Evert Daniel Romero Garrido
119 lines
4.8 KiB
Terraform
119 lines
4.8 KiB
Terraform
# ===============================================================================================================
|
|
# oidc-bitbucket.tf - Configuración OIDC entre Bitbucket Pipelines y AWS
|
|
# Descripción:
|
|
# Crea el IAM OIDC Provider para Bitbucket y el rol IAM que el pipeline
|
|
# asumirá mediante Web Identity Federation (AssumeRoleWithWebIdentity).
|
|
#
|
|
# IMPORTANTE (Bootstrap):
|
|
# Este archivo debe aplicarse MANUALMENTE la primera vez por un
|
|
# administrador con credenciales AWS válidas. Una vez creados el
|
|
# OIDC provider y el rol, el pipeline puede autenticarse solo.
|
|
# ===============================================================================================================
|
|
|
|
locals {
|
|
bitbucket_workspace = "ccsoft1"
|
|
bitbucket_oidc_url = "https://api.bitbucket.org/2.0/workspaces/${local.bitbucket_workspace}/pipelines-config/identity/oidc"
|
|
|
|
# ------------------------------------------------------------------
|
|
# REPO_UUID de proyectosacc
|
|
# ------------------------------------------------------------------
|
|
# Obtener en Bitbucket: Repository settings > OpenID Connect > Repository UUID
|
|
# Ejemplo real: "{1de489be-ce6a-42a0-a8c8-eadbf1174ac7}"
|
|
#
|
|
# NOTA DE SEGURIDAD:
|
|
# Si aún no conoces el UUID exacto, puedes dejar "*" temporalmente
|
|
# para permitir cualquier repo del workspace. Esto es MENOS SEGURO
|
|
# y solo debe usarse durante las pruebas iniciales. En producción,
|
|
# reemplázalo por el UUID exacto del repo ccsoft1/proyectosacc.
|
|
# ------------------------------------------------------------------
|
|
bitbucket_repo_uuid = "{3ceb5bec-0805-4bfb-b891-aaf5626ad7a5}"
|
|
}
|
|
|
|
# Obtener el thumbprint del certificado TLS del issuer OIDC
|
|
data "tls_certificate" "bitbucket_oidc" {
|
|
url = local.bitbucket_oidc_url
|
|
}
|
|
|
|
# -------------------------------------------------------------------------------
|
|
# OIDC Provider para Bitbucket Pipelines
|
|
# -------------------------------------------------------------------------------
|
|
resource "aws_iam_openid_connect_provider" "bitbucket" {
|
|
url = local.bitbucket_oidc_url
|
|
|
|
# Usamos "sts.amazonaws.com" como audience para simplificar la
|
|
# configuración y evitar depender del Workspace UUID de Bitbucket.
|
|
# Esto requiere configurar "audiences: [sts.amazonaws.com]" en
|
|
# bitbucket-pipelines.yml.
|
|
client_id_list = [
|
|
"sts.amazonaws.com"
|
|
]
|
|
|
|
thumbprint_list = [
|
|
data.tls_certificate.bitbucket_oidc.certificates[0].sha1_fingerprint
|
|
]
|
|
|
|
tags = {
|
|
Name = "bitbucket-pipelines-oidc"
|
|
Project = var.project_name
|
|
ManagedBy = "terraform"
|
|
Environment = var.environment
|
|
}
|
|
}
|
|
|
|
# -------------------------------------------------------------------------------
|
|
# Rol IAM para CI/CD desde Bitbucket Pipelines
|
|
# -------------------------------------------------------------------------------
|
|
resource "aws_iam_role" "bitbucket_ci_cd" {
|
|
name = "BitbucketProyectosaccCICDRole${title(var.environment)}"
|
|
|
|
assume_role_policy = jsonencode({
|
|
Version = "2012-10-17"
|
|
Statement = [
|
|
{
|
|
Effect = "Allow"
|
|
Principal = {
|
|
Federated = aws_iam_openid_connect_provider.bitbucket.arn
|
|
}
|
|
Action = "sts:AssumeRoleWithWebIdentity"
|
|
Condition = {
|
|
StringEquals = {
|
|
"${trimprefix(local.bitbucket_oidc_url, "https://")}:aud" = "sts.amazonaws.com"
|
|
}
|
|
StringLike = {
|
|
"${trimprefix(local.bitbucket_oidc_url, "https://")}:sub" = "${local.bitbucket_repo_uuid}:*"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
})
|
|
|
|
tags = {
|
|
Name = "bitbucket-ci-cd-role-${var.environment}"
|
|
Project = var.project_name
|
|
Environment = var.environment
|
|
ManagedBy = "terraform"
|
|
}
|
|
}
|
|
|
|
# -------------------------------------------------------------------------------
|
|
# Política de permisos: AdministratorAccess (punto de partida)
|
|
# -------------------------------------------------------------------------------
|
|
# TODO: Reemplazar AdministratorAccess por una política custom con
|
|
# mínimo privilegio. Ver docs/iam-policy-ci-cd-proyectosacc.json como
|
|
# base para construir la política restrictiva.
|
|
# -------------------------------------------------------------------------------
|
|
resource "aws_iam_role_policy_attachment" "bitbucket_ci_cd_admin" {
|
|
role = aws_iam_role.bitbucket_ci_cd.name
|
|
policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
|
|
}
|
|
|
|
# -------------------------------------------------------------------------------
|
|
# Política mínima alternativa (descomentar cuando esté lista)
|
|
# -------------------------------------------------------------------------------
|
|
# resource "aws_iam_role_policy" "bitbucket_ci_cd_minimal" {
|
|
# name = "${var.project_name}-bitbucket-ci-cd-minimal-${var.environment}"
|
|
# role = aws_iam_role.bitbucket_ci_cd.id
|
|
#
|
|
# policy = file("${path.module}/../docs/iam-policy-ci-cd-proyectosacc.json")
|
|
# }
|