From 27f7dee81f0a214e8c2f67cc3d19c7e3a95ba66d Mon Sep 17 00:00:00 2001 From: Matej Stajduhar Date: Thu, 5 Jun 2025 15:14:10 +0200 Subject: [PATCH 1/7] Updating-aws_admin_tools-role-with-new-option-and-setting-up-general-s3-bucket-name-16 --- .../aws_admin_tools/tasks/create_methods.yml | 35 +++---------------- roles/aws/aws_admin_tools/tasks/main.yml | 16 +++++++++ .../templates/trust_apigateway.j2 | 12 +++++++ .../{trusted_entitites.j2 => trust_lambda.j2} | 0 4 files changed, 33 insertions(+), 30 deletions(-) create mode 100644 roles/aws/aws_admin_tools/templates/trust_apigateway.j2 rename roles/aws/aws_admin_tools/templates/{trusted_entitites.j2 => trust_lambda.j2} (100%) diff --git a/roles/aws/aws_admin_tools/tasks/create_methods.yml b/roles/aws/aws_admin_tools/tasks/create_methods.yml index b8a1afb92..1210bd6e4 100644 --- a/roles/aws/aws_admin_tools/tasks/create_methods.yml +++ b/roles/aws/aws_admin_tools/tasks/create_methods.yml @@ -28,7 +28,7 @@ dest: request_template when: item.url_params is defined and item.url_params | length > 0 -- name: Put method on API gateway with URL params for Lambda. +- name: Put method on API gateway with URL params. ansible.builtin.command: >- aws apigateway put-method --rest-api-id "{{ _api_gate.id }}" @@ -38,20 +38,7 @@ --request-parameters file://request_template --no-api-key-required --region "{{ _aws_region }}" - when: item.url_params is defined and item.url_params | length > 0 and item.resource != "s3" - -- name: Put method on API gateway with URL params for S3. - ansible.builtin.command: >- - aws apigateway put-method - --rest-api-id "{{ _api_gate.id }}" - --resource-id "{{ _api_resource.id }}" - --http-method "{{ item.type }}" - --authorization-type "NONE" - --request-parameters file://request_template - --no-api-key-required - --region "{{ _aws_region }}" - --credentials "arn:aws:iam::{{ _acc_id }}:role/{{ item.name }}" - when: item.url_params is defined and item.url_params | length > 0 and item.resource == "s3" + when: item.url_params is defined and item.url_params | length > 0 - name: Build arn for S3 bucket. ansible.builtin.set_fact: @@ -106,21 +93,8 @@ --integration-http-method POST --uri "{{ _target_arn }}" --region {{ _aws_region }} - when: item.url_params is not defined or item.url_params | length == 0 and item.resource != "s3" - -- name: Add S3 bucket for method without URL params. - ansible.builtin.command: >- - aws apigateway put-integration - --rest-api-id "{{ _api_gate.id }}" - --resource-id "{{ _api_resource.id }}" - --http-method "{{ item.type }}" - --type AWS - --content-handling CONVERT_TO_TEXT - --integration-http-method POST - --uri "{{ _target_arn }}" - --region {{ _aws_region }} - --credentials "arn:aws:iam::{{ _acc_id }}:role/{{ item.name }}" - when: item.url_params is not defined or item.url_params | length == 0 and item.resource == "s3" + {{ '--credentials "arn:aws:iam::' + _acc_id + ':role/' + item.name + '"' if item.resource == 's3' else '' }} + when: item.url_params is not defined or item.url_params | length == 0 - name: Generate template parts for each param set_fact: @@ -151,6 +125,7 @@ --request-template file://integration_template --uri "{{ _target_arn }}" --region {{ _aws_region }} + {{ '--credentials "arn:aws:iam::' + _acc_id + ':role/' + item.name + '"' if item.resource == 's3' else '' }} when: item.url_params is defined and item.url_params | length > 0 - name: Add method response. diff --git a/roles/aws/aws_admin_tools/tasks/main.yml b/roles/aws/aws_admin_tools/tasks/main.yml index c77610d51..264499aac 100644 --- a/roles/aws/aws_admin_tools/tasks/main.yml +++ b/roles/aws/aws_admin_tools/tasks/main.yml @@ -76,6 +76,22 @@ ansible.builtin.set_fact: _api_without_s3: "{{ aws_admin_tools.functions | rejectattr('resource', 'eq', 's3') | list }}" +- name: Set CloudWatch logs full access for apigateway. + ansible.builtin.set_fact: + _policies: "{{ ['arn:aws:iam::aws:policy/CloudWatchLogsFullAccess'] }}" + +- name: Create a policy for API Gateway to assume role. + ansible.builtin.include_role: + name: aws/aws_iam_role + vars: + aws_iam_role: + name: "api_get_s3" + aws_profile: "{{ _aws_profile }}" + managed_policies: "{{ _policies }}" + inline_policies: + - "s3:GetObject" + policy_document: "{{ lookup('template', 'trust_apigateway.j2') }}" + - name: Configure Lambda IAM policies. ansible.builtin.include_tasks: lambda_iam.yml loop: "{{ _api_without_s3 }}" diff --git a/roles/aws/aws_admin_tools/templates/trust_apigateway.j2 b/roles/aws/aws_admin_tools/templates/trust_apigateway.j2 new file mode 100644 index 000000000..921b293c4 --- /dev/null +++ b/roles/aws/aws_admin_tools/templates/trust_apigateway.j2 @@ -0,0 +1,12 @@ +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": { + "Service": "apigateway.amazonaws.com" + }, + "Action": "sts:AssumeRole" + } + ] +} diff --git a/roles/aws/aws_admin_tools/templates/trusted_entitites.j2 b/roles/aws/aws_admin_tools/templates/trust_lambda.j2 similarity index 100% rename from roles/aws/aws_admin_tools/templates/trusted_entitites.j2 rename to roles/aws/aws_admin_tools/templates/trust_lambda.j2 From aabe4386eb71e76fdfa55ab95863dc6cdcd534bc Mon Sep 17 00:00:00 2001 From: Matej Stajduhar Date: Thu, 5 Jun 2025 15:19:13 +0200 Subject: [PATCH 2/7] Updating-aws_admin_tools-role-with-new-option-and-setting-up-general-s3-bucket-name-17 --- roles/aws/aws_admin_tools/tasks/create_methods.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/roles/aws/aws_admin_tools/tasks/create_methods.yml b/roles/aws/aws_admin_tools/tasks/create_methods.yml index 1210bd6e4..1232f9e27 100644 --- a/roles/aws/aws_admin_tools/tasks/create_methods.yml +++ b/roles/aws/aws_admin_tools/tasks/create_methods.yml @@ -43,7 +43,6 @@ - name: Build arn for S3 bucket. ansible.builtin.set_fact: _target_arn: "arn:aws:apigateway:{{ _aws_region }}:s3:path/{{ item.bucket }}/{{ item.object }}" - _target_arn: "arn:aws:s3:::codeenigma-dummy-general-storage-eu-west-1/lambda-results/infra-info" when: item.resource == "s3" - name: List Objects in S3 bucket. From 8e6bee944d7057d59d7be35d949512f79fb90a20 Mon Sep 17 00:00:00 2001 From: Matej Stajduhar Date: Thu, 5 Jun 2025 15:23:02 +0200 Subject: [PATCH 3/7] Updating-aws_admin_tools-role-with-new-option-and-setting-up-general-s3-bucket-name-18 --- roles/aws/aws_admin_tools/tasks/create_methods.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/aws/aws_admin_tools/tasks/create_methods.yml b/roles/aws/aws_admin_tools/tasks/create_methods.yml index 1232f9e27..56b55401a 100644 --- a/roles/aws/aws_admin_tools/tasks/create_methods.yml +++ b/roles/aws/aws_admin_tools/tasks/create_methods.yml @@ -46,7 +46,7 @@ when: item.resource == "s3" - name: List Objects in S3 bucket. - amazon.aws.aws_s3: + amazon.aws.s3_object: bucket: "{{ item.bucket }}" mode: list register: _objects_in_s3_bucket From 6f8d3775ade78550a1c29b71d160cf64d9a605ed Mon Sep 17 00:00:00 2001 From: Matej Stajduhar Date: Thu, 5 Jun 2025 15:26:58 +0200 Subject: [PATCH 4/7] Updating-aws_admin_tools-role-with-new-option-and-setting-up-general-s3-bucket-name-19 --- roles/aws/aws_admin_tools/tasks/lambda_iam.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/aws/aws_admin_tools/tasks/lambda_iam.yml b/roles/aws/aws_admin_tools/tasks/lambda_iam.yml index e2e5c960d..93a11c2d3 100644 --- a/roles/aws/aws_admin_tools/tasks/lambda_iam.yml +++ b/roles/aws/aws_admin_tools/tasks/lambda_iam.yml @@ -11,4 +11,4 @@ aws_profile: "{{ _aws_profile }}" managed_policies: "{{ _policies }}" inline_policies: "{{ item.inline_policies | default(omit) }}" - policy_document: "{{ lookup('template', 'trusted_entitites.j2') }}" + policy_document: "{{ lookup('template', 'trust_lambda.j2') }}" From 8e0e40fe781e64cddd8672695e0dfbf546dbc77b Mon Sep 17 00:00:00 2001 From: Matej Stajduhar Date: Thu, 5 Jun 2025 15:44:37 +0200 Subject: [PATCH 5/7] Updating-aws_admin_tools-role-with-new-option-and-setting-up-general-s3-bucket-name-20 --- roles/aws/aws_admin_tools/tasks/create_methods.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/aws/aws_admin_tools/tasks/create_methods.yml b/roles/aws/aws_admin_tools/tasks/create_methods.yml index 56b55401a..40dc4a456 100644 --- a/roles/aws/aws_admin_tools/tasks/create_methods.yml +++ b/roles/aws/aws_admin_tools/tasks/create_methods.yml @@ -92,7 +92,7 @@ --integration-http-method POST --uri "{{ _target_arn }}" --region {{ _aws_region }} - {{ '--credentials "arn:aws:iam::' + _acc_id + ':role/' + item.name + '"' if item.resource == 's3' else '' }} + {{ '--credentials "arn:aws:iam::' + _acc_id + ':role/api_get_s3"' if item.resource == 's3' else '' }} when: item.url_params is not defined or item.url_params | length == 0 - name: Generate template parts for each param @@ -124,7 +124,7 @@ --request-template file://integration_template --uri "{{ _target_arn }}" --region {{ _aws_region }} - {{ '--credentials "arn:aws:iam::' + _acc_id + ':role/' + item.name + '"' if item.resource == 's3' else '' }} + {{ '--credentials "arn:aws:iam::' + _acc_id + ':role/api_get_s3"' if item.resource == 's3' else '' }} when: item.url_params is defined and item.url_params | length > 0 - name: Add method response. From c6718ef69a7e59586cbb03553d57a88e5f20da93 Mon Sep 17 00:00:00 2001 From: Matej Stajduhar Date: Thu, 5 Jun 2025 15:58:04 +0200 Subject: [PATCH 6/7] Updating-aws_admin_tools-role-with-new-option-and-setting-up-general-s3-bucket-name-21 --- roles/aws/aws_admin_tools/tasks/create_methods.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/roles/aws/aws_admin_tools/tasks/create_methods.yml b/roles/aws/aws_admin_tools/tasks/create_methods.yml index 40dc4a456..e06acf07a 100644 --- a/roles/aws/aws_admin_tools/tasks/create_methods.yml +++ b/roles/aws/aws_admin_tools/tasks/create_methods.yml @@ -81,7 +81,7 @@ _target_arn: "arn:aws:apigateway:{{ _aws_region }}:lambda:path/2015-03-31/functions/arn:aws:lambda:{{ _aws_region }}:{{ _acc_id }}:function:api_{{ item.name }}/invocations" when: item.resource == "api" -- name: Add Lambda for method without URL params. +- name: Add Service for method without URL params. ansible.builtin.command: >- aws apigateway put-integration --rest-api-id "{{ _api_gate.id }}" @@ -89,7 +89,7 @@ --http-method "{{ item.type }}" --type AWS --content-handling CONVERT_TO_TEXT - --integration-http-method POST + --integration-http-method {{ 'GET' if item.resource == 's3' else 'POST' }} --uri "{{ _target_arn }}" --region {{ _aws_region }} {{ '--credentials "arn:aws:iam::' + _acc_id + ':role/api_get_s3"' if item.resource == 's3' else '' }} @@ -111,7 +111,7 @@ dest: integration_template when: item.url_params is defined and item.url_params | length > 0 -- name: Add Lambda for method with URL params. +- name: Add Service for method with URL params. ansible.builtin.command: >- aws apigateway put-integration --rest-api-id "{{ _api_gate.id }}" @@ -119,7 +119,7 @@ --http-method "{{ item.type }}" --type AWS --content-handling CONVERT_TO_TEXT - --integration-http-method POST + --integration-http-method {{ 'GET' if item.resource == 's3' else 'POST' }} --passthrough-behavior WHEN_NO_TEMPLATES --request-template file://integration_template --uri "{{ _target_arn }}" From f9b86769652710a5a9dd4422fc50e2493344b202 Mon Sep 17 00:00:00 2001 From: Matej Stajduhar Date: Fri, 6 Jun 2025 09:41:38 +0200 Subject: [PATCH 7/7] Updating-defaults-adding-comments --- roles/aws/aws_admin_tools/defaults/main.yml | 48 +++++++++------------ 1 file changed, 20 insertions(+), 28 deletions(-) diff --git a/roles/aws/aws_admin_tools/defaults/main.yml b/roles/aws/aws_admin_tools/defaults/main.yml index 9c08edab3..64287c822 100644 --- a/roles/aws/aws_admin_tools/defaults/main.yml +++ b/roles/aws/aws_admin_tools/defaults/main.yml @@ -1,32 +1,24 @@ +aws_admin_tools_enable: true aws_admin_tools: - runtime: "python3.12" - timeout: 20 + runtime: "python3.12" # Version of pythn for functions + timeout: 20 # Global timeout for all functions allowed_ips: - 192.168.1.1/32 # Ip of server with access to API-s functions: - - name: "get_forecasted_costs" - resource: api # can be "api" or "schedule" - type: GET - inline_policies: # Define inline policies which will be in use for executing Lambda function - name: "{{ _aws_profile }}Billing" - resource: "*" - action: - - "ce:*" - policies: [] - - name: "change_asg_scaling" - resource: api - type: POST - policies: [] - inline_policies: - name: "change_asg_scaling" - resource: "*" - action: + - name: "change_asg_scaling" # Name used for creating API Gateway and Lambda functions + resource: api # Refers to type of resource for needed function (can be api, schedule and s3) + type: POST # Type of HTTP method, can be GET and POST + policies: [] # List of policies to use for lambda function + inline_policies: # Inline policies to allow defining least privilages access + name: "change_asg_scaling" # Name of inline policies + resource: "*" # Resources that are allowed for access + action: # List of policies to attach - "autoscaling:DescribePolicies" - "autoscaling:PutScalingPolicy" - name: "get_ip_set" resource: api type: GET - url_params: + url_params: # URL parameters are used for some functions and they allow u to provide more details to the function - set_name - id policies: [] @@ -35,20 +27,20 @@ aws_admin_tools: resource: "*" action: - "wafv2:GetIPSet" - - name: "test" - resource: schedule - cron: "cron(0 0 ? * MON *)" # If schedule is defined, we need the cron - timeout: 300 # Timeout can be set per function, or use global if missing + - name: "get_infra_data_from_s3" + resource: schedule # If resource is set to schedule it will require cron variable + cron: "cron(0 0 ? * MON *)" # Cron for running scheduled tasks + timeout: 300 # Override timeout if task takes more than the timeout defined globally policies: [] inline_policies: name: "test" resource: "*" action: - "wafv2:GetWebACL" - - name: "get_infra_data_from_s3" # This is the bit that sets up the API Gateway to pull and share infra data over API. No Lambda function needed here though. How do we do this? See docs - resource: s3 + - name: "get_infra_data_from_s3" + resource: s3 # s3 resource is to set bucket as the target for API Gateway type: GET - bucket: "codeenigma-{{ _aws_profile }}-general-storage-{{ _aws_region }}" - object: "lambda-results/infra-info" + bucket: "codeenigma-{{ _aws_profile }}-general-storage-{{ _aws_region }}" # Name of the bucket from where it's pulling the data + object: "lambda-results/infra-info" # Object which is targeted by API Gateway url_params: - date