Add common policy module for per-zone route53 access

Use the common policy for the cert-manager-ocp-massopen user and the
innabox-dns-manager user.

Author: larsks

iam-users/cert-manager-ocp-massopen.tf

@@ -1,49 +1,17 @@
 # -- cert-manager-ocp-massopen ------------------------------------------------
 
-data "aws_route53_zone" "ocp_massopen_cloud" {
-  name = "ocp.massopen.cloud"
-}
-
-data "aws_iam_policy_document" "cert_manager_ocp_massopen" {
-  statement {
-    sid    = "ManageRecords"
-    effect = "Allow"
-    actions = [
-      "route53:ChangeResourceRecordSets",
-      "route53:ListResourceRecordSets",
-    ]
-    resources = [data.aws_route53_zone.ocp_massopen_cloud.arn]
-  }
-
-  statement {
-    sid       = "GetChange"
-    effect    = "Allow"
-    actions   = ["route53:GetChange"]
-    resources = ["arn:aws:route53:::change/*"]
-  }
-
-  statement {
-    sid    = "ListZones"
-    effect = "Allow"
-    actions = [
-      "route53:ListHostedZones",
-      "route53:ListHostedZonesByName",
-    ]
-    resources = ["*"]
-  }
-}
-
-resource "aws_iam_policy" "cert_manager_ocp_massopen" {
-  name        = "ocp-massopen-cloud"
-  description = "modify records in ocp.massopen.cloud mainly for the purposes for dns01 challenged."
-  policy      = data.aws_iam_policy_document.cert_manager_ocp_massopen.json
+module "route53_policy_ocp_massopen" {
+  source             = "../modules/route53-policy"
+  zone_name          = "ocp.massopen.cloud"
+  policy_name        = "ocp-massopen-cloud"
+  policy_description = "modify records in ocp.massopen.cloud mainly for the purposes for dns01 challenged."
 }
 
 module "cert_manager_ocp_massopen" {
   source = "../modules/iam-user"
   name   = "cert-manager-ocp-massopen"
   policy_arns = {
-    ocp-massopen-cloud = aws_iam_policy.cert_manager_ocp_massopen.arn
+    ocp-massopen-cloud = module.route53_policy_ocp_massopen.policy_arn
   }
   tags = {
     "AKIAYLUGMT7YKZRT4APO" = "cert-manager-nist-clusters"

iam-users/innabox-dns-manager.tf

@@ -0,0 +1,20 @@
+# -- innabox-dns-manager ------------------------------------------------
+
+module "route53_policy_innabox" {
+  source             = "../modules/route53-policy"
+  zone_name          = "box.massopen.cloud"
+  policy_name        = "box-massopen-cloud"
+  policy_description = "allow cert-manager in innabox dev cluster to manage box.massopen.cloud"
+}
+
+module "innbox_dns_manager" {
+  source = "../modules/iam-user"
+  name   = "innabox-dns-manager"
+  policy_arns = {
+    ocp-massopen-cloud = module.route53_policy_innabox.policy_arn
+  }
+  tags = {
+    AKIAYLUGMT7YLZGBNPO2 = "create dns record for innabox tenant clusters"
+    AKIAYLUGMT7YL5VWQTCR = "innabox AAP credentials"
+  }
+}

modules/route53-policy/main.tf

@@ -0,0 +1,38 @@
+data "aws_route53_zone" "this" {
+  name = var.zone_name
+}
+
+data "aws_iam_policy_document" "this" {
+  statement {
+    sid    = "ManageRecords"
+    effect = "Allow"
+    actions = [
+      "route53:ChangeResourceRecordSets",
+      "route53:ListResourceRecordSets",
+    ]
+    resources = [data.aws_route53_zone.this.arn]
+  }
+
+  statement {
+    sid       = "GetChange"
+    effect    = "Allow"
+    actions   = ["route53:GetChange"]
+    resources = ["arn:aws:route53:::change/*"]
+  }
+
+  statement {
+    sid    = "ListZones"
+    effect = "Allow"
+    actions = [
+      "route53:ListHostedZones",
+      "route53:ListHostedZonesByName",
+    ]
+    resources = ["*"]
+  }
+}
+
+resource "aws_iam_policy" "this" {
+  name        = var.policy_name
+  description = var.policy_description
+  policy      = data.aws_iam_policy_document.this.json
+}

modules/route53-policy/outputs.tf

@@ -0,0 +1,11 @@
+output "policy_arn" {
+  value = aws_iam_policy.this.arn
+}
+
+output "zone_arn" {
+  value = data.aws_route53_zone.this.arn
+}
+
+output "zone_id" {
+  value = data.aws_route53_zone.this.zone_id
+}

modules/route53-policy/variables.tf

@@ -0,0 +1,15 @@
+variable "zone_name" {
+  description = "Name of the Route53 hosted zone (e.g. example.com)"
+  type        = string
+}
+
+variable "policy_name" {
+  description = "Name for the IAM policy"
+  type        = string
+}
+
+variable "policy_description" {
+  description = "Description for the IAM policy"
+  type        = string
+  default     = ""
+}