iam.tf

###############################################################################
# Trust policies. The MicroVM build/exec roles are assumed by the lambda service
# principal; the confused-deputy guard pins the source account.
###############################################################################

data "aws_iam_policy_document" "lambda_trust" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = [local.account_id]
    }
  }
}

# The dispatcher is an ordinary Lambda function; no SourceAccount condition.
data "aws_iam_policy_document" "dispatcher_trust" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

###############################################################################
# Build role - assumed by Lambda DURING the MicroVM image build. Reads the code
# artifact from S3 and writes build logs.
###############################################################################

resource "aws_iam_role" "build" {
  name               = "${var.name_prefix}-build-role"
  assume_role_policy = data.aws_iam_policy_document.lambda_trust.json
  tags               = local.tags
}

data "aws_iam_policy_document" "build" {
  statement {
    sid       = "ReadArtifactWriteBuildOutput"
    effect    = "Allow"
    actions   = ["s3:GetObject", "s3:PutObject", "s3:ListBucket"]
    resources = [aws_s3_bucket.artifacts.arn, "${aws_s3_bucket.artifacts.arn}/*"]
  }
  statement {
    sid       = "BuildLogs"
    effect    = "Allow"
    actions   = ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"]
    resources = ["arn:aws:logs:${local.region}:${local.account_id}:*"]
  }
}

resource "aws_iam_role_policy" "build" {
  name   = "build"
  role   = aws_iam_role.build.id
  policy = data.aws_iam_policy_document.build.json
}

###############################################################################
# Exec role - assumed AT RUNTIME by each MicroVM. Writes runner/dockerd logs and
# may self-terminate when an ephemeral job ends (stops billing immediately).
###############################################################################

resource "aws_iam_role" "exec" {
  name               = "${var.name_prefix}-exec-role"
  assume_role_policy = data.aws_iam_policy_document.lambda_trust.json
  tags               = local.tags
}

data "aws_iam_policy_document" "exec" {
  statement {
    sid       = "RuntimeLogs"
    effect    = "Allow"
    actions   = ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"]
    resources = ["arn:aws:logs:${local.region}:${local.account_id}:*"]
  }
  statement {
    sid       = "SelfTerminate"
    effect    = "Allow"
    actions   = ["lambda:TerminateMicrovm"]
    resources = ["*"]
  }
}

resource "aws_iam_role_policy" "exec" {
  name   = "exec"
  role   = aws_iam_role.exec.id
  policy = data.aws_iam_policy_document.exec.json
}

###############################################################################
# Dispatcher role - assumed by the dispatcher Lambda. Launches/terminates
# MicroVMs, passes the egress connector + exec role, and reads the secret.
###############################################################################

resource "aws_iam_role" "dispatcher" {
  name               = "${var.name_prefix}-dispatcher-role"
  assume_role_policy = data.aws_iam_policy_document.dispatcher_trust.json
  tags               = local.tags
}

data "aws_iam_policy_document" "dispatcher" {
  statement {
    sid       = "Logs"
    effect    = "Allow"
    actions   = ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"]
    resources = ["arn:aws:logs:${local.region}:${local.account_id}:*"]
  }
  statement {
    sid       = "MicroVMOps"
    effect    = "Allow"
    actions   = ["lambda:RunMicrovm", "lambda:TerminateMicrovm", "lambda:GetMicrovm", "lambda:GetMicrovmImage", "lambda:ListMicrovms"]
    resources = ["*"]
  }
  statement {
    sid       = "PassNetworkConnector"
    effect    = "Allow"
    actions   = ["lambda:PassNetworkConnector"]
    resources = ["arn:aws:lambda:${local.region}:aws:network-connector:aws-network-connector:*"]
  }
  statement {
    sid       = "PassExecRole"
    effect    = "Allow"
    actions   = ["iam:PassRole"]
    resources = [aws_iam_role.exec.arn]
  }
  statement {
    sid       = "ReadDispatcherParam"
    effect    = "Allow"
    actions   = ["ssm:GetParameter"]
    resources = [aws_ssm_parameter.dispatcher.arn]
  }
  statement {
    sid       = "DecryptDispatcherParam"
    effect    = "Allow"
    actions   = ["kms:Decrypt"]
    resources = ["*"]
    # Scope the AWS-managed aws/ssm key decrypt to SSM only.
    condition {
      test     = "StringEquals"
      variable = "kms:ViaService"
      values   = ["ssm.${local.region}.amazonaws.com"]
    }
  }
}

resource "aws_iam_role_policy" "dispatcher" {
  name   = "dispatcher"
  role   = aws_iam_role.dispatcher.id
  policy = data.aws_iam_policy_document.dispatcher.json
}