Skip to content

Add DB Ec2 instances access to postgres secrets #18713

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dave-belton merged 9 commits into from
Sep 2, 2026
Merged

Add DB Ec2 instances access to postgres secrets #18713

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
cd4fa03
All DB Ec2 instances access to postgres secret
dave-belton Sep 1, 2026
14848d8
Can't use local variable at that point as tf fails with null value
dave-belton Sep 1, 2026
a732a92
Add access to KMS key to allow decryption of the secret
dave-belton Sep 1, 2026
a5e920c
Merge branch 'main' into DBA-1282-Oracle-to-PostgreSQL-connectivity-f…
dave-belton Sep 1, 2026
c32d565
TF fix
dave-belton Sep 1, 2026
fcce53a
Merge branch 'main' into DBA-1282-Oracle-to-PostgreSQL-connectivity-f…
dave-belton Sep 2, 2026
9900a47
DBA-1282: try to use the KMS resource ARN directly and try to additio…
dave-belton Sep 2, 2026
6c8dd68
Merge branch 'main' into DBA-1282-Oracle-to-PostgreSQL-connectivity-f…
dave-belton Sep 2, 2026
2741d4d
DBA-1282: update preprod and prod to use the KMS resource ARN directl…
dave-belton Sep 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions terraform/environments/oasys/locals_preproduction.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,8 +215,16 @@ locals {
resources = [
"arn:aws:secretsmanager:*:*:secret:/oracle/database/*PP/*",
"arn:aws:secretsmanager:*:*:secret:/oracle/database/PP*/*",
"arn:aws:secretsmanager:*:*:secret:/postgres/database/hmpps-arns-assessment-view-db-preprod/*",
]
},
{
effect = "Allow"
actions = [
"kms:Decrypt",
]
resources = ["*"]

@ep-93 ep-93 Sep 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could it be a specific resource to follow the least privilege. If you dont know the key ARN maybe a condition or restrict usage to secrets manager.

},
]
}
Ec2PreprodWebPolicy = {
Expand Down
8 changes: 8 additions & 0 deletions terraform/environments/oasys/locals_production.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -453,8 +453,16 @@ locals {
"arn:aws:secretsmanager:*:*:secret:/oracle/database/*PD/*",
"arn:aws:secretsmanager:*:*:secret:/oracle/database/PD*/*",
"arn:aws:secretsmanager:*:*:secret:/oracle/database/DR*/*",
"arn:aws:secretsmanager:*:*:secret:/postgres/database/hmpps-arns-assessment-view-db-prod/*",
]
},
{
effect = "Allow"
actions = [
"kms:Decrypt",
]
resources = ["*"]
},
]
}
Ec2ProdWebPolicy = {
Expand Down
10 changes: 9 additions & 1 deletion terraform/environments/oasys/locals_test.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -352,8 +352,16 @@ locals {
resources = [
"arn:aws:secretsmanager:*:*:secret:/oracle/database/*T2/*",
"arn:aws:secretsmanager:*:*:secret:/oracle/database/T2*/*",
"arn:aws:secretsmanager:*:*:secret:/postgres/database/hmpps-arns-assessment-view-db-test/*",
]
}
},
{
effect = "Allow"
actions = [
"kms:Decrypt",
]
resources = ["*"]
},
]
}
Ec2T2WebPolicy = {
Expand Down
Loading