Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…

…izations-infra
Sage-Bionetworks-IT · Dec 18, 2024 · 3b977ee · 3b977ee
2 parents 5b04ff6 + 4ef56e3
commit 3b977ee
Show file tree

Hide file tree

Showing 7 changed files with 207 additions and 83 deletions.
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -1,3 +1,5 @@
+ci:
+  autoupdate_schedule: monthly
 repos:
   - repo: https://github.com/awslabs/git-secrets
     rev: b9e96b3212fa06aea65964ff0d5cda84ce935f38
@@ -6,7 +8,7 @@ repos:
       entry: git-secrets
       args: [--scan, --recursive]
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.6.0
+    rev: v5.0.0
     hooks:
       # On Windows, git will convert all CRLF to LF, but only after all hooks are done executing.
       # yamllint will fail before git has a chance to convert line endings, so it must be explicitly done before yamllint
@@ -20,7 +22,7 @@ repos:
     hooks:
       - id: yamllint
   - repo: https://github.com/awslabs/cfn-python-lint
-    rev: v1.15.2
+    rev: v1.20.1
     hooks:
       - id: cfn-python-lint
         files: templates/.*\.(json|yml|yaml)$
@@ -30,7 +32,7 @@ repos:
     hooks:
       - id: remove-tabs
   - repo: https://github.com/sirosen/check-jsonschema
-    rev: 0.29.3
+    rev: 0.30.0
     hooks:
       - id: check-github-workflows
       - id: check-github-actions

diff --git a/org-formation/650-identity-providers/_tasks.yaml b/org-formation/650-identity-providers/_tasks.yaml
@@ -100,58 +100,58 @@ GithubOidcSageBionetworksDataCuratorInfra:
       - !Ref DCAProdAccount
     Region: us-east-1
 
-GithubOidcSageBionetworksSchematicInfra:
+GithubOidcSageBionetworksItSchematicInfraV2:
   Type: update-stacks
   DependsOn: GithubOidcSageBionetworks
   Template: https://raw.githubusercontent.com/Sage-Bionetworks/aws-infra/v0.7.6/templates/IAM/github-oidc-provider.j2
-  StackName: !Sub ${resourcePrefix}-${appName}-sage-bionetworks-schematic-infra
+  StackName: !Sub ${resourcePrefix}-${appName}-sage-bionetworks-it-schematic-infra-v2
   Parameters:
     ProviderArn: !CopyValue [ !Sub '${resourcePrefix}-${appName}-ProviderArn' ]
-    ProviderRoleName: !Sub ${resourcePrefix}-${appName}-sage-bionetworks-schematic-infra
+    ProviderRoleName: !Sub ${resourcePrefix}-${appName}-sage-bionetworks-it-schematic-infra-v2
     ManagedPolicyArns:
       - "arn:aws:iam::aws:policy/AdministratorAccess"
       - "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser"
   TemplatingContext:
-    GitHubOrg: "Sage-Bionetworks"
+    GitHubOrg: "Sage-Bionetworks-IT"
     Repositories:
-      - name: "schematic-infra"
-        branches: ["*"]
+      - name: "schematic-infra-v2"
+        branches: ["dev", "stage", "prod"]
   DefaultOrganizationBinding:
     Account:
       - !Ref DnTDevAccount
       - !Ref DCAProdAccount
     Region: us-east-1
 
-GithubOidcSageBionetworksItSchematicInfraV2:
+GithubOidcSageBionetworksSynapseDockerRegistry:
   Type: update-stacks
   DependsOn: GithubOidcSageBionetworks
   Template: https://raw.githubusercontent.com/Sage-Bionetworks/aws-infra/v0.7.6/templates/IAM/github-oidc-provider.j2
-  StackName: !Sub ${resourcePrefix}-${appName}-sage-bionetworks-it-schematic-infra-v2
+  StackName: !Sub ${resourcePrefix}-${appName}-sage-bionetworks-synapse-docker-registry
   Parameters:
     ProviderArn: !CopyValue [ !Sub '${resourcePrefix}-${appName}-ProviderArn' ]
-    ProviderRoleName: !Sub ${resourcePrefix}-${appName}-sage-bionetworks-it-schematic-infra-v2
+    ProviderRoleName: !Sub ${resourcePrefix}-${appName}-sage-bionetworks-synapse-docker-registry
     ManagedPolicyArns:
       - "arn:aws:iam::aws:policy/AdministratorAccess"
       - "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser"
   TemplatingContext:
-    GitHubOrg: "Sage-Bionetworks-IT"
+    GitHubOrg: "Sage-Bionetworks"
     Repositories:
-      - name: "schematic-infra-v2"
-        branches: ["dev", "stage", "prod"]
+      - name: "synapse-docker-registry"
+        branches: ["*"]
   DefaultOrganizationBinding:
     Account:
-      - !Ref DnTDevAccount
-      - !Ref DCAProdAccount
+      - !Ref SynapseDevAccount
+      - !Ref SynapseProdAccount
     Region: us-east-1
 
-GithubOidcSageBionetworksSynapseDockerRegistry:
+GithubOidcSageBionetworksSynapse:
   Type: update-stacks
   DependsOn: GithubOidcSageBionetworks
   Template: https://raw.githubusercontent.com/Sage-Bionetworks/aws-infra/v0.7.6/templates/IAM/github-oidc-provider.j2
-  StackName: !Sub ${resourcePrefix}-${appName}-sage-bionetworks-synapse-docker-registry
+  StackName: !Sub ${resourcePrefix}-${appName}-sage-bionetworks-synapse
   Parameters:
     ProviderArn: !CopyValue [ !Sub '${resourcePrefix}-${appName}-ProviderArn' ]
-    ProviderRoleName: !Sub ${resourcePrefix}-${appName}-sage-bionetworks-synapse-docker-registry
+    ProviderRoleName: !Sub ${resourcePrefix}-${appName}-sage-bionetworks-synapse
     ManagedPolicyArns:
       - "arn:aws:iam::aws:policy/AdministratorAccess"
       - "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser"
@@ -160,6 +160,8 @@ GithubOidcSageBionetworksSynapseDockerRegistry:
     Repositories:
       - name: "synapse-docker-registry"
         branches: ["*"]
+      - name: "nbconvert-webapp"
+        branches: ["master", "develop"]
   DefaultOrganizationBinding:
     Account:
       - !Ref SynapseDevAccount
@@ -804,6 +806,29 @@ GithubOidcAgoraInfraDeploy:
       - !Ref AgoraProdAccount
     Region: us-east-1
 
+GithubOidcAgoraInfraV3:
+  Type: update-stacks
+  DependsOn: GithubOidcSageBionetworks
+  Template: https://raw.githubusercontent.com/Sage-Bionetworks/aws-infra/v0.7.6/templates/IAM/github-oidc-provider.j2
+  StackName: !Sub ${resourcePrefix}-${appName}-agora-infra-v3
+  Parameters:
+    ProviderArn: !CopyValue [ !Sub '${resourcePrefix}-${appName}-ProviderArn' ]
+    ProviderRoleName: !Sub ${resourcePrefix}-${appName}-agora-infra-v3
+    MaxSessionDuration: 7200
+    ManagedPolicyArns:
+      - "arn:aws:iam::aws:policy/AdministratorAccess"
+      - "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser"
+  TemplatingContext:
+    GitHubOrg: "Sage-Bionetworks-IT"
+    Repositories:
+      - name: "agora-infra-v3"
+        branches: ["dev","stage","prod"]
+  DefaultOrganizationBinding:
+    Account:
+      - !Ref AgoraDevAccount
+      - !Ref AgoraProdAccount
+    Region: us-east-1
+
 GithubOidcAgoraEBDeploy:
   Type: update-stacks
   DependsOn: GithubOidcSageBionetworks
@@ -849,32 +874,6 @@ GithubOidcOpenChallengesDeploy:
       - !Ref OpenChallengesProdAccount
     Region: us-east-1
 
-GithubOidcNbConvertDeploy:
-  Type: update-stacks
-  DependsOn: GithubOidcSageBionetworks
-  Template: https://raw.githubusercontent.com/Sage-Bionetworks/aws-infra/v0.7.6/templates/IAM/github-oidc-provider.j2
-  StackName: !Sub ${resourcePrefix}-${appName}-nbconvert-deploy
-  Parameters:
-    ProviderArn: !CopyValue [ !Sub '${resourcePrefix}-${appName}-ProviderArn' ]
-    ProviderRoleName: !Sub ${resourcePrefix}-${appName}-nbconvert-deploy
-    MaxSessionDuration: 7200
-    ManagedPolicyArns:
-      - "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess"
-      - "arn:aws:iam::aws:policy/AWSLambda_FullAccess"
-      - "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"
-      - "arn:aws:iam::aws:policy/IAMFullAccess"
-      - "arn:aws:iam::aws:policy/AWSCloudFormationFullAccess"
-  TemplatingContext:
-    GitHubOrg: "Sage-Bionetworks"
-    Repositories:
-      - name: "nbconvert-webapp"
-        branches: ["master", "develop"]
-  DefaultOrganizationBinding:
-    Account:
-      - !Ref SynapseDevAccount
-      - !Ref SynapseProdAccount
-    Region: us-east-1
-
 ############################### Managed Policies ###############################
 # Managed policies used in github OIDC providers
 # Note: Managed policies can be used as work around for the AWS cloudformation
@@ -898,9 +897,7 @@ SynapseMonorepoBucketAccessPolicy:
               "Effect": "Allow",
               "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListBucketMultipartUploads" ],
               "Resource": [
-                            "arn:aws:s3:::prod.accounts.sagebionetworks.org",
-                            "arn:aws:s3:::staging.accounts.sagebionetworks.org",
-                            "arn:aws:s3:::dev.accounts.sagebionetworks.org",
+                            "arn:aws:s3:::dev.accounts.synapse.org",
                             "arn:aws:s3:::prod.accounts.synapse.org",
                             "arn:aws:s3:::staging.accounts.synapse.org",
                             "arn:aws:s3:::prod-adknowledgeportalsynapse-org-websitebucket-1wcys549ufmd",
@@ -951,9 +948,7 @@ SynapseMonorepoFileAccessPolicy:
               "Effect": "Allow",
               "Action": [ "s3:PutObject", "s3:GetObject", "s3:DeleteObject", "s3:*Multipart*" ],
               "Resource": [
-                            "arn:aws:s3:::prod.accounts.sagebionetworks.org/*",
-                            "arn:aws:s3:::staging.accounts.sagebionetworks.org/*",
-                            "arn:aws:s3:::dev.accounts.sagebionetworks.org/*",
+                            "arn:aws:s3:::dev.accounts.synapse.org/*",
                             "arn:aws:s3:::prod.accounts.synapse.org/*",
                             "arn:aws:s3:::staging.accounts.synapse.org/*",
                             "arn:aws:s3:::prod-adknowledgeportalsynapse-org-websitebucket-1wcys549ufmd/*",
@@ -1021,8 +1016,6 @@ SynapseMonorepoCloudfrontAccessPolicy:
                             "arn:aws:cloudfront::797640923903:distribution/E10U4765KQQW5P",
                             "arn:aws:cloudfront::797640923903:distribution/E1FILQHG8BTWIL",
                             "arn:aws:cloudfront::797640923903:distribution/E14P60CJ0I6G7Y",
-                            "arn:aws:cloudfront::797640923903:distribution/E2656IE63W1MXI",
-                            "arn:aws:cloudfront::797640923903:distribution/EY52HOUGKDP1F",
                             "arn:aws:cloudfront::797640923903:distribution/E14F656YEGR4P3",
                             "arn:aws:cloudfront::797640923903:distribution/E1CB47ERU70VWV",
                             "arn:aws:cloudfront::797640923903:distribution/E2K9BYXQN2MM76",

diff --git a/org-formation/700-aws-sso/_tasks.yaml b/org-formation/700-aws-sso/_tasks.yaml
@@ -313,6 +313,10 @@ Parameters:
     Type: String
     Default: '2448e4e8-50b1-70e5-def0-07e0f4fcd60e'
 
+  OpenchallengesDevDeveloperGroup:     # JC aws-openchallenges-dev-developers
+    Type: String
+    Default: '44183438-a051-7070-f706-284ffd41907b'
+
   OpenchallengesDevAdminGroup:     # JC aws-openchallenges-dev-admins
     Type: String
     Default: 'e4388458-2011-7096-3f98-3a6eeb10e458'
@@ -643,8 +647,18 @@ SsoLlmDeveloper:
     principalId: !Ref llmDeveloperGroup
     permissionSetName: 'LlmDeveloper'
     managedPolicies:
-      - 'arn:aws:iam::aws:policy/AmazonBedrockFullAccess'
-      - 'arn:aws:iam::aws:policy/AWSCloudFormationFullAccess'
+      - 'arn:aws:iam::aws:policy/PowerUserAccess'
+    inlinePolicy: >-
+      {
+          "Version": "2012-10-17",
+          "Statement": [
+              {
+                  "Effect": "Deny",
+                  "Action": "sts:AssumeRole",
+                  "Resource": "*"
+              }
+          ]
+      }
     sessionDuration: 'PT12H'
 
 # Role for a user that can only access AWS Athena in the Synapse Dev account
@@ -2154,6 +2168,23 @@ SsoItsandboxDeveloper:
     principalId: !Ref itsandboxDeveloperGroup
     permissionSetArn: !CopyValue [ !Sub '${resourcePrefix}-${appName}-developer-permission-set-arn' ]
 
+SsoOpenchallengesDevDeveloper:
+  Type: update-stacks
+  DependsOn: SsoDeveloper
+  Template: https://raw.githubusercontent.com/Sage-Bionetworks/aws-infra/v0.3.8/templates/SSO/aws-sso.yaml
+  StackName: !Sub '${resourcePrefix}-${appName}-openchallenges-dev-developer'
+  StackDescription: 'SSO: Developer role used by openchallenges developer group'
+  DefaultOrganizationBindingRegion: !Ref primaryRegion
+  DefaultOrganizationBinding:
+    IncludeMasterAccount: true
+  OrganizationBindings:
+    TargetBinding:
+      Account: !Ref OpenChallengesDevAccount
+  Parameters:
+    instanceArn: !Ref instanceArn
+    principalId: !Ref OpenchallengesDevDeveloperGroup
+    permissionSetArn: !CopyValue [ !Sub '${resourcePrefix}-${appName}-developer-permission-set-arn' ]
+
 SsoOpenchallengesDevAdmin:
   Type: update-stacks
   DependsOn: SsoAdministrator