Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add ecs to allowed services for oidc-cicd role #8443

Merged
merged 2 commits into from
Nov 7, 2024

Conversation

dms1981
Copy link
Contributor

@dms1981 dms1981 commented Nov 7, 2024

A reference to the issue / Description of it

Had the following through via Slack from @roncitrus :

Error: Failed to register task definition in ECS: User: arn:aws:sts::111111111111:assumed-role/modernisation-platform-oidc-cicd/GitHubActions is not authorized to perform: iam:PassRole on resource: arn:aws:iam::111111111111:role/task-cdpt-chaps because no identity-based policy allows the iam:PassRole action
Error: User: arn:aws:sts::111111111111:assumed-role/modernisation-platform-oidc-cicd/GitHubActions is not authorized to perform: iam:PassRole on resource: arn:aws:iam::111111111111:role/task-cdpt-chaps because no identity-based policy allows the iam:PassRole action

How does this PR fix the problem?

Adds ecs to allowed services for passrole permission.

How has this been tested?

Tested through CI pipeline tests

Deployment Plan / Instructions

Deploy through CI

Checklist (check x in [ ] of list items)

  • I have performed a self-review of my own code
  • All checks have passed
  • I have made corresponding changes to the documentation
  • Plan and discussed how it should be deployed to PROD (If needed)

Additional comments (if any)

{Please write here}

@dms1981 dms1981 requested a review from a team as a code owner November 7, 2024 15:13
Copy link
Contributor

github-actions bot commented Nov 7, 2024

Trivy Scan Success

Show Output ```hcl

Trivy will check the following folders:
terraform/environments/bootstrap/member-bootstrap


Running Trivy in terraform/environments/bootstrap/member-bootstrap
2024-11-07T15:15:47Z INFO [vulndb] Need to update DB
2024-11-07T15:15:47Z INFO [vulndb] Downloading vulnerability DB...
2024-11-07T15:15:47Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-07T15:15:49Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-07T15:15:49Z INFO [vuln] Vulnerability scanning is enabled
2024-11-07T15:15:49Z INFO [misconfig] Misconfiguration scanning is enabled
2024-11-07T15:15:49Z INFO [misconfig] Need to update the built-in checks
2024-11-07T15:15:49Z INFO [misconfig] Downloading the built-in checks...
160.60 KiB / 160.60 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-11-07T15:15:49Z INFO [secret] Secret scanning is enabled
2024-11-07T15:15:49Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-07T15:15:49Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2024-11-07T15:15:50Z INFO [terraform scanner] Scanning root module file_path="."
2024-11-07T15:15:51Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T15:15:51Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T15:15:51Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T15:15:51Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T15:15:51Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T15:15:51Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T15:15:51Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-roles: no such file or directory"
2024-11-07T15:15:51Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T15:15:51Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T15:15:51Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T15:15:55Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.pagerduty_core_alerts[0].data.aws_sns_topic.alarm_topics" value="cty.NilVal"
2024-11-07T15:15:55Z INFO Number of language-specific files num=0
2024-11-07T15:15:55Z INFO Detected config files num=3
trivy_exitcode=0

</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/bootstrap/member-bootstrap

*****************************

Running Checkov in terraform/environments/bootstrap/member-bootstrap
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-11-07 15:15:58,244 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-cross-account-access?ref=6819b090bce6d3068d55c7c7b9b3fd18c9dca648:None (for external modules, the --download-external-modules flag is required)
2024-11-07 15:15:58,244 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=0179859e6fafc567843cd55c0b05d325d5012dc4:None (for external modules, the --download-external-modules flag is required)
2024-11-07 15:15:58,244 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-github-oidc-role?ref=62b8a16c73d8e4422cd81923e46948e8f4b5cf48:None (for external modules, the --download-external-modules flag is required)
2024-11-07 15:15:58,244 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-github-oidc-provider?ref=82f546bd5f002674138a2ccdade7d7618c6758b3:None (for external modules, the --download-external-modules flag is required)
2024-11-07 15:15:58,244 [MainThread  ] [WARNI]  Failed to download module github.com/terraform-aws-modules/terraform-aws-iam//modules/iam-assumable-role?ref=de95e21a3bc51cd3a44b3b95a4c2f61000649ebb:None (for external modules, the --download-external-modules flag is required)
2024-11-07 15:15:58,244 [MainThread  ] [WARNI]  Failed to download module github.com/terraform-aws-modules/terraform-aws-iam//modules/iam-assumable-roles?ref=de95e21a3bc51cd3a44b3b95a4c2f61000649ebb:None (for external modules, the --download-external-modules flag is required)
2024-11-07 15:15:58,270 [MainThread  ] [WARNI]  [ArmLocalGraph] created 0 vertices
2024-11-07 15:15:58,271 [MainThread  ] [WARNI]  [ArmLocalGraph] created 0 edges
terraform scan results:

Passed checks: 151, Failed checks: 0, Skipped checks: 52


checkov_exitcode=0

CTFLint Scan Success

Show Output
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/bootstrap/member-bootstrap

*****************************

Running tflint in terraform/environments/bootstrap/member-bootstrap
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

Trivy Scan Success

Show Output
*****************************

Trivy will check the following folders:
terraform/environments/bootstrap/member-bootstrap

*****************************

Running Trivy in terraform/environments/bootstrap/member-bootstrap
2024-11-07T15:15:47Z	INFO	[vulndb] Need to update DB
2024-11-07T15:15:47Z	INFO	[vulndb] Downloading vulnerability DB...
2024-11-07T15:15:47Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-07T15:15:49Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-07T15:15:49Z	INFO	[vuln] Vulnerability scanning is enabled
2024-11-07T15:15:49Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-11-07T15:15:49Z	INFO	[misconfig] Need to update the built-in checks
2024-11-07T15:15:49Z	INFO	[misconfig] Downloading the built-in checks...
160.60 KiB / 160.60 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-11-07T15:15:49Z	INFO	[secret] Secret scanning is enabled
2024-11-07T15:15:49Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-07T15:15:49Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2024-11-07T15:15:50Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-11-07T15:15:51Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T15:15:51Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T15:15:51Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T15:15:51Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T15:15:51Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T15:15:51Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T15:15:51Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-roles: no such file or directory"
2024-11-07T15:15:51Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T15:15:51Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T15:15:51Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T15:15:55Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.pagerduty_core_alerts[0].data.aws_sns_topic.alarm_topics" value="cty.NilVal"
2024-11-07T15:15:55Z	INFO	Number of language-specific files	num=0
2024-11-07T15:15:55Z	INFO	Detected config files	num=3
trivy_exitcode=0

Kudzai-moj
Kudzai-moj previously approved these changes Nov 7, 2024
Copy link
Contributor

@Kudzai-moj Kudzai-moj left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@dms1981 dms1981 added this pull request to the merge queue Nov 7, 2024
github-merge-queue bot pushed a commit that referenced this pull request Nov 7, 2024
…o-ecs

Add ecs to allowed services for oidc-cicd role
@dms1981 dms1981 removed this pull request from the merge queue due to a manual request Nov 7, 2024
Copy link
Contributor

github-actions bot commented Nov 7, 2024

Trivy Scan Success

Show Output ```hcl

Trivy will check the following folders:
terraform/environments/bootstrap/member-bootstrap


Running Trivy in terraform/environments/bootstrap/member-bootstrap
2024-11-07T17:05:33Z INFO [vulndb] Need to update DB
2024-11-07T17:05:33Z INFO [vulndb] Downloading vulnerability DB...
2024-11-07T17:05:33Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-07T17:05:35Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-07T17:05:35Z INFO [vuln] Vulnerability scanning is enabled
2024-11-07T17:05:35Z INFO [misconfig] Misconfiguration scanning is enabled
2024-11-07T17:05:35Z INFO [misconfig] Need to update the built-in checks
2024-11-07T17:05:35Z INFO [misconfig] Downloading the built-in checks...
2024-11-07T17:05:35Z ERROR [misconfig] Falling back to embedded checks err="failed to download built-in policies: download error: OCI repository error: 1 error occurred:\n\t* GET https://ghcr.io/v2/aquasecurity/trivy-checks/manifests/1: TOOMANYREQUESTS: retry-after: 383.943µs, allowed: 44000/minute\n\n"
2024-11-07T17:05:35Z INFO [secret] Secret scanning is enabled
2024-11-07T17:05:35Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-07T17:05:35Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2024-11-07T17:05:36Z INFO [terraform scanner] Scanning root module file_path="."
2024-11-07T17:05:36Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T17:05:36Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T17:05:36Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T17:05:36Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T17:05:36Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T17:05:36Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T17:05:36Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-roles: no such file or directory"
2024-11-07T17:05:37Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T17:05:37Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T17:05:37Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T17:05:38Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.pagerduty_core_alerts[0].data.aws_sns_topic.alarm_topics" value="cty.NilVal"
2024-11-07T17:05:38Z INFO Number of language-specific files num=0
2024-11-07T17:05:38Z INFO Detected config files num=3
trivy_exitcode=0

</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/bootstrap/member-bootstrap

*****************************

Running Checkov in terraform/environments/bootstrap/member-bootstrap
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-11-07 17:05:41,011 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-cross-account-access?ref=6819b090bce6d3068d55c7c7b9b3fd18c9dca648:None (for external modules, the --download-external-modules flag is required)
2024-11-07 17:05:41,012 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=0179859e6fafc567843cd55c0b05d325d5012dc4:None (for external modules, the --download-external-modules flag is required)
2024-11-07 17:05:41,012 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-github-oidc-role?ref=62b8a16c73d8e4422cd81923e46948e8f4b5cf48:None (for external modules, the --download-external-modules flag is required)
2024-11-07 17:05:41,012 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-github-oidc-provider?ref=82f546bd5f002674138a2ccdade7d7618c6758b3:None (for external modules, the --download-external-modules flag is required)
2024-11-07 17:05:41,012 [MainThread  ] [WARNI]  Failed to download module github.com/terraform-aws-modules/terraform-aws-iam//modules/iam-assumable-role?ref=de95e21a3bc51cd3a44b3b95a4c2f61000649ebb:None (for external modules, the --download-external-modules flag is required)
2024-11-07 17:05:41,012 [MainThread  ] [WARNI]  Failed to download module github.com/terraform-aws-modules/terraform-aws-iam//modules/iam-assumable-roles?ref=de95e21a3bc51cd3a44b3b95a4c2f61000649ebb:None (for external modules, the --download-external-modules flag is required)
2024-11-07 17:05:41,027 [MainThread  ] [WARNI]  [ArmLocalGraph] created 0 vertices
2024-11-07 17:05:41,027 [MainThread  ] [WARNI]  [ArmLocalGraph] created 0 edges
terraform scan results:

Passed checks: 151, Failed checks: 0, Skipped checks: 52


checkov_exitcode=0

CTFLint Scan Success

Show Output
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/bootstrap/member-bootstrap

*****************************

Running tflint in terraform/environments/bootstrap/member-bootstrap
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

Trivy Scan Success

Show Output
*****************************

Trivy will check the following folders:
terraform/environments/bootstrap/member-bootstrap

*****************************

Running Trivy in terraform/environments/bootstrap/member-bootstrap
2024-11-07T17:05:33Z	INFO	[vulndb] Need to update DB
2024-11-07T17:05:33Z	INFO	[vulndb] Downloading vulnerability DB...
2024-11-07T17:05:33Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-07T17:05:35Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-07T17:05:35Z	INFO	[vuln] Vulnerability scanning is enabled
2024-11-07T17:05:35Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-11-07T17:05:35Z	INFO	[misconfig] Need to update the built-in checks
2024-11-07T17:05:35Z	INFO	[misconfig] Downloading the built-in checks...
2024-11-07T17:05:35Z	ERROR	[misconfig] Falling back to embedded checks	err="failed to download built-in policies: download error: OCI repository error: 1 error occurred:\n\t* GET https://ghcr.io/v2/aquasecurity/trivy-checks/manifests/1: TOOMANYREQUESTS: retry-after: 383.943µs, allowed: 44000/minute\n\n"
2024-11-07T17:05:35Z	INFO	[secret] Secret scanning is enabled
2024-11-07T17:05:35Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-07T17:05:35Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2024-11-07T17:05:36Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-11-07T17:05:36Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T17:05:36Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T17:05:36Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T17:05:36Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T17:05:36Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T17:05:36Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T17:05:36Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-roles: no such file or directory"
2024-11-07T17:05:37Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T17:05:37Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T17:05:37Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-07T17:05:38Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.pagerduty_core_alerts[0].data.aws_sns_topic.alarm_topics" value="cty.NilVal"
2024-11-07T17:05:38Z	INFO	Number of language-specific files	num=0
2024-11-07T17:05:38Z	INFO	Detected config files	num=3
trivy_exitcode=0

@dms1981 dms1981 added this pull request to the merge queue Nov 7, 2024
@ASTRobinson ASTRobinson removed this pull request from the merge queue due to the queue being cleared Nov 7, 2024
@dms1981 dms1981 merged commit 7521cf5 into main Nov 7, 2024
12 checks passed
@dms1981 dms1981 deleted the fix/allow-oidc-role-to-ecs branch November 7, 2024 17:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants