feat(firehose): allow creation of writer role

It is convenient to create a role that has access to writing to the firehose we create within our app. We don't necessarily know what service will be assuming the role however. Gate the creation of such a role on the user providing a service.
observeinc · Nov 20, 2023 · 80f26c0 · 80f26c0
1 parent 9c6ce40
commit 80f26c0
Show file tree

Hide file tree

Showing 2 changed files with 45 additions and 2 deletions.
diff --git a/apps/firehose/template.yaml b/apps/firehose/template.yaml
@@ -44,11 +44,20 @@ Parameters:
     Description: |
       Buffer incoming data to the specified size, in MiBs, before delivering it
       to the destination.
+  WriterRoleService:
+    Type: String
+    Description: |
+      Optional service to create writer role for.
+    Default: ''
 
 Conditions:
   UseStackName: !Equals
     - !Ref NameOverride
     - ''
+  CreateWriterRole: !Not
+    - !Equals
+      - !Ref WriterRoleService
+      - ''
 
 Resources:
   Role:
@@ -125,8 +134,41 @@ Resources:
           Enabled: true
           LogGroupName: !Ref LogGroup
           LogStreamName: !Ref LogStream
+  WriterRole:
+    Type: 'AWS::IAM::Role'
+    Condition: CreateWriterRole
+    Properties:
+      AssumeRolePolicyDocument:
+        Version: 2012-10-17
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service:
+                - !Ref WriterRoleService
+            Action:
+              - 'sts:AssumeRole'
+      Path: /
+      Policies:
+        - PolicyName: firehose
+          PolicyDocument:
+            Version: 2012-10-17
+            Statement:
+              - Effect: Allow
+                Action:
+                  - firehose:DescribeDeliveryStream
+                  - firehose:ListDeliveryStreams
+                  - firehose:ListTagsForDeliveryStream
+                  - firehose:PutRecord
+                  - firehose:PutRecordBatch
+                Resource: !GetAtt 'DeliveryStream.Arn'
 
 Outputs:
   Firehose:
     Description: 'Firehose ARN'
     Value: !GetAtt 'DeliveryStream.Arn'
+  WriterRole:
+    Description: 'Writer role ARN'
+    Value: !If
+      - CreateWriterRole
+      - !GetAtt 'WriterRole.Arn'
+      - ''
diff --git a/integration/tests/firehose.tftest.hcl b/integration/tests/firehose.tftest.hcl
@@ -41,8 +41,9 @@ run "set_prefix" {
     name = run.setup.id
     app  = "firehose"
     parameters = {
-      BucketARN = "arn:aws:s3:::${run.setup.access_point.bucket}"
-      Prefix    = "${run.setup.id}/"
+      BucketARN         = "arn:aws:s3:::${run.setup.access_point.bucket}"
+      Prefix            = "${run.setup.id}/"
+      WriterRoleService = "logs.amazonaws.com"
     }
     capabilities = [
       "CAPABILITY_IAM",