Allow readonly roles to lock Terraform state files

infra/deployments/deploy/engineer-access/roles.tf

@@ -12,6 +12,7 @@ module "engineer_access" {
   codestar_connection_arn   = var.codestar_connection_arn
   allow_ecs_task_usage      = false
   allow_rds_data_api_access = false
+  state_file_bucket_name    = "gds-forms-deploy-tfstate"
 
   # Pentesters may not have GDS domains so our pattern using the 'users' module
   # doesn't necessarily work.

infra/deployments/forms/account/engineer-access.tf

@@ -15,4 +15,5 @@ module "engineer_access" {
   codestar_connection_arn   = var.codestar_connection_arn
   allow_rds_data_api_access = true
   allow_ecs_task_usage      = true
+  state_file_bucket_name    = var.bucket
 }

infra/deployments/integration/account/engineer-access.tf

@@ -33,6 +33,31 @@ resource "aws_iam_policy" "deny_parameter_store" {
   })
 }
 
+resource "aws_iam_policy" "lock_state_files" {
+  name = "release-lock-on-state-files"
+  path = "/"
+
+  description = "Allow locking state files"
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = [
+          "s3:GetObject",
+          "s3:PutObject",
+          "s3:DeleteObject"
+        ]
+        Effect = "Allow"
+        Resource = [
+          "arn:aws:s3:::${var.bucket}/*.tflock"
+        ]
+      }
+    ]
+  })
+}
+
+
 
 module "admin_role" {
   for_each = toset(local.admin_users)
@@ -51,6 +76,7 @@ module "support_role" {
   email       = "${each.value}@digital.cabinet-office.gov.uk"
   role_suffix = "support"
   iam_policy_arns = [
+    aws_iam_policy.lock_state_files.arn
   ]
   ip_restrictions = local.ip_restrictions
 }
@@ -63,6 +89,7 @@ module "readonly_role" {
   role_suffix = "readonly"
   iam_policy_arns = [
     "arn:aws:iam::aws:policy/ReadOnlyAccess",
+    aws_iam_policy.lock_state_files.arn
   ]
   ip_restrictions = local.ip_restrictions
 }

infra/modules/engineer-access/policies.tf

@@ -289,24 +289,26 @@ resource "aws_iam_policy" "deny_parameter_store" {
   })
 }
 
-resource "aws_iam_policy" "release_lock_on_state_files" {
+resource "aws_iam_policy" "lock_state_files" {
   name = "release-lock-on-state-files"
   path = "/"
 
-  description = "Allow releasing the lock on state files"
+  description = "Allow locking state files"
 
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
       {
         Action = [
+          "s3:GetObject",
+          "s3:PutObject",
           "s3:DeleteObject"
         ]
         Effect = "Allow"
         Resource = [
-          "arn:aws:s3:::gds-forms-${var.environment_type}-tfstate/*.tflock"
+          "arn:aws:s3:::${var.state_file_bucket_name}/*.tflock"
         ]
       }
     ]
   })
-}
+}

infra/modules/engineer-access/roles.tf

@@ -28,7 +28,7 @@ module "support_role" {
     aws_iam_policy.manage_dashboards.arn,
     aws_iam_policy.manage_deployments.arn,
     aws_iam_policy.manage_maintenance_page.arn,
-    aws_iam_policy.release_lock_on_state_files.arn,
+    aws_iam_policy.lock_state_files.arn,
     var.allow_rds_data_api_access ? [aws_iam_policy.query_rds_with_data_api[0].arn] : [],
     var.allow_ecs_task_usage ? [aws_iam_policy.run_task[0].arn, aws_iam_policy.stop_task[0].arn] : []
   ])
@@ -43,6 +43,7 @@ module "readonly_role" {
   role_suffix = "readonly"
   iam_policy_arns = [
     "arn:aws:iam::aws:policy/ReadOnlyAccess",
+    aws_iam_policy.lock_state_files.arn,
   ]
   ip_restrictions = local.vpn_ip_restrictions
 }

infra/modules/engineer-access/variables.tf

@@ -57,4 +57,9 @@ variable "allow_rds_data_api_access" {
 variable "allow_ecs_task_usage" {
   type        = bool
   description = "Whether appropriate engineer roles should be able to run tasks in AWS ECS"
-}
+}
+
+variable "state_file_bucket_name" {
+  type        = string
+  description = "The name of the S3 bucket in which Terraform state files are stored"
+}