Feature/infrastructure security

[abi-muller]

review of the infrastructure/terraform code

• removing unused terraform code
• Overly permissive IAM permission (reducing permissions on IAM role)
  • PassRole ((infrastructure/modules/aws-core/iam-resources/iam.tf)
    • this was overly permissive which provides a precursor for potential privilege escalation
    • explicitly stated which resources its allowed access to
• ECR Scanning (infrastructure/blocks/ecr/main.tf) (adding s3 encryption policies)
  - the version of ECR scanning we were using was about to be deprecated so opted for a new version
• IAM inline policies in use (removing iam inline policies in use)
  • inline policies apply only to the resources to which they are attached which is discouraged as does not allow for a central management of permissions
  • moved to being separate managed policy resources that are attached
• added encryption policies to unencrypted s3 buckets (adding s3 encryption policies)

[lcardno10]

This seems more permissive?

[MotwaniM]

question on why we're encrypting buckets the way we are