-
Notifications
You must be signed in to change notification settings - Fork 8
/
ecs_datadog_iam.tf
45 lines (38 loc) · 1.16 KB
/
ecs_datadog_iam.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
resource "aws_iam_role" "ecs-datadog-role" {
name = "${var.env}-${var.identifier}-jenkins-ecs-datadog-role"
assume_role_policy = "${data.aws_iam_policy_document.ecs-task-role-assume.json}"
}
resource "aws_iam_role_policy_attachment" "ecs-datadog" {
role = "${aws_iam_role.ecs-datadog-role.name}"
policy_arn = "${aws_iam_policy.ecs-datadog-role-policy.arn}"
}
resource "aws_iam_policy" "ecs-datadog-role-policy" {
name = "${var.env}-${var.identifier}-datadog-agent-ecs-iam-role-policy"
policy = "${data.aws_iam_policy_document.ecs-datadog-role.json}"
}
data "aws_iam_policy_document" "ecs-datadog-role" {
statement {
sid = "AllowDatadogToReadECSMetrics",
effect = "Allow"
actions = [
"ecs:RegisterContainerInstance",
"ecs:DeregisterContainerInstance",
"ecs:DiscoverPollEndpoint",
"ecs:Submit*",
"ecs:Poll",
"ecs:StartTask",
"ecs:StartTelemetrySession"
]
resources = [ "*" ]
}
}
data "aws_iam_policy_document" "ecs-task-role-assume" {
statement {
effect = "Allow"
actions = [ "sts:AssumeRole" ]
principals {
type = "Service"
identifiers = [ "ecs-tasks.amazonaws.com" ]
}
}
}