Skip to content

Commit c18c65e

Browse files
chore(CFN): Changes for MPL TestVectors (#653)
1 parent 0f93205 commit c18c65e

File tree

1 file changed

+55
-2
lines changed

1 file changed

+55
-2
lines changed

cfn/ESDK-Python.yml

+55-2
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,10 @@ Resources:
170170
AssumeRolePolicyDocument: "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"codebuild.amazonaws.com\"},\"Action\":\"sts:AssumeRole\"}]}"
171171
MaxSessionDuration: 3600
172172
ManagedPolicyArns:
173+
# Ideally we would add GeneratedVectorsArtifactsS3BucketPolicy to run test vectors.
174+
# However, this role would then have 11 managed policies.
175+
# IAM has a limit of 10 managed policies per role.
176+
# If we need to add more policies here, we should increase this limit.
173177
- !Ref CryptoToolsKMS
174178
- !Ref CodeBuildBatchPolicy
175179
- !Ref CodeBuildBasePolicy
@@ -187,7 +191,9 @@ Resources:
187191
- !Ref CryptoToolsKMS
188192
- !Ref CodeBuildCIBatchPolicy
189193
- !Ref CodeBuildBasePolicy
194+
- !Ref SecretsManagerCIPolicy
190195
- !Ref CodeBuildCISTSAllow
196+
- !Ref GeneratedVectorsArtifactsS3BucketPolicy
191197

192198
CodeBuildBatchPolicy:
193199
Type: "AWS::IAM::ManagedPolicy"
@@ -231,7 +237,8 @@ Resources:
231237
"Action": [
232238
"codebuild:StartBuild",
233239
"codebuild:StopBuild",
234-
"codebuild:RetryBuild"
240+
"codebuild:RetryBuild",
241+
"codebuild:BatchGetBuilds"
235242
]
236243
}
237244
]
@@ -259,7 +266,8 @@ Resources:
259266
"Action": [
260267
"logs:CreateLogGroup",
261268
"logs:CreateLogStream",
262-
"logs:PutLogEvents"
269+
"logs:PutLogEvents",
270+
"logs:GetLogEvents"
263271
]
264272
},
265273
{
@@ -310,6 +318,26 @@ Resources:
310318
}
311319
]
312320
}
321+
322+
SecretsManagerCIPolicy:
323+
Type: "AWS::IAM::ManagedPolicy"
324+
Properties:
325+
ManagedPolicyName: !Sub "CryptoTools-SecretsManagerCI-${ProjectName}-release"
326+
Path: "/service-role/"
327+
# Policy: Allow access to a Github fine-grained PAT that can read ESDK-Dafny "Daily CI" artifacts
328+
PolicyDocument: !Sub |
329+
{
330+
"Version": "2012-10-17",
331+
"Statement": [
332+
{
333+
"Effect": "Allow",
334+
"Resource": [
335+
"arn:aws:secretsmanager:us-west-2:587316601012:secret:Github/lucasmcdonald3-fgpat-1aAsdO"
336+
],
337+
"Action": "secretsmanager:GetSecretValue"
338+
}
339+
]
340+
}
313341
314342
# There exist public AWS KMS CMKs that are used for testing
315343
# Take care with these CMKs they are **ONLY** for testing!!!
@@ -358,3 +386,28 @@ Resources:
358386
}
359387
]
360388
}
389+
390+
GeneratedVectorsArtifactsS3Bucket:
391+
Type: 'AWS::S3::Bucket'
392+
Properties:
393+
BucketName: generated-vectors-artifacts-bucket
394+
LifecycleConfiguration:
395+
Rules:
396+
- Id: Expire artifacts in 14 days
397+
Status: Enabled
398+
ExpirationInDays: 14
399+
400+
GeneratedVectorsArtifactsS3BucketPolicy:
401+
Type: 'AWS::IAM::ManagedPolicy'
402+
Properties:
403+
ManagedPolicyName: Generated-Vectors-Artifacts-S3-Bucket-Policy
404+
PolicyDocument:
405+
Version: 2012-10-17
406+
Statement:
407+
- Effect: Allow
408+
Action:
409+
- 's3:PutObject'
410+
- 's3:GetObject'
411+
- 's3:DeleteObject'
412+
Resource:
413+
- !Join [ "", [ !GetAtt GeneratedVectorsArtifactsS3Bucket.Arn, '/*'] ]

0 commit comments

Comments
 (0)