feat: add SRE Security Hub automation rule role

[patheard]

Summary

Add an OIDC rule that can be used by the SRE repo by the tools/aws-security-automation-rules script to manage Security Hub automation rules.

Related

• https://github.com/cds-snc/site-reliability-engineering/pull/1020
• https://github.com/cds-snc/platform-core-services/issues/471

[github-actions]

Plan for log_archive/sre_bot

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

Plan: 3 to add, 0 to change, 0 to destroy

Show summary

CHANGE	NAME
add	aws_iam_policy.sre_sechub_automation_rules
	aws_iam_role_policy_attachment.sre_sechub_automation_rules
	module.OIDC_Roles.aws_iam_role.this["sre_sechub_automation_rules_github_action"]

Show plan

Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_iam_policy.sre_sechub_automation_rules will be created
  + resource "aws_iam_policy" "sre_sechub_automation_rules" {
      + arn         = (known after apply)
      + id          = (known after apply)
      + name        = "sre_sechub_automation_rules"
      + name_prefix = (known after apply)
      + path        = "/"
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "securityhub:ListAutomationRules",
                          + "securityhub:CreateAutomationRule",
                          + "securityhub:BatchGetAutomationRules",
                          + "securityhub:BatchDeleteAutomationRules",
                        ]
                      + Effect   = "Allow"
                      + Resource = "*"
                      + Sid      = "ManageSecurityHubAutomationRules"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id   = (known after apply)
      + tags        = {
          + "CostCentre" = "cds-aft-log-archive-production"
          + "Terraform"  = "true"
        }
      + tags_all    = {
          + "CostCentre" = "cds-aft-log-archive-production"
          + "Terraform"  = "true"
        }
    }

  # aws_iam_role_policy_attachment.sre_sechub_automation_rules will be created
  + resource "aws_iam_role_policy_attachment" "sre_sechub_automation_rules" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = "sre_sechub_automation_rules_github_action"
    }

  # module.OIDC_Roles.aws_iam_role.this["sre_sechub_automation_rules_github_action"] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRoleWithWebIdentity"
                      + Condition = {
                          + StringLike = {
                              + token.actions.githubusercontent.com:sub = [
                                  + "repo:cds-snc/site-reliability-engineering:ref:refs/heads/main",
                                ]
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + Federated = "arn:aws:iam::274536870005:oidc-provider/token.actions.githubusercontent.com"
                        }
                      + Sid       = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "sre_sechub_automation_rules_github_action"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + role_last_used        = (known after apply)
      + tags                  = {
          + "CostCentre" = "cds-aft-log-archive-production"
          + "Terraform"  = "true"
        }
      + tags_all              = {
          + "CostCentre" = "cds-aft-log-archive-production"
          + "Terraform"  = "true"
        }
      + unique_id             = (known after apply)

      + inline_policy {
          + name   = (known after apply)
          + policy = (known after apply)
        }
    }

Plan: 3 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"
Releasing state lock. This may take a few moments...

Show Conftest results

WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.assume_sre_vulnerability_report"]

18 tests, 17 passed, 1 warning, 0 failures, 0 exceptions

[wanpengyang]

👍