = var.aws_region
  environment = var.environment
}
```
* versions.tf

Additionally, in `terraform-infra`'s `permissions-platform/<env>/auth0-m2m-config`, update the `variables.tf` file with the 
new AWS Account name.

[^1]: For example, for the Fansifter team's QA AWS account, this config would be `fansifter/qa/iam/auth0-m2m-config`. But for the ORCD Prod account, this config would be added to once to `prod/iam/auth0-m2m-config` (`variable "environment"` is `prod`) and once to `qa/iam/auth0-m2m-config` (`variable "environment"` is `qa`).