fix: IAM policy needs bucket ARN not bucket name #58

slapula · 2023-04-25T19:54:59Z

Ticket #9

Description

Correcting a typo with this PR. I accidentally defined the resource by name in this policy instead of the ARN.

Testing

Automated and Unit Tests

Added Unit tests

Manual tests for Reviewer

Added steps to test feature/functionality manually

Checklist

Provided ticket and description
Provided testing information
Provided adequate test coverage for all new code
Added PR reviewers

github-actions · 2023-04-25T19:56:03Z

Terraform Summary

Step	Result
🖌 Terraform Format & Style	✅
⚙️ Terraform Initialization	✅
🤖 Terraform Validation	✅
📖 Terraform Plan	✅

Output

Validation Output

Success! The configuration is valid.

Plan Output

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+   create
  ~ update in-place
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # aws_s3_bucket_policy.ses_source_data_s3_access_policy will be created
+   resource "aws_s3_bucket_policy" "ses_source_data_s3_access_policy" {
+       bucket = "grantsingest-staging-grantssourcedata-357150818708-us-west-2"
+       id     = (known after apply)
+       policy = jsonencode(
            {
+               Statement = [
+                   {
+                       Action    = "s3:PutObject"
+                       Condition = {
+                           StringEquals = {
+                               "AWS:SourceAccount" = "357150818708"
+                               "AWS:SourceArn"     = "arn:aws:ses:us-west-2:357150818708:receipt-rule-set/ffis_ingest-rule-set:receipt-rule/ffis_ingest-staging"
                            }
                        }
+                       Effect    = "Allow"
+                       Principal = {
+                           Service = "ses.amazonaws.com"
                        }
+                       Resource  = "arn:aws:s3:::grantsingest-staging-grantssourcedata-357150818708-us-west-2/ses/*"
+                       Sid       = ""
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
    }

  # aws_ses_receipt_rule.ffis_ingest will be created
+   resource "aws_ses_receipt_rule" "ffis_ingest" {
+       arn           = (known after apply)
+       enabled       = true
+       id            = (known after apply)
+       name          = "grants_ingest-staging-ffis_ingest"
+       recipients    = [
+           "ffis-ingest@staging.grants.usdigitalresponse.org",
        ]
+       rule_set_name = "ffis_ingest-rule-set"
+       scan_enabled  = true
+       tls_policy    = "Require"

+       s3_action {
+           bucket_name       = "grantsingest-staging-grantssourcedata-357150818708-us-west-2"
+           object_key_prefix = "ses/ffis_ingest/new"
+           position          = 1
        }
    }

  # datadog_metric_metadata.custom["grants_ingest.DownloadGrantsGovDB.source_size"] will be updated in-place
  ~ resource "datadog_metric_metadata" "custom" {
        id              = "grants_ingest.DownloadGrantsGovDB.source_size"
-       type            = "gauge" -> null
        # (6 unchanged attributes hidden)
    }

  # datadog_metric_metadata.custom["grants_ingest.SplitGrantsGovXMLDB.opportunity.created"] will be updated in-place
  ~ resource "datadog_metric_metadata" "custom" {
        id              = "grants_ingest.SplitGrantsGovXMLDB.opportunity.created"
-       type            = "gauge" -> null
        # (5 unchanged attributes hidden)
    }

  # datadog_metric_metadata.custom["grants_ingest.SplitGrantsGovXMLDB.opportunity.skipped"] will be updated in-place
  ~ resource "datadog_metric_metadata" "custom" {
        id              = "grants_ingest.SplitGrantsGovXMLDB.opportunity.skipped"
-       type            = "gauge" -> null
        # (5 unchanged attributes hidden)
    }

  # datadog_metric_metadata.custom["grants_ingest.SplitGrantsGovXMLDB.opportunity.updated"] will be updated in-place
  ~ resource "datadog_metric_metadata" "custom" {
        id              = "grants_ingest.SplitGrantsGovXMLDB.opportunity.updated"
-       type            = "gauge" -> null
        # (5 unchanged attributes hidden)
    }

  # module.DownloadGrantsGovDB.module.lambda_function.aws_lambda_function.this[0] will be updated in-place
  ~ resource "aws_lambda_function" "this" {
        id                             = "grants_ingest-staging-DownloadGrantsGovDB"
      ~ last_modified                  = "2023-04-25T19:39:28.000+0000" -> (known after apply)
      ~ qualified_arn                  = "arn:aws:lambda:us-west-2:357150818708:function:grants_ingest-staging-DownloadGrantsGovDB:14" -> (known after apply)
      ~ qualified_invoke_arn           = "arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:357150818708:function:grants_ingest-staging-DownloadGrantsGovDB:14/invocations" -> (known after apply)
      ~ s3_key                         = "builds/2009c8b97123081dad16737488a125535c2958604e0e71bbe17d45b343feb549.zip" -> "builds/4a02f023653c46b1b1d78f71dd7fc907e94a0d35c9862504889dac7111208d81.zip"
      ~ s3_object_version              = "5tpBkVKyCGVQJxzcodZDyMrXE36GVZWU" -> (known after apply)
        tags                           = {}
      ~ version                        = "14" -> (known after apply)
        # (23 unchanged attributes hidden)

      ~ environment {
          ~ variables = {
              ~ "DD_TAGS"                        = "git.commit.sha:505b647f8ec6f72a4e656e9ec6521f3976e20c52,git.repository_url:github.com/usdigitalresponse/grants-ingest,handlername:downloadgrantsgovdb" -> "git.commit.sha:cbd6716146f31efc5b3a461eec4ed361bcdbe136,git.repository_url:github.com/usdigitalresponse/grants-ingest,handlername:downloadgrantsgovdb"
              ~ "DD_VERSION"                     = "505b647f8ec6f72a4e656e9ec6521f3976e20c52" -> "cbd6716146f31efc5b3a461eec4ed361bcdbe136"
                # (12 unchanged elements hidden)
            }
        }

        # (2 unchanged blocks hidden)
    }

  # module.DownloadGrantsGovDB.module.lambda_function.aws_lambda_permission.current_version_triggers["Schedule"] must be replaced
-/+ resource "aws_lambda_permission" "current_version_triggers" {
      ~ id                  = "Schedule" -> (known after apply)
      ~ qualifier           = "14" -> (known after apply) # forces replacement
+       statement_id_prefix = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.DownloadGrantsGovDB.module.lambda_function.aws_s3_object.lambda_package[0] must be replaced
-/+ resource "aws_s3_object" "lambda_package" {
      ~ bucket_key_enabled     = false -> (known after apply)
      ~ content_type           = "binary/octet-stream" -> (known after apply)
      ~ etag                   = "4c1d14a3a9883343c91285797b5bfd5e-2" -> (known after apply)
      ~ id                     = "builds/2009c8b97123081dad16737488a125535c2958604e0e71bbe17d45b343feb549.zip" -> (known after apply)
      ~ key                    = "builds/2009c8b97123081dad16737488a125535c2958604e0e71bbe17d45b343feb549.zip" -> "builds/4a02f023653c46b1b1d78f71dd7fc907e94a0d35c9862504889dac7111208d81.zip" # forces replacement
+       kms_key_id             = (known after apply)
-       metadata               = {} -> null
      ~ source                 = "builds/2009c8b97123081dad16737488a125535c2958604e0e71bbe17d45b343feb549.zip" -> "builds/4a02f023653c46b1b1d78f71dd7fc907e94a0d35c9862504889dac7111208d81.zip"
-       tags                   = {} -> null
      ~ version_id             = "5tpBkVKyCGVQJxzcodZDyMrXE36GVZWU" -> (known after apply)
        # (6 unchanged attributes hidden)
    }

  # module.DownloadGrantsGovDB.module.lambda_function.local_file.archive_plan[0] will be created
+   resource "local_file" "archive_plan" {
+       content              = jsonencode(
            {
+               artifacts_dir = "builds"
+               build_plan    = [
+                   [
+                       "sh",
+                       "..",
+                       <<-EOT
                            task build-DownloadGrantsGovDB
                            cd bin/DownloadGrantsGovDB
                        EOT,
                    ],
+                   [
+                       "zip:embedded",
+                       "..",
+                       null,
                    ],
                ]
+               filename      = "builds/4a02f023653c46b1b1d78f71dd7fc907e94a0d35c9862504889dac7111208d81.zip"
+               runtime       = "provided.al2"
            }
        )
+       content_base64sha256 = (known after apply)
+       content_base64sha512 = (known after apply)
+       content_md5          = (known after apply)
+       content_sha1         = (known after apply)
+       content_sha256       = (known after apply)
+       content_sha512       = (known after apply)
+       directory_permission = "0755"
+       file_permission      = "0644"
+       filename             = "builds/4a02f023653c46b1b1d78f71dd7fc907e94a0d35c9862504889dac7111208d81.plan.json"
+       id                   = (known after apply)
    }

  # module.DownloadGrantsGovDB.module.lambda_function.null_resource.archive[0] must be replaced
-/+ resource "null_resource" "archive" {
      ~ id       = "1385093556973411059" -> (known after apply)
      ~ triggers = { # forces replacement
          ~ "filename"  = "builds/2009c8b97123081dad16737488a125535c2958604e0e71bbe17d45b343feb549.zip" -> "builds/4a02f023653c46b1b1d78f71dd7fc907e94a0d35c9862504889dac7111208d81.zip"
          ~ "timestamp" = "1682451434648312000" -> "1682452547679802800"
        }
    }

  # module.DownloadGrantsGovDB.module.lambda_function.null_resource.sam_metadata_aws_lambda_function[0] must be replaced
-/+ resource "null_resource" "sam_metadata_aws_lambda_function" {
      ~ id       = "5507289458736627281" -> (known after apply)
      ~ triggers = { # forces replacement
          ~ "built_output_path"    = "builds/2009c8b97123081dad16737488a125535c2958604e0e71bbe17d45b343feb549.zip" -> "builds/4a02f023653c46b1b1d78f71dd7fc907e94a0d35c9862504889dac7111208d81.zip"
            # (4 unchanged elements hidden)
        }
    }

  # module.SplitGrantsGovXMLDB.module.lambda_function.aws_lambda_function.this[0] will be updated in-place
  ~ resource "aws_lambda_function" "this" {
        id                             = "grants_ingest-staging-SplitGrantsGovXMLDB"
      ~ last_modified                  = "2023-04-25T19:39:28.000+0000" -> (known after apply)
      ~ qualified_arn                  = "arn:aws:lambda:us-west-2:357150818708:function:grants_ingest-staging-SplitGrantsGovXMLDB:13" -> (known after apply)
      ~ qualified_invoke_arn           = "arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:357150818708:function:grants_ingest-staging-SplitGrantsGovXMLDB:13/invocations" -> (known after apply)
      ~ s3_key                         = "builds/7c147de5e7706e72c8b9aa89240524bbd14a10af456d6898b8414131d9b4d1f3.zip" -> "builds/eaf5a95b7999587bcc7fc31938a42646cd696b48f077e6469d08851cf0bc99ea.zip"
      ~ s3_object_version              = "l42uAeOPv5dWTbAJ8xrBCM8Sqmym9P.x" -> (known after apply)
        tags                           = {}
      ~ version                        = "13" -> (known after apply)
        # (23 unchanged attributes hidden)

      ~ environment {
          ~ variables = {
              ~ "DD_TAGS"                          = "git.commit.sha:505b647f8ec6f72a4e656e9ec6521f3976e20c52,git.repository_url:github.com/usdigitalresponse/grants-ingest,handlername:splitgrantsgovxmldb" -> "git.commit.sha:cbd6716146f31efc5b3a461eec4ed361bcdbe136,git.repository_url:github.com/usdigitalresponse/grants-ingest,handlername:splitgrantsgovxmldb"
              ~ "DD_VERSION"                       = "505b647f8ec6f72a4e656e9ec6521f3976e20c52" -> "cbd6716146f31efc5b3a461eec4ed361bcdbe136"
                # (15 unchanged elements hidden)
            }
        }

        # (2 unchanged blocks hidden)
    }

  # module.SplitGrantsGovXMLDB.module.lambda_function.aws_lambda_permission.current_version_triggers["S3BucketNotification"] must be replaced
-/+ resource "aws_lambda_permission" "current_version_triggers" {
      ~ id                  = "S3BucketNotification" -> (known after apply)
      ~ qualifier           = "13" -> (known after apply) # forces replacement
+       statement_id_prefix = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.SplitGrantsGovXMLDB.module.lambda_function.aws_s3_object.lambda_package[0] must be replaced
-/+ resource "aws_s3_object" "lambda_package" {
      ~ bucket_key_enabled     = false -> (known after apply)
      ~ content_type           = "binary/octet-stream" -> (known after apply)
      ~ etag                   = "13284ff949bf5cf5d867baed7e0b8821-2" -> (known after apply)
      ~ id                     = "builds/7c147de5e7706e72c8b9aa89240524bbd14a10af456d6898b8414131d9b4d1f3.zip" -> (known after apply)
      ~ key                    = "builds/7c147de5e7706e72c8b9aa89240524bbd14a10af456d6898b8414131d9b4d1f3.zip" -> "builds/eaf5a95b7999587bcc7fc31938a42646cd696b48f077e6469d08851cf0bc99ea.zip" # forces replacement
+       kms_key_id             = (known after apply)
-       metadata               = {} -> null
      ~ source                 = "builds/7c147de5e7706e72c8b9aa89240524bbd14a10af456d6898b8414131d9b4d1f3.zip" -> "builds/eaf5a95b7999587bcc7fc31938a42646cd696b48f077e6469d08851cf0bc99ea.zip"
-       tags                   = {} -> null
      ~ version_id             = "l42uAeOPv5dWTbAJ8xrBCM8Sqmym9P.x" -> (known after apply)
        # (6 unchanged attributes hidden)
    }

  # module.SplitGrantsGovXMLDB.module.lambda_function.local_file.archive_plan[0] will be created
+   resource "local_file" "archive_plan" {
+       content              = jsonencode(
            {
+               artifacts_dir = "builds"
+               build_plan    = [
+                   [
+                       "sh",
+                       "..",
+                       <<-EOT
                            task build-SplitGrantsGovXMLDB
                            cd bin/SplitGrantsGovXMLDB
                        EOT,
                    ],
+                   [
+                       "zip:embedded",
+                       "..",
+                       null,
                    ],
                ]
+               filename      = "builds/eaf5a95b7999587bcc7fc31938a42646cd696b48f077e6469d08851cf0bc99ea.zip"
+               runtime       = "provided.al2"
            }
        )
+       content_base64sha256 = (known after apply)
+       content_base64sha512 = (known after apply)
+       content_md5          = (known after apply)
+       content_sha1         = (known after apply)
+       content_sha256       = (known after apply)
+       content_sha512       = (known after apply)
+       directory_permission = "0755"
+       file_permission      = "0644"
+       filename             = "builds/eaf5a95b7999587bcc7fc31938a42646cd696b48f077e6469d08851cf0bc99ea.plan.json"
+       id                   = (known after apply)
    }

  # module.SplitGrantsGovXMLDB.module.lambda_function.null_resource.archive[0] must be replaced
-/+ resource "null_resource" "archive" {
      ~ id       = "126780147730697592" -> (known after apply)
      ~ triggers = { # forces replacement
          ~ "filename"  = "builds/7c147de5e7706e72c8b9aa89240524bbd14a10af456d6898b8414131d9b4d1f3.zip" -> "builds/eaf5a95b7999587bcc7fc31938a42646cd696b48f077e6469d08851cf0bc99ea.zip"
          ~ "timestamp" = "1682451434675659000" -> "1682452547804728000"
        }
    }

  # module.SplitGrantsGovXMLDB.module.lambda_function.null_resource.sam_metadata_aws_lambda_function[0] must be replaced
-/+ resource "null_resource" "sam_metadata_aws_lambda_function" {
      ~ id       = "1167732162775445540" -> (known after apply)
      ~ triggers = { # forces replacement
          ~ "built_output_path"    = "builds/7c147de5e7706e72c8b9aa89240524bbd14a10af456d6898b8414131d9b4d1f3.zip" -> "builds/eaf5a95b7999587bcc7fc31938a42646cd696b48f077e6469d08851cf0bc99ea.zip"
            # (4 unchanged elements hidden)
        }
    }

Plan: 12 to add, 6 to change, 8 to destroy.

Pusher: @slapula, Action: pull_request, Workflow: Continuous Integration

fix: IAM policy needs bucket ARN not bucket name

d8b6a1d

slapula self-assigned this Apr 25, 2023

TylerHendrickson approved these changes Apr 25, 2023

View reviewed changes

slapula merged commit d298b9b into main Apr 25, 2023

slapula deleted the 9-bucket-arn-not-id branch April 25, 2023 20:11

TylerHendrickson added bug Something isn't working terraform Pull requests that update Terraform code labels Aug 24, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: IAM policy needs bucket ARN not bucket name #58

fix: IAM policy needs bucket ARN not bucket name #58

slapula commented Apr 25, 2023

github-actions bot commented Apr 25, 2023

fix: IAM policy needs bucket ARN not bucket name #58

fix: IAM policy needs bucket ARN not bucket name #58

Conversation

slapula commented Apr 25, 2023

Ticket #9

Description

Testing

Automated and Unit Tests

Manual tests for Reviewer

Checklist

github-actions bot commented Apr 25, 2023

Terraform Summary

Output