Add support for IAM Server Certificates

tremble · Sep 23, 2021 · 8be2d25 · 8be2d25
1 parent e6e4863
commit 8be2d25
Show file tree

Hide file tree

Showing 2 changed files with 36 additions and 4 deletions.
diff --git a/aws/policy/security-services.yaml b/aws/policy/security-services.yaml
@@ -100,23 +100,26 @@ Statement:
   - Sid: AllowGlobalRestrictedResourceActionsWhichIncurFees
     Effect: Allow
     Action:
+      - iam:DeleteServerCertificate
+      - iam:UploadServerCertificate
       - secretsmanager:CreateSecret
-      - secretsmanager:UpdateSecret
       - secretsmanager:DeleteSecret
       - secretsmanager:GetSecretValue
       - secretsmanager:RotateSecret
-      - secretsmanager:UntagResource
       - secretsmanager:TagResource
+      - secretsmanager:UntagResource
+      - secretsmanager:UpdateSecret
     Resource:
+      - 'arn:aws:iam::{{ aws_account_id }}:server-certificate/*'
       - 'arn:aws:secretsmanager:{{ aws_region }}:{{ aws_account_id }}:secret:ansible-test*'
 
   - Sid: AllowResourceRestrictedActionsWhichIncurNoFees
     Effect: Allow
     Action:
-      - acm:DescribeCertificate
-      - acm:GetCertificate
       - acm:AddTagsToCertificate
       - acm:DeleteCertificate
+      - acm:DescribeCertificate
+      - acm:GetCertificate
       - iam:AddRoleToInstanceProfile
       - iam:CreateInstanceProfile
       - iam:CreateRole
@@ -126,15 +129,19 @@ Statement:
       - iam:DeleteSAMLProvider
       - iam:GetInstanceProfile
       - iam:GetSAMLProvider
+      - iam:GetServerCertificate
       - iam:ListInstanceProfilesForRole
+      - iam:ListServerCertificates
       - iam:PassRole
       - iam:RemoveRoleFromInstanceProfile
       - iam:UpdateSAMLProvider
+      - iam:UpdateServerCertificate
       - sts:AssumeRole
     Resource:
       - 'arn:aws:acm:{{ aws_region }}:{{ aws_account_id }}:certificate/*'
       - 'arn:aws:iam::{{ aws_account_id }}:instance-profile/ansible-test-*'
       - 'arn:aws:iam::{{ aws_account_id }}:saml-provider/ansible-test-*'
+      - 'arn:aws:iam::{{ aws_account_id }}:server-certificate/*'
       - 'arn:aws:iam::{{ aws_account_id }}:role/ansible-test-*'
       # This is hard coded into DMS...
       - 'arn:aws:iam::{{ aws_account_id }}:role/dms-vpc-role'

diff --git a/aws/terminator/security_services.py b/aws/terminator/security_services.py
@@ -69,6 +69,31 @@ def terminate(self):
         self.client.delete_instance_profile(InstanceProfileName=self.name)
 
 
+class IamServerCertificate(Terminator):
+    @staticmethod
+    def create(credentials):
+        return Terminator._create(credentials, IamServerCertificate, 'iam', lambda client: client.list_server_certificates()['ServerCertificateMetadataList'])
+
+    @property
+    def id(self):
+        return self.instance['ServerCertificateId']
+
+    @property
+    def name(self):
+        return self.instance['ServerCertificateName']
+
+    @property
+    def ignore(self):
+        return not self.name.startswith('ansible-test-')
+
+    @property
+    def created_time(self):
+        return self.instance['UploadDate']
+
+    def terminate(self):
+        self.client.delete_server_certificate(ServerCertificateName=self.name)
+
+
 class ACMCertificate(DbTerminator):
     # ACM provides a created time, but there are cases where describe_certificate can fail
     # We need to be able to delete anyway, so use DbTerminator