aws-iam-operator-setup-template.yaml

---
# SPDX-FileCopyrightText: Based on https://github.com/bambooengineering/example-eks-oidc-iam-cloudformation by 2020 Bamboo Loans
# SPDX-License-Identifier: MIT
AWSTemplateFormatVersion: '2010-09-09'
Description: 'Sets up an OIDC provider for your cluster for use with AWS IRSA, and creates roles and policies for the Otterize intents operator and credentials operator'
Metadata:
  Source: https://github.com/otterize/setup/aws-iam-operator-setup-template.yaml

Parameters:
  EKSClusterName:
    Type: String
    Description: EKS cluster name

  OtterizeDeployNamespace:
    Type: String
    Description: The namespace Otterize is deployed in.

Resources:
  IntentsOperatorServiceAccountRole:
    Type: AWS::IAM::Role
    Properties:
      # We have to drop into a JSON string here as we want to apply a Condition to restrict the role
      # to pods in the namespace "test-namespace" and with the service account name "test-service-account".
      # There is no other way to template a StringEquals key in CloudFormation YAML.
      AssumeRolePolicyDocument: !Sub |
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Federated": "arn:aws:iam::${AWS::AccountId}:oidc-provider/${ClusterOIDCURL}"
              },
              "Action": "sts:AssumeRoleWithWebIdentity",
              "Condition": {
                "StringEquals": {
                  "${ClusterOIDCURL}:sub": "system:serviceaccount:${OtterizeDeployNamespace}:intents-operator-controller-manager"
                }
              }
            }
          ]
        }
      Path: "/"
      RoleName: !Sub "${EKSClusterName}-otterize-intents-operator"
      Tags:
        - Key: "otterize/system"
          Value: "true"
        - Key: "otterize/clusterName"
          Value: !Sub "${EKSClusterName}"

  CredentialsOperatorServiceAccountRole:
    Type: AWS::IAM::Role
    Properties:
      # We have to drop into a JSON string here as we want to apply a Condition to restrict the role
      # to pods in the namespace "test-namespace" and with the service account name "test-service-account".
      # There is no other way to template a StringEquals key in CloudFormation YAML.
      AssumeRolePolicyDocument: !Sub |
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Federated": "arn:aws:iam::${AWS::AccountId}:oidc-provider/${ClusterOIDCURL}"
              },
              "Action": "sts:AssumeRoleWithWebIdentity",
              "Condition": {
                "StringEquals": {
                  "${ClusterOIDCURL}:sub": "system:serviceaccount:${OtterizeDeployNamespace}:credentials-operator-controller-manager"
                }
              }
            }
          ]
        }
      Path: "/"
      RoleName: !Sub "${EKSClusterName}-otterize-credentials-operator"
      Tags:
        - Key: "otterize/system"
          Value: "true"
        - Key: "otterize/clusterName"
          Value: !Sub "${EKSClusterName}"

  IntentsOperatorPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub "${EKSClusterName}-intents-operator-access-policy"
      Roles:
        - !Ref IntentsOperatorServiceAccountRole
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action:
              - "iam:GetPolicy"
              - "iam:GetRole"
              - "iam:ListAttachedRolePolicies"
              - "iam:ListEntitiesForPolicy"
              - "iam:ListPolicyVersions"
            Resource: "*"
          - Effect: Deny
            Action:
              - "iam:*"
            Resource:
              - !Sub "arn:aws:iam::${AWS::AccountId}:role/${EKSClusterName}-otterize-intents-operator"
              - !Sub "arn:aws:iam::${AWS::AccountId}:role/${EKSClusterName}-otterize-credentials-operator"
              - !Sub "arn:aws:iam::${AWS::AccountId}:policy/${EKSClusterName}-limit-iam-permission-boundary"
          - Effect: Deny
            Action:
              - "iam:CreatePolicyVersion"
              - "iam:DeletePolicyVersion"
              - "iam:DetachRolePolicy"
              - "iam:SetDefaultPolicyVersion"
            Resource: !Sub "arn:aws:iam::${AWS::AccountId}:policy/${EKSClusterName}-limit-iam-permission-boundary"
          - Effect: Deny
            Action:
              - "iam:DeleteRolePermissionsBoundary"
            Resource: "*"
          - Effect: Allow
            Action:
              - "iam:AttachRolePolicy"
              - "iam:CreatePolicy"
              - "iam:CreatePolicyVersion"
              - "iam:DeletePolicy"
              - "iam:DeletePolicyVersion"
              - "iam:TagPolicy"
              - "iam:UntagPolicy"
              - "iam:DetachRolePolicy"
              - "ec2:DescribeInstances"
              - "eks:DescribeCluster"
            Resource: "*"

  CredentialsOperatorPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub "${EKSClusterName}-credentials-operator-access-policy"
      Roles:
        - !Ref CredentialsOperatorServiceAccountRole
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action:
              - "iam:GetPolicy"
              - "iam:GetRole"
              - "iam:ListAttachedRolePolicies"
              - "iam:ListEntitiesForPolicy"
              - "iam:ListPolicyVersions"
            Resource: "*"
          - Effect: Deny
            Action:
              - "iam:*"
            Resource:
              - !Sub "arn:aws:iam::${AWS::AccountId}:role/${EKSClusterName}-otterize-intents-operator"
              - !Sub "arn:aws:iam::${AWS::AccountId}:role/${EKSClusterName}-otterize-credentials-operator"
              - !Sub "arn:aws:iam::${AWS::AccountId}:policy/${EKSClusterName}-limit-iam-permission-boundary"
          - Effect: Allow
            Action:
              - "iam:CreateRole"
            Resource:
              - "*"
            Condition:
              StringEquals:
                "iam:PermissionsBoundary": !Sub "arn:aws:iam::${AWS::AccountId}:policy/${EKSClusterName}-limit-iam-permission-boundary"
          - Effect: Allow
            Action:
              - "iam:DeletePolicy"
              - "iam:DeletePolicyVersion"
              - "iam:DeleteRole"
              - "iam:DetachRolePolicy"
              - "iam:TagRole"
              - "iam:TagPolicy"
              - "iam:UntagRole"
              - "iam:UntagPolicy"
            Resource: "*"
          - Effect: Deny
            Action:
              - "iam:DeleteRolePermissionsBoundary"
            Resource: "*"
          - Effect: Allow
            Action:
              - "ec2:DescribeInstances"
              - "eks:DescribeCluster"
            Resource: "*"

  LimitIAMPermissionBoundaryPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub "${EKSClusterName}-limit-iam-permission-boundary"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Deny
            Action: "iam:*"
            Resource: "*"
          - Effect: Allow
            Action: "*"
            Resource: "*"

  ClusterOIDCURL:
    Type: Custom::ClusterOIDCURL
    Properties:
      ServiceToken: !GetAtt ClusterOIDCURLFunction.Arn
      ClusterName: !Ref EKSClusterName

  # We need to use the API to get the OpenID Connect URL from the cluster, so a Lambda does that for us here
  ClusterOIDCURLFunction:
    Type: AWS::Lambda::Function
    Properties:
      Runtime: python3.12
      Handler: index.lambda_handler
      MemorySize: 128
      Role: !GetAtt ClusterOIDCLambdaExecutionRole.Arn
      Timeout: 30
      Code:
        ZipFile: |
          import boto3
          import json
          import cfnresponse
          eks = boto3.client("eks")
          def lambda_handler(event, context):
            responseData = {}
            if event['RequestType'] == 'Delete':
              responseData['Reason'] = "Success"
              cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData, "")
            else:
              try:
                cluster_name = event['ResourceProperties']['ClusterName']
                response = eks.describe_cluster(name=cluster_name)
                cluster_oidc_url = response['cluster']['identity']['oidc']['issuer']
                # We need the url for the roles without the protocol when creating roles, so remove
                # it here to make this easier to use in CF templates.
                without_protocol = cluster_oidc_url.replace('https://', '')
                responseData['Reason'] = "Success"
                responseData['Url'] = without_protocol
                cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData, without_protocol)
              except Exception as e:
                responseData['Reason'] = str(e)
                cfnresponse.send(event, context, cfnresponse.FAILED, responseData, "")

  ClusterOIDCProvider:
    Type: Custom::ClusterOIDCProvider
    Properties:
      ServiceToken: !GetAtt ClusterOIDCProviderFunction.Arn
      ClusterOIDCURL: !Ref ClusterOIDCURL

  # This defines the lambda that will run the setup (and teardown) code for the OIDC provider
  ClusterOIDCProviderFunction:
    Type: AWS::Lambda::Function
    Properties:
      Runtime: python3.12
      Handler: index.lambda_handler
      MemorySize: 128
      Role: !GetAtt ClusterOIDCLambdaExecutionRole.Arn
      Timeout: 30
      Code:
        ZipFile: !Sub |
          import boto3
          from botocore.exceptions import ClientError
          import json
          import cfnresponse
          iam = boto3.client("iam")
          def lambda_handler(event, context):
            data = {}
            try:
              cluster_oidc_url = event['ResourceProperties']['ClusterOIDCURL']
              if event['RequestType'] == 'Create':
                with_protocol = "https://" + cluster_oidc_url
                # This is the ca thumbprint of AWS's issuer
                issuer_thumbprint = '9e99a48a9960b14926bb7f3b02e22da2b0ab7280'
                try:
                  print("target ARN:" + 'arn:aws:iam::${AWS::AccountId}:oidc-provider/' + cluster_oidc_url)
                  iam.get_open_id_connect_provider(OpenIDConnectProviderArn='arn:aws:iam::${AWS::AccountId}:oidc-provider/' + cluster_oidc_url)
                except iam.exceptions.NoSuchEntityException:
                  resp = iam.create_open_id_connect_provider(Url=with_protocol,ClientIDList=['sts.amazonaws.com'],ThumbprintList=[issuer_thumbprint])
                  provider_arn = resp['OpenIDConnectProviderArn']
                  data["Reason"] = "Provider with ARN " + provider_arn + " created"
                  cfnresponse.send(event, context, cfnresponse.SUCCESS, data, provider_arn)
                  return
          
                data["Reason"] = "Provider already existed, not created"
                cfnresponse.send(event, context, cfnresponse.SUCCESS, data, None)
              elif event['RequestType'] == 'Delete':
                provider_arn = event["PhysicalResourceId"]
                print("Getting ready to delete provider " + provider_arn)
                if provider_arn is None or not provider_arn.startswith("arn:aws"):
                  data["Reason"] = "Provider was not created, not removing"
                  cfnresponse.send(event, context, cfnresponse.SUCCESS, data, provider_arn)
                else:
                  resp = iam.delete_open_id_connect_provider(OpenIDConnectProviderArn=provider_arn)
                  data["Reason"] = "Provider with ARN " + provider_arn + " deleted"
                  cfnresponse.send(event, context, cfnresponse.SUCCESS, data, provider_arn)
              else:
                data["Reason"] = "Unknown operation: " + event['RequestType']
                cfnresponse.send(event, context, cfnresponse.FAILED, data, "")
            except Exception as e:
              data["Reason"] = "Cannot " + event['RequestType'] + " Provider" + str(e)
              cfnresponse.send(event, context, cfnresponse.FAILED, data, "")

  # This the role that gives the stack sufficient permissions to create the OIDC provider. It is only
  # used during lifecycle operations of this stack
  ClusterOIDCLambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: oidc-provider-management
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - eks:DescribeCluster
                Resource: !Sub "arn:aws:eks:${AWS::Region}:${AWS::AccountId}:cluster/${EKSClusterName}"
              - Effect: Allow
                Action:
                  - iam:*OpenIDConnectProvider*
                Resource: "*"
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: "*"

Outputs:
  ClusterOIDCURL:
    Description: The OpenID Connect URL (without protocol)
    Value: !Ref ClusterOIDCURL
  ClusterOIDCProvider:
    Description: The ARN of the OIDCProvider
    Value: !Ref ClusterOIDCProvider