From 839ba9f0224275473d84ca294d261ab660fa57f1 Mon Sep 17 00:00:00 2001 From: xnoto Date: Fri, 28 Aug 2026 10:21:41 -0600 Subject: [PATCH] chore(iam): remove chart updater AWS role --- README.md | 2 -- aws-github-oidc.tf | 53 ---------------------------------------------- 2 files changed, 55 deletions(-) diff --git a/README.md b/README.md index 65528d7..b39743f 100644 --- a/README.md +++ b/README.md @@ -27,13 +27,11 @@ No modules. | [aws_iam_access_key.sops_secrets_operator](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_access_key) | resource | | [aws_iam_openid_connect_provider.github_actions](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_openid_connect_provider) | resource | | [aws_iam_role.bedrock_batch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | -| [aws_iam_role.github_actions_chart_updater](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | | [aws_iam_role.github_actions_opentofu_docs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | | [aws_iam_role.github_actions_sops_kms](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | | [aws_iam_role.opencode_mcp](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | | [aws_iam_role_policy.bedrock_batch_invoke](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource | | [aws_iam_role_policy.bedrock_batch_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource | -| [aws_iam_role_policy.github_actions_chart_updater](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource | | [aws_iam_role_policy.github_actions_opentofu_docs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource | | [aws_iam_role_policy.github_actions_sops_kms](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource | | [aws_iam_role_policy.opencode_mcp_secrets](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource | diff --git a/aws-github-oidc.tf b/aws-github-oidc.tf index cbb0cca..84a12f5 100644 --- a/aws-github-oidc.tf +++ b/aws-github-oidc.tf @@ -69,56 +69,3 @@ resource "aws_iam_role_policy" "github_actions_sops_kms" { ] }) } - -# This dedicated role prevents the chart workflow from gaining the broader -# SOPS KMS permissions used by OpenTofu roots. -# The post-publish chart workflow may assume it only from charts/main. -# It can read exactly one GitHub App private key, used only to mint a -# short-lived installation token scoped to kustomize-cluster. -resource "aws_iam_role" "github_actions_chart_updater" { - name = "github-actions-chart-updater" - - assume_role_policy = jsonencode({ - Version = "2012-10-17" - Statement = [ - { - Effect = "Allow" - Principal = { - Federated = aws_iam_openid_connect_provider.github_actions.arn - } - Action = "sts:AssumeRoleWithWebIdentity" - Condition = { - StringEquals = { - "token.actions.githubusercontent.com:aud" = "sts.amazonaws.com" - "token.actions.githubusercontent.com:sub" = "repo:makeitworkcloud/charts:ref:refs/heads/main" - } - } - } - ] - }) - - tags = { - ManagedBy = "Terraform" - Purpose = "chart-gitops-updater" - } -} - -resource "aws_iam_role_policy" "github_actions_chart_updater" { - name = "read-chart-updater-github-app-key" - role = aws_iam_role.github_actions_chart_updater.id - - policy = jsonencode({ - Version = "2012-10-17" - Statement = [ - { - Sid = "ReadChartUpdaterGitHubAppKey" - Effect = "Allow" - Action = [ - "secretsmanager:DescribeSecret", - "secretsmanager:GetSecretValue" - ] - Resource = "arn:aws:secretsmanager:us-west-2:332355796717:secret:xnoto-s-chart-updater-github-app-private-key-qP4Qr3" - } - ] - }) -}