AWS Examples

# Deploy WAF first (CLOUDFRONT scope requires us-east-1)
module "waf" {
  source = "./waf"
  name   = "my-app"
  providers = { aws.us_east_1 = aws.us_east_1 }
}

# Deploy CloudFront, pass WAF ARN in
module "cloudfront" {
  source          = "./cloudfront"
  name            = "my-app"
  waf_web_acl_arn = module.waf.web_acl_arn
  providers = {
    aws           = aws
    aws.us_east_1 = aws.us_east_1
  }
}

# Run from the FMS administrator (security) account
module "fms" {
  source              = "./firewall-manager"
  security_account_id = "123456789012"
  production_ou_id    = "ou-xxxx-yyyyyyyy"
  remediation_enabled = false  # audit mode first
}

aws iam create-policy \
  --policy-name my-app-s3-read \
  --policy-document file://iam/s3-least-privilege.json

# Trust policy pins to specific namespace + service account
assume_role_policy = jsonencode({
  Statement = [{
    Effect    = "Allow"
    Principal = { Federated = aws_iam_openid_connect_provider.cluster.arn }
    Action    = "sts:AssumeRoleWithWebIdentity"
    Condition = {
      StringEquals = {
        "${local.oidc_issuer}:sub" = "system:serviceaccount:${var.namespace}:${var.service_account}"
      }
    }
  }]
})

# Pod spec — EKS injects the token automatically
spec:
  serviceAccountName: my-app-sa  # Annotated with role ARN

# ✅ Scoped actions and resources
resource "aws_iam_policy" "app" {
  policy = jsonencode({
    Statement = [{
      Effect   = "Allow"
      Action   = ["s3:GetObject", "s3:ListBucket"]
      Resource = [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ]
    }]
  })
}
# ❌ Never: Action = "*" or Resource = "*"

permissions:
  id-token: write
  contents: read

steps:
  - uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: arn:aws:iam::123456789012:role/github-actions-terraform
      aws-region: eu-central-1