|
| 1 | +// The user-bot Lambda: when a new IAM user gets a console login profile, it sets a |
| 2 | +// temporary password and DMs it to the person on Slack. See |
| 3 | +// hackforla/devops-security#209 and lambda/user-bot/README.md. |
| 4 | +// |
| 5 | +// Terraform owns everything about the function except its code. The real code is |
| 6 | +// built and shipped by .github/workflows/user-bot-deploy.yml, which assumes the |
| 7 | +// devops-security-user-bot-deploy role declared in aws-gha-oidc-providers.tf. Here the |
| 8 | +// function is created from a placeholder, and ignore_changes stops Terraform reverting |
| 9 | +// whatever the deploy workflow last pushed. |
| 10 | +// |
| 11 | +// Everything that is regional lives in us-east-1, not the provider's us-west-2. IAM is |
| 12 | +// a global service and its CloudTrail events are delivered to EventBridge only in |
| 13 | +// us-east-1, and an EventBridge rule can only target a Lambda in its own region. The |
| 14 | +// events come from the management-events trail in cloudtrail.tf, which is multi-region |
| 15 | +// and includes global service events. |
| 16 | + |
| 17 | +data "aws_caller_identity" "current" {} |
| 18 | + |
| 19 | +locals { |
| 20 | + user_bot_region = "us-east-1" |
| 21 | +} |
| 22 | + |
| 23 | +// --------------------------------------------------------------------------- |
| 24 | +// Trigger |
| 25 | +// --------------------------------------------------------------------------- |
| 26 | + |
| 27 | +// CreateLoginProfile rather than CreateUser: the aws-users module calls CreateUser a |
| 28 | +// moment before CreateLoginProfile, so a Lambda triggered by CreateUser could try to |
| 29 | +// update a login profile that does not exist yet. By the time this event fires, the |
| 30 | +// user, its tags and its login profile all exist. |
| 31 | +// |
| 32 | +// Failed calls are recorded by CloudTrail too, with an errorCode. Those are excluded: |
| 33 | +// a failed CreateLoginProfile did not create anything to act on. |
| 34 | +resource "aws_cloudwatch_event_rule" "user_bot" { |
| 35 | + region = local.user_bot_region |
| 36 | + |
| 37 | + name = "user-bot-create-login-profile" |
| 38 | + description = "Invokes the user-bot Lambda when an IAM user is given a console login profile" |
| 39 | + |
| 40 | + event_pattern = jsonencode({ |
| 41 | + source = ["aws.iam"] |
| 42 | + detail-type = ["AWS API Call via CloudTrail"] |
| 43 | + detail = { |
| 44 | + eventSource = ["iam.amazonaws.com"] |
| 45 | + eventName = ["CreateLoginProfile"] |
| 46 | + errorCode = [{ exists = false }] |
| 47 | + } |
| 48 | + }) |
| 49 | +} |
| 50 | + |
| 51 | +resource "aws_cloudwatch_event_target" "user_bot" { |
| 52 | + region = local.user_bot_region |
| 53 | + |
| 54 | + rule = aws_cloudwatch_event_rule.user_bot.name |
| 55 | + arn = aws_lambda_function.user_bot.arn |
| 56 | +} |
| 57 | + |
| 58 | +resource "aws_lambda_permission" "user_bot_eventbridge" { |
| 59 | + region = local.user_bot_region |
| 60 | + |
| 61 | + statement_id = "AllowInvokeFromCreateLoginProfileRule" |
| 62 | + action = "lambda:InvokeFunction" |
| 63 | + function_name = aws_lambda_function.user_bot.function_name |
| 64 | + principal = "events.amazonaws.com" |
| 65 | + source_arn = aws_cloudwatch_event_rule.user_bot.arn |
| 66 | +} |
| 67 | + |
| 68 | +// --------------------------------------------------------------------------- |
| 69 | +// Function |
| 70 | +// --------------------------------------------------------------------------- |
| 71 | + |
| 72 | +// Declared so it carries the default tags and a retention period. Without it, Lambda |
| 73 | +// creates the group on first invocation, untagged and never expiring. |
| 74 | +resource "aws_cloudwatch_log_group" "user_bot" { |
| 75 | + region = local.user_bot_region |
| 76 | + |
| 77 | + name = "/aws/lambda/user-bot" |
| 78 | + retention_in_days = 90 |
| 79 | +} |
| 80 | + |
| 81 | +// Stands in until the deploy workflow ships the real code. It deliberately does |
| 82 | +// nothing: an event arriving before the first deploy must not reset anyone's password. |
| 83 | +data "archive_file" "user_bot_placeholder" { |
| 84 | + type = "zip" |
| 85 | + output_path = "${path.module}/.terraform/user-bot-placeholder.zip" |
| 86 | + |
| 87 | + source { |
| 88 | + filename = "index.js" |
| 89 | + content = <<-EOT |
| 90 | + exports.handler = async () => { |
| 91 | + console.log("user-bot placeholder: no code deployed yet, taking no action"); |
| 92 | + }; |
| 93 | + EOT |
| 94 | + } |
| 95 | +} |
| 96 | + |
| 97 | +resource "aws_lambda_function" "user_bot" { |
| 98 | + region = local.user_bot_region |
| 99 | + |
| 100 | + function_name = "user-bot" |
| 101 | + description = "DMs new IAM users a temporary console password. Code is deployed by user-bot-deploy.yml in hackforla/devops-security." |
| 102 | + role = aws_iam_role.user_bot.arn |
| 103 | + |
| 104 | + // Must match lambda/user-bot/.nvmrc, which is what CI builds and tests with. |
| 105 | + runtime = "nodejs24.x" |
| 106 | + handler = "index.handler" |
| 107 | + timeout = 30 |
| 108 | + memory_size = 128 |
| 109 | + |
| 110 | + filename = data.archive_file.user_bot_placeholder.output_path |
| 111 | + source_code_hash = data.archive_file.user_bot_placeholder.output_base64sha256 |
| 112 | + |
| 113 | + depends_on = [aws_cloudwatch_log_group.user_bot] |
| 114 | + |
| 115 | + lifecycle { |
| 116 | + ignore_changes = [filename, source_code_hash] |
| 117 | + } |
| 118 | +} |
| 119 | + |
| 120 | +// --------------------------------------------------------------------------- |
| 121 | +// Execution role |
| 122 | +// --------------------------------------------------------------------------- |
| 123 | + |
| 124 | +resource "aws_iam_role" "user_bot" { |
| 125 | + name = "user-bot" |
| 126 | + |
| 127 | + assume_role_policy = jsonencode({ |
| 128 | + Version = "2012-10-17" |
| 129 | + Statement = [ |
| 130 | + { |
| 131 | + Effect = "Allow" |
| 132 | + Principal = { Service = "lambda.amazonaws.com" } |
| 133 | + Action = "sts:AssumeRole" |
| 134 | + } |
| 135 | + ] |
| 136 | + }) |
| 137 | +} |
| 138 | + |
| 139 | +// The tag condition on UpdateLoginProfile is the important part. Without it this role |
| 140 | +// could reset the console password of any user in the account, including admins and |
| 141 | +// the users tagged managed-by = exempt. The Lambda checks the same tag in code; this |
| 142 | +// makes IAM enforce it even if the code is wrong or the function is invoked with a |
| 143 | +// crafted event. |
| 144 | +resource "aws_iam_role_policy" "user_bot" { |
| 145 | + name = "user-bot" |
| 146 | + role = aws_iam_role.user_bot.id |
| 147 | + |
| 148 | + policy = jsonencode({ |
| 149 | + Version = "2012-10-17" |
| 150 | + Statement = [ |
| 151 | + { |
| 152 | + Sid = "ReadUserTags" |
| 153 | + Effect = "Allow" |
| 154 | + Action = "iam:ListUserTags" |
| 155 | + Resource = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:user/*" |
| 156 | + }, |
| 157 | + { |
| 158 | + Sid = "ResetPasswordOfDevopsSecurityUsersOnly" |
| 159 | + Effect = "Allow" |
| 160 | + Action = "iam:UpdateLoginProfile" |
| 161 | + Resource = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:user/*" |
| 162 | + Condition = { |
| 163 | + StringEquals = { |
| 164 | + "iam:ResourceTag/managed-by" = "terraform-devops-security" |
| 165 | + } |
| 166 | + } |
| 167 | + }, |
| 168 | + { |
| 169 | + Sid = "WriteOwnLogs" |
| 170 | + Effect = "Allow" |
| 171 | + Action = ["logs:CreateLogStream", "logs:PutLogEvents"] |
| 172 | + Resource = "${aws_cloudwatch_log_group.user_bot.arn}:*" |
| 173 | + } |
| 174 | + ] |
| 175 | + }) |
| 176 | +} |
0 commit comments