Setup gha 107 #7

chelseybeck · 2024-02-08T04:01:27Z

Changes:

Added a GitHub action to run a plan when a PR is opened and output the plan as a comment on the PR.
Added access level tags to users
To test the action, added a custom policy that grants iam services admins permission to update passwords and create keys for users
Updated policy attachments to use a mapping

Testing

These changes have been tested and produce the plan attached to the latest comment

github-actions · 2024-02-19T23:19:23Z

Terraform plan in .

Error: No configuration files

Error: No configuration files

Plan requires configuration to be present. Planning without a configuration
would mark everything for destruction, which is normally not what is desired.
If you would like to destroy everything, run plan with the -destroy option.
Otherwise, create a Terraform configuration file (.tf file) and try again.

❌ Failed to generate plan in Write Terraform Plan to Pull Request #27

github-actions · 2024-02-19T23:24:30Z

Terraform plan in terraform

Plan: 5 to add, 7 to change, 2 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+   create
!~  update in-place
-   destroy

Terraform will perform the following actions:

  # module.aws_custom_policies.aws_iam_policy.custom_policy["IAMServicesAdmin"] will be created
+   resource "aws_iam_policy" "custom_policy" {
+       arn         = (known after apply)
+       description = "Policy granting IAM services admins permissions to make changes to user accounts"
+       id          = (known after apply)
+       name        = "IAMServicesAdmin"
+       name_prefix = (known after apply)
+       path        = "/"
+       policy      = jsonencode(
            {
+               Statement = [
+                   {
+                       Action   = [
+                           "iam:CreateAccessKey",
                        ]
+                       Effect   = "Allow"
+                       Resource = "arn:aws:iam::*:user/*"
                    },
+                   {
+                       Action    = [
+                           "iam:UpdateLoginProfile",
                        ]
+                       Condition = {
+                           StringEquals = {
+                               "iam:ResourceTag/Access Level" = [
+                                   "1",
+                                   "2",
                                ]
                            }
                        }
+                       Effect    = "Allow"
+                       Resource  = "arn:aws:iam::*:user/*"
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       policy_id   = (known after apply)
+       tags_all    = (known after apply)
    }

  # module.iam_read_only_group.aws_iam_group_policy_attachment.group_policy_attachment["IAMUserChangePassword"] will be created
+   resource "aws_iam_group_policy_attachment" "group_policy_attachment" {
+       group      = "read-only-group"
+       id         = (known after apply)
+       policy_arn = "arn:aws:iam::aws:policy/IAMUserChangePassword"
    }

  # module.iam_read_only_group.aws_iam_group_policy_attachment.group_policy_attachment["ReadOnlyAccess"] will be created
+   resource "aws_iam_group_policy_attachment" "group_policy_attachment" {
+       group      = "read-only-group"
+       id         = (known after apply)
+       policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess"
    }

  # module.iam_read_only_group.aws_iam_group_policy_attachment.group_policy_attachment["arn:aws:iam::aws:policy/IAMUserChangePassword"] will be destroyed
  # (because key ["arn:aws:iam::aws:policy/IAMUserChangePassword"] is not in for_each map)
-   resource "aws_iam_group_policy_attachment" "group_policy_attachment" {
-       group      = "read-only-group" -> null
-       id         = "read-only-group-20240214024410737500000001" -> null
-       policy_arn = "arn:aws:iam::aws:policy/IAMUserChangePassword" -> null
    }

  # module.iam_read_only_group.aws_iam_group_policy_attachment.group_policy_attachment["arn:aws:iam::aws:policy/ReadOnlyAccess"] will be destroyed
  # (because key ["arn:aws:iam::aws:policy/ReadOnlyAccess"] is not in for_each map)
-   resource "aws_iam_group_policy_attachment" "group_policy_attachment" {
-       group      = "read-only-group" -> null
-       id         = "read-only-group-20240214022809806800000006" -> null
-       policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess" -> null
    }

  # module.iam_services_admin_group.aws_iam_group.group will be created
+   resource "aws_iam_group" "group" {
+       arn       = (known after apply)
+       id        = (known after apply)
+       name      = "iam-services-admin-group"
+       path      = "/"
+       unique_id = (known after apply)
    }

  # module.iam_services_admin_group.aws_iam_group_policy_attachment.group_policy_attachment["IAMServicesAdmin"] will be created
+   resource "aws_iam_group_policy_attachment" "group_policy_attachment" {
+       group      = "iam-services-admin-group"
+       id         = (known after apply)
+       policy_arn = (known after apply)
    }

  # module.iam_user_abbyz123.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id            = "abbyz123"
        name          = "abbyz123"
!~      tags          = {
+           "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all      = {
+           "Access Level" = "1"
#            (1 unchanged element hidden)
        }
#        (4 unchanged attributes hidden)
    }

  # module.iam_user_awlFCCamp.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id            = "awlFCCamp"
        name          = "awlFCCamp"
!~      tags          = {
+           "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all      = {
+           "Access Level" = "1"
#            (1 unchanged element hidden)
        }
#        (4 unchanged attributes hidden)
    }

  # module.iam_user_brittanyms.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id            = "brittanyms"
        name          = "brittanyms"
!~      tags          = {
+           "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all      = {
+           "Access Level" = "1"
#            (1 unchanged element hidden)
        }
#        (4 unchanged attributes hidden)
    }

  # module.iam_user_freaky4wrld.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id            = "freaky4wrld"
        name          = "freaky4wrld"
!~      tags          = {
+           "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all      = {
+           "Access Level" = "1"
#            (1 unchanged element hidden)
        }
#        (4 unchanged attributes hidden)
    }

  # module.iam_user_samuelusc.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id            = "samuelusc"
        name          = "samuelusc"
!~      tags          = {
+           "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all      = {
+           "Access Level" = "1"
#            (1 unchanged element hidden)
        }
#        (4 unchanged attributes hidden)
    }

  # module.iam_user_shikha0428.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id            = "shikha0428"
        name          = "shikha0428"
!~      tags          = {
+           "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all      = {
+           "Access Level" = "1"
#            (1 unchanged element hidden)
        }
#        (4 unchanged attributes hidden)
    }

  # module.iam_user_shinjonathan.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id            = "shinjonathan"
        name          = "shinjonathan"
!~      tags          = {
+           "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all      = {
+           "Access Level" = "1"
#            (1 unchanged element hidden)
        }
#        (4 unchanged attributes hidden)
    }

Plan: 5 to add, 7 to change, 2 to destroy.

❌ Error applying plan in Apply Terraform changes on merge #1

…s keys

freaky4wrld

Looks Good!!!

github-actions · 2024-02-22T04:41:14Z

Terraform plan in terraform

Plan: 3 to add, 7 to change, 0 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+   create
!~  update in-place

Terraform will perform the following actions:

  # module.aws_custom_policies.aws_iam_policy.custom_policy["IAMServicesAdmin"] will be created
+   resource "aws_iam_policy" "custom_policy" {
+       arn         = (known after apply)
+       description = "Policy granting IAM services admins permissions to make changes to user accounts"
+       id          = (known after apply)
+       name        = "IAMServicesAdmin"
+       name_prefix = (known after apply)
+       path        = "/"
+       policy      = jsonencode(
            {
+               Statement = [
+                   {
+                       Action   = [
+                           "iam:CreateAccessKey",
                        ]
+                       Effect   = "Allow"
+                       Resource = "arn:aws:iam::*:user/*"
                    },
+                   {
+                       Action    = [
+                           "iam:UpdateLoginProfile",
                        ]
+                       Condition = {
+                           StringEquals = {
+                               "iam:ResourceTag/Access Level" = [
+                                   "1",
+                                   "2",
                                ]
                            }
                        }
+                       Effect    = "Allow"
+                       Resource  = "arn:aws:iam::*:user/*"
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       policy_id   = (known after apply)
+       tags_all    = (known after apply)
    }

  # module.iam_read_only_group.aws_iam_group_policy_attachment.group_policy_attachment["ReadOnlyAccess"] will be created
+   resource "aws_iam_group_policy_attachment" "group_policy_attachment" {
+       group      = "read-only-group"
+       id         = (known after apply)
+       policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess"
    }

  # module.iam_services_admin_group.aws_iam_group_policy_attachment.group_policy_attachment["IAMServicesAdmin"] will be created
+   resource "aws_iam_group_policy_attachment" "group_policy_attachment" {
+       group      = "iam-services-admin-group"
+       id         = (known after apply)
+       policy_arn = (known after apply)
    }

  # module.iam_user_abbyz123.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id            = "abbyz123"
        name          = "abbyz123"
!~      tags          = {
+           "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all      = {
+           "Access Level" = "1"
#            (1 unchanged element hidden)
        }
#        (4 unchanged attributes hidden)
    }

  # module.iam_user_awlFCCamp.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id            = "awlFCCamp"
        name          = "awlFCCamp"
!~      tags          = {
+           "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all      = {
+           "Access Level" = "1"
#            (1 unchanged element hidden)
        }
#        (4 unchanged attributes hidden)
    }

  # module.iam_user_brittanyms.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id            = "brittanyms"
        name          = "brittanyms"
!~      tags          = {
+           "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all      = {
+           "Access Level" = "1"
#            (1 unchanged element hidden)
        }
#        (4 unchanged attributes hidden)
    }

  # module.iam_user_freaky4wrld.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id            = "freaky4wrld"
        name          = "freaky4wrld"
!~      tags          = {
+           "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all      = {
+           "Access Level" = "1"
#            (1 unchanged element hidden)
        }
#        (4 unchanged attributes hidden)
    }

  # module.iam_user_samuelusc.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id            = "samuelusc"
        name          = "samuelusc"
!~      tags          = {
+           "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all      = {
+           "Access Level" = "1"
#            (1 unchanged element hidden)
        }
#        (4 unchanged attributes hidden)
    }

  # module.iam_user_shikha0428.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id            = "shikha0428"
        name          = "shikha0428"
!~      tags          = {
+           "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all      = {
+           "Access Level" = "1"
#            (1 unchanged element hidden)
        }
#        (4 unchanged attributes hidden)
    }

  # module.iam_user_shinjonathan.aws_iam_user.user will be updated in-place
!~  resource "aws_iam_user" "user" {
        id            = "shinjonathan"
        name          = "shinjonathan"
!~      tags          = {
+           "Access Level" = "1"
            "Project"      = "devops-security"
        }
!~      tags_all      = {
+           "Access Level" = "1"
#            (1 unchanged element hidden)
        }
#        (4 unchanged attributes hidden)
    }

Plan: 3 to add, 7 to change, 0 to destroy.

❌ Error applying plan in Apply Terraform changes on merge #1

github-actions · 2024-02-22T04:46:25Z

Terraform plan in terraform

Plan: 2 to add, 0 to change, 1 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+   create
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # module.aws_custom_policies.aws_iam_policy.custom_policy["IAMServicesAdmin"] is tainted, so must be replaced
-/+ resource "aws_iam_policy" "custom_policy" {
!~      arn         = "arn:aws:iam::035866691871:policy/IAMServicesAdmin" -> (known after apply)
!~      id          = "*************************************************" -> (known after apply)
        name        = "IAMServicesAdmin"
+       name_prefix = (known after apply)
!~      policy_id   = "*********************" -> (known after apply)
-       tags        = {} -> null
!~      tags_all    = {} -> (known after apply)
#        (3 unchanged attributes hidden)
    }

  # module.iam_services_admin_group.aws_iam_group_policy_attachment.group_policy_attachment["IAMServicesAdmin"] will be created
+   resource "aws_iam_group_policy_attachment" "group_policy_attachment" {
+       group      = "iam-services-admin-group"
+       id         = (known after apply)
+       policy_arn = (known after apply)
    }

Plan: 2 to add, 0 to change, 1 to destroy.

❌ Error applying plan in Apply Terraform changes on merge #1

github-actions · 2024-02-22T04:51:36Z

Terraform plan in terraform

Plan: 2 to add, 0 to change, 1 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+   create
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # module.aws_custom_policies.aws_iam_policy.custom_policy["IAMServicesAdmin"] is tainted, so must be replaced
-/+ resource "aws_iam_policy" "custom_policy" {
!~      arn         = "arn:aws:iam::035866691871:policy/IAMServicesAdmin" -> (known after apply)
!~      id          = "*************************************************" -> (known after apply)
        name        = "IAMServicesAdmin"
+       name_prefix = (known after apply)
!~      policy_id   = "*********************" -> (known after apply)
-       tags        = {} -> null
!~      tags_all    = {} -> (known after apply)
#        (3 unchanged attributes hidden)
    }

  # module.iam_services_admin_group.aws_iam_group_policy_attachment.group_policy_attachment["IAMServicesAdmin"] will be created
+   resource "aws_iam_group_policy_attachment" "group_policy_attachment" {
+       group      = "iam-services-admin-group"
+       id         = (known after apply)
+       policy_arn = (known after apply)
    }

Plan: 2 to add, 0 to change, 1 to destroy.

❌ Error applying plan in Apply Terraform changes on merge #1

github-actions · 2024-02-22T04:53:58Z

Terraform plan in terraform

Plan: 2 to add, 0 to change, 1 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+   create
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # module.aws_custom_policies.aws_iam_policy.custom_policy["IAMServicesAdmin"] is tainted, so must be replaced
-/+ resource "aws_iam_policy" "custom_policy" {
!~      arn         = "arn:aws:iam::035866691871:policy/IAMServicesAdmin" -> (known after apply)
!~      id          = "*************************************************" -> (known after apply)
        name        = "IAMServicesAdmin"
+       name_prefix = (known after apply)
!~      policy_id   = "*********************" -> (known after apply)
-       tags        = {} -> null
!~      tags_all    = {} -> (known after apply)
#        (3 unchanged attributes hidden)
    }

  # module.iam_services_admin_group.aws_iam_group_policy_attachment.group_policy_attachment["IAMServicesAdmin"] will be created
+   resource "aws_iam_group_policy_attachment" "group_policy_attachment" {
+       group      = "iam-services-admin-group"
+       id         = (known after apply)
+       policy_arn = (known after apply)
    }

Plan: 2 to add, 0 to change, 1 to destroy.

✅ Plan applied in Apply Terraform changes on merge #1

chelseybeck added 21 commits February 7, 2024 19:59

adding workflow directory

6296677

updating - to _

890454e

testing to see if plan works without dflook

cdf8ce8

writing plan to comment

9776bf6

adding missing v

f166ed0

testing path to key

45d14e8

testing permissions with updated path

5343460

reverting back to original directory structure

cadfcee

testing jonathans config

6dadd45

reverting back to previous workflow

5dbd01f

fixing format

9166728

testing init

77013e2

testing ci

1121b9f

testing ci connection

10fb916

fixing directory

85fff0f

adding auth step

a9dd217

testing

b33e6a3

testing

d4f7d37

testing

72ba39f

removing redundancy and testing

e74cfaa

removing test and updating plan to use dflook as planned

28602cc

adding path to plan step

e929b83

chelseybeck added 6 commits February 19, 2024 15:26

removing python script used for testing

9c928ab

adding new users

79cd027

updating read only group to add ability to change pw

d66224b

removing duplicate steps

0e97319

removing duplicate path

b2dc7b5

removing path from plan

22ca6e6

chelseybeck added 9 commits February 19, 2024 15:48

fixing indent and granting contents read access for dflook

fb0c53c

adding checkout step back in

9db8a89

adding iam services admin policy to update passwords and create acces…

22f3b36

…s keys

updating policy arn to use a map and adding the admin group

343ddbd

updating formatting and adding access levels to users

66f4f24

changing for each to use a map

8324623

updating variable to use map instead of list

5ce810f

updating file path

40e5058

adding a custom policy to attach to iam services admin

1d50e71

chelseybeck mentioned this pull request Feb 20, 2024

2024 DevOps Community of Practice Agendas hackforla/ops#100

Open

freaky4wrld self-requested a review February 22, 2024 02:22

brittanyms self-requested a review February 22, 2024 02:22

freaky4wrld previously approved these changes Feb 22, 2024

View reviewed changes

adding apply stage

b32fd04

chelseybeck dismissed freaky4wrld’s stale review via b32fd04 February 22, 2024 02:56

chelseybeck requested a review from freaky4wrld February 22, 2024 02:59

freaky4wrld approved these changes Feb 22, 2024

View reviewed changes

chelseybeck merged commit 28d1065 into main Feb 22, 2024
1 check passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Setup gha 107 #7

Setup gha 107 #7

chelseybeck commented Feb 8, 2024 •

edited

Loading

github-actions bot commented Feb 19, 2024 •

edited

Loading

github-actions bot commented Feb 19, 2024 •

edited

Loading

freaky4wrld left a comment

github-actions bot commented Feb 22, 2024 •

edited

Loading

github-actions bot commented Feb 22, 2024 •

edited

Loading

github-actions bot commented Feb 22, 2024 •

edited

Loading

github-actions bot commented Feb 22, 2024 •

edited

Loading

Setup gha 107 #7

Setup gha 107 #7

Conversation

chelseybeck commented Feb 8, 2024 • edited Loading

Changes:

Testing

github-actions bot commented Feb 19, 2024 • edited Loading

github-actions bot commented Feb 19, 2024 • edited Loading

freaky4wrld left a comment

Choose a reason for hiding this comment

github-actions bot commented Feb 22, 2024 • edited Loading

github-actions bot commented Feb 22, 2024 • edited Loading

github-actions bot commented Feb 22, 2024 • edited Loading

github-actions bot commented Feb 22, 2024 • edited Loading

chelseybeck commented Feb 8, 2024 •

edited

Loading

github-actions bot commented Feb 19, 2024 •

edited

Loading

github-actions bot commented Feb 19, 2024 •

edited

Loading

github-actions bot commented Feb 22, 2024 •

edited

Loading

github-actions bot commented Feb 22, 2024 •

edited

Loading

github-actions bot commented Feb 22, 2024 •

edited

Loading

github-actions bot commented Feb 22, 2024 •

edited

Loading