xdr-terraform-modules/base/phantom/instance_profile.tf

resource "aws_iam_instance_profile" "phantom_instance_profile" {
  name = "xdr-phantom-instance-profile"
  path = "/instance/"
  role = aws_iam_role.phantom_instance_role.name
}

resource "aws_iam_role"  "phantom_instance_role" {
  name = "xdr-phantom-instance-role"
  path = "/instance/"
  assume_role_policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "",
        "Effect": "Allow",
        "Principal": {
          "Service": [
            "ec2.amazonaws.com",
            "ssm.amazonaws.com"
            ]
        },
        "Action": "sts:AssumeRole"
      }
    ]
  }
EOF
}

# These 3 are the default profile attachments:
resource "aws_iam_role_policy_attachment" "phantom_instance_AmazonEC2RoleforSSM" {
  role       = aws_iam_role.phantom_instance_role.name
  policy_arn = "arn:${var.aws_partition}:iam::aws:policy/service-role/AmazonEC2RoleforSSM"
}

resource "aws_iam_role_policy_attachment" "phantom_instance_default_policy_attach" {
  role       = aws_iam_role.phantom_instance_role.name
  policy_arn = "arn:${ var.aws_partition }:iam::${ var.aws_account_id }:policy/launchroles/default_instance_tag_read"
}

resource "aws_iam_role_policy_attachment" "phantom_instance_cloudwatch_policy_attach" {
  role       = aws_iam_role.phantom_instance_role.name
  policy_arn = "arn:${ var.aws_partition }:iam::${ var.aws_account_id }:policy/cloudwatch_events"
}

# Phantom Specific Policy
#resource "aws_iam_policy" "phantom_instance_policy" {
#  name        = "phantom_instance_policy"
#  path        = "/launchroles/"
#  description = "This policy allows phantom-specific functions"
#  policy      = data.aws_iam_policy_document.phantom_instance_policy_doc.json
#}
#
#data "aws_iam_policy_document" "phantom_instance_policy_doc" {
#  # Allow copying to S3 for frozen
#  # Allow use of S3 for SmartStore
#  statement {
#    sid = "GeneralBucketAccess"
#    effect = "Allow"
#    actions = [
#      "s3:ListAllMyBuckets",
#      "s3:HeadBucket",
#    ]
#    resources = [ "*" ]
#  }
#
#  statement {
#    sid = "S3BucketAccess"
#    effect = "Allow"
#    actions = [
#      "s3:GetLifecycleConfiguration",
#      "s3:DeleteObjectVersion",
#      "s3:ListBucketVersions",
#      "s3:GetBucketLogging",
#      "s3:RestoreObject",
#      "s3:ListBuckets",
#      "s3:GetBucketVersioning",
#      "s3:PutObject",
#      "s3:GetObject",
#      "s3:PutLifecycleConfiguration",
#      "s3:GetBucketCORS",
#      "s3:DeleteObject",
#      "s3:GetBucketLocation",
#      "s3:GetObjectVersion",
#    ]
#    resources = [ 
#      "arn:${ var.aws_partition }:s3:::xdr-${ var.prefix }-${ var.environment }-splunk-frozen",
#      "arn:${ var.aws_partition }:s3:::xdr-${ var.prefix }-${ var.environment }-splunk-frozen/*",
#      "arn:${ var.aws_partition }:s3:::xdr-${ var.prefix }-${ var.environment }-splunk-smartstore",
#      "arn:${ var.aws_partition }:s3:::xdr-${ var.prefix }-${ var.environment }-splunk-smartstore/*",
#    ]
#  }
#
#  statement {
#    sid = "S3ReadOnlyBucketAccess"
#    effect = "Allow"
#    actions = [
#      "s3:ListBucketVersions",
#      "s3:ListBuckets",
#      "s3:GetBucketVersioning",
#      "s3:GetObject",
#      "s3:GetBucketCORS",
#      "s3:GetBucketLocation",
#      "s3:GetObjectVersion",
#    ]
#    resources = [ 
#      "arn:${ var.aws_partition }:s3:::xdr-${ var.prefix }-${ var.environment }-splunk-apps",
#      "arn:${ var.aws_partition }:s3:::xdr-${ var.prefix }-${ var.environment }-splunk-apps/*",
#    ]
#  }
#
#  statement {
#    sid = "KMSKeyAccess"
#    effect = "Allow"
#    actions = [
#      "kms:Decrypt",
#      "kms:GenerateDataKeyWithoutPlaintext",
#      "kms:Verify",
#      "kms:GenerateDataKeyPairWithoutPlaintext",
#      "kms:GenerateDataKeyPair",
#      "kms:ReEncryptFrom",
#      "kms:Encrypt",
#      "kms:GenerateDataKey",
#      "kms:ReEncryptTo",
#      "kms:Sign",
#    ]
#    resources = [ "*" ]
#  }      
#}
#
#resource "aws_iam_role_policy_attachment" "phantom_instance_policy_attach" {
#  role       = aws_iam_role.phantom_instance_role.name
#  policy_arn = aws_iam_policy.phantom_instance_policy.arn
#}