fix: grant AWS SQLWorkspace RDS vendor permissions

modules/aws/vendor-access/README.md

@@ -32,7 +32,7 @@ This module creates the following resources within your AWS account:
   - Authorized to fully manage StreamNative owned EKS cluster, worker nodes, and load balancers
 
 - `role/StreamNativeCloudBootstrapRole` & `policy/StreamNativeCloudBootstrapPolicy`: These IAM resources are used for provisioning, deprovisioning, and regular or emergency maintenance. This role and policy have the following characteristics:
-  - Have the ability to create, delete, manage, and read (within the limits of the permission boundary) EC2, EKS, IAM, DynamoDB, Route53, and KMS resources
+  - Have the ability to create, delete, manage, and read (within the limits of the permission boundary) EC2, EKS, IAM, DynamoDB, Route53, S3, RDS, and KMS resources
   - Cannot create or modify IAM policies (but are allowed to work with IAM policies specified by this module)
   - Can only work with resources that have specific tags associated or certain expected patterns in the resource's friendly name.
 

modules/aws/vendor-access/files/permission_boundary_iam_policy.json.tpl

@@ -19,6 +19,7 @@
           "kms:*",
           "logs:*",
           "pricing:*",
+          "rds:*",
           "route53:*",
           "route53domains:*",
           "s3:*",

modules/aws/vendor-access/files/provision2.json.tpl

@@ -225,6 +225,84 @@
           "aws:ResourceTag/Vendor": "StreamNative"
         }
       }
+    },
+    {
+      "Sid": "SQLWorkspaceRDSCreateInstance",
+      "Effect": "Allow",
+      "Action": "rds:CreateDBInstance",
+      "Resource": [
+        "arn:${partition}:rds:${region}:${account_id}:db:*",
+        "arn:${partition}:rds:${region}:${account_id}:og:default*",
+        "arn:${partition}:rds:${region}:${account_id}:pg:default*",
+        "arn:${partition}:rds:${region}:${account_id}:subgrp:*"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "aws:RequestTag/Vendor": "StreamNative",
+          "rds:DatabaseEngine": "postgres"
+        },
+        "Bool": {
+          "rds:PubliclyAccessible": "false",
+          "rds:StorageEncrypted": "true"
+        }
+      }
+    },
+    {
+      "Sid": "SQLWorkspaceRDSCreateSubnetGroup",
+      "Effect": "Allow",
+      "Action": "rds:CreateDBSubnetGroup",
+      "Resource": "arn:${partition}:rds:${region}:${account_id}:subgrp:*",
+      "Condition": {
+        "StringEquals": {
+          "aws:RequestTag/Vendor": "StreamNative"
+        }
+      }
+    },
+    {
+      "Sid": "SQLWorkspaceRDSTagOnCreate",
+      "Effect": "Allow",
+      "Action": "rds:AddTagsToResource",
+      "Resource": [
+        "arn:${partition}:rds:${region}:${account_id}:db:*",
+        "arn:${partition}:rds:${region}:${account_id}:subgrp:*"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "aws:RequestTag/Vendor": "StreamNative"
+        }
+      }
+    },
+    {
+      "Sid": "SQLWorkspaceRDSManage",
+      "Effect": "Allow",
+      "Action": [
+        "rds:AddTagsToResource",
+        "rds:DeleteDBInstance",
+        "rds:DeleteDBSubnetGroup",
+        "rds:ModifyDBInstance",
+        "rds:ModifyDBSubnetGroup",
+        "rds:RemoveTagsFromResource"
+      ],
+      "Resource": [
+        "arn:${partition}:rds:${region}:${account_id}:db:*",
+        "arn:${partition}:rds:${region}:${account_id}:subgrp:*"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "aws:ResourceTag/Vendor": "StreamNative"
+        }
+      }
+    },
+    {
+      "Sid": "SQLWorkspaceRDSProtectOwnershipTag",
+      "Effect": "Deny",
+      "Action": "rds:RemoveTagsFromResource",
+      "Resource": "*",
+      "Condition": {
+        "ForAnyValue:StringEquals": {
+          "aws:TagKeys": "Vendor"
+        }
+      }
     }
   ]
 }

modules/aws/vendor-access/files/provision_preserve.json.tpl

@@ -33,6 +33,8 @@
         "kms:ListResourceTags",
         "logs:Describe*",
         "logs:List*",
+        "rds:Describe*",
+        "rds:ListTagsForResource",
         "route53:Get*",
         "route53:List*",
         "s3:ListAllMyBuckets",
@@ -125,4 +127,4 @@
       "Resource": "arn:${partition}:iam::${account_id}:role/aws-service-role/*"
     }
   ]
-}
+}

modules/aws/vendor-access/main.tf

@@ -199,10 +199,10 @@ resource "aws_iam_policy" "provision_preserve_policy" {
   path        = "/StreamNative/"
   policy = templatefile("${path.module}/files/provision_preserve.json.tpl",
     {
-      account_id      = local.account_id
-      bucket_pattern  = var.s3_bucket_pattern
-      partition       = local.aws_partition
-      r53_zone_arns   = local.r53_zone_arns
+      account_id     = local.account_id
+      bucket_pattern = var.s3_bucket_pattern
+      partition      = local.aws_partition
+      r53_zone_arns  = local.r53_zone_arns
   })
   tags = local.tag_set
 }
@@ -214,7 +214,7 @@ resource "aws_iam_policy" "provision_1_policy" {
   path        = "/StreamNative/"
   policy = templatefile("${path.module}/files/provision1.json.tpl",
     {
-      vpc_ids         = local.arn_like_vpcs_str
+      vpc_ids = local.arn_like_vpcs_str
   })
   tags = local.tag_set
 }

modules/aws/vendor-access/variables.tf

@@ -16,7 +16,7 @@
 
 variable "sn_policy_version" {
   description = "The value of SNVersion tag"
-  default     = "3.25.0"  # {{ x-release-please-version }}
+  default     = "3.25.0" # {{ x-release-please-version }}
   type        = string
 }