Separate Terraform plan and apply roles for incubator

[Benettonkkb]

Fixes #146

What changes did you make?

• Added a new GitHub Actions OIDC role incubator-tf-plan with ReadOnlyAccess for Terraform plan jobs.
• Added a new GitHub Actions OIDC role incubator-tf-apply with AdministratorAccess and a trust policy restricted to repo:hackforla/incubator:ref:refs/heads/main(in consideration of IAM best practices).
• Left the existing gha-incubator role unchanged to avoid breaking anything(can change, if needed).

Why did you make the changes (we will use this info to test)?

• The issue asked for it.
• What this should do is implement separate plan and apply roles so plan runs with read-only permissions, and apply can only run from the main branch.
• I didn't use policy_arns = ["arn:aws:iam::aws:policy/AdministratorAccess" ] in the same way iam_oidc_gha_incubator does to separate the privilege definitions(I believe I understand this correctly- open to being corrected).

[github-actions]

Terraform plan in terraform
With backend config files: terraform/prod.backend.tfvars

Plan: 4 to add, 0 to change, 0 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+   create

Terraform will perform the following actions:

  # aws_iam_role.incubator_tf_apply will be created
+   resource "aws_iam_role" "incubator_tf_apply" {
+       arn                   = (known after apply)
+       assume_role_policy    = jsonencode(
            {
+               Statement = [
+                   {
+                       Action    = "sts:AssumeRoleWithWebIdentity"
+                       Condition = {
+                           StringEquals = {
+                               "token.actions.githubusercontent.com:aud" = "*****************"
                            }
+                           StringLike   = {
+                               "token.actions.githubusercontent.com:sub" = "********************************************"
                            }
                        }
+                       Effect    = "Allow"
+                       Principal = {
+                           Federated = "arn:aws:iam::035866691871:oidc-provider/token.actions.githubusercontent.com"
                        }
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       create_date           = (known after apply)
+       force_detach_policies = false
+       id                    = (known after apply)
+       managed_policy_arns   = (known after apply)
+       max_session_duration  = 3600
+       name                  = "incubator-tf-apply"
+       name_prefix           = (known after apply)
+       path                  = "/"
+       tags_all              = (known after apply)
+       unique_id             = (known after apply)

+       inline_policy (known after apply)
    }

  # aws_iam_role_policy_attachment.incubator_tf_apply_admin will be created
+   resource "aws_iam_role_policy_attachment" "incubator_tf_apply_admin" {
+       id         = (known after apply)
+       policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
+       role       = "incubator-tf-apply"
    }

  # module.iam_oidc_incubator_tf_plan.aws_iam_openid_connect_provider.github_actions will be created
+   resource "aws_iam_openid_connect_provider" "github_actions" {
+       arn             = (known after apply)
+       client_id_list  = [
+           "sts.amazonaws.com",
        ]
+       id              = (known after apply)
+       tags_all        = (known after apply)
+       thumbprint_list = [
+           "2b18947a6a9fc7764fd8b5fb18a863b0c6dac24f",
        ]
+       url             = "https://token.actions.githubusercontent.com"
    }

  # module.iam_oidc_incubator_tf_plan.aws_iam_role.github_actions_oidc will be created
+   resource "aws_iam_role" "github_actions_oidc" {
+       arn                   = (known after apply)
+       assume_role_policy    = jsonencode(
            {
+               Statement = [
+                   {
+                       Action    = "sts:AssumeRoleWithWebIdentity"
+                       Condition = {
+                           StringEquals = {
+                               "token.actions.githubusercontent.com:aud" = "*****************"
                            }
+                           StringLike   = {
+                               "token.actions.githubusercontent.com:sub" = [
+                                   "repo:hackforla/incubator:ref:refs/heads/*",
+                                   "repo:hackforla/incubator:pull_request",
                                ]
                            }
                        }
+                       Effect    = "Allow"
+                       Principal = {
+                           Federated = "arn:aws:iam::035866691871:oidc-provider/token.actions.githubusercontent.com"
                        }
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       create_date           = (known after apply)
+       force_detach_policies = false
+       id                    = (known after apply)
+       managed_policy_arns   = [
+           "arn:aws:iam::aws:policy/ReadOnlyAccess",
        ]
+       max_session_duration  = 3600
+       name                  = "incubator-tf-plan"
+       name_prefix           = (known after apply)
+       path                  = "/"
+       tags_all              = (known after apply)
+       unique_id             = (known after apply)

+       inline_policy (known after apply)
    }

Plan: 4 to add, 0 to change, 0 to destroy.

Warning: Argument is deprecated

  with module.iam_oidc_incubator_tf_plan.aws_iam_role.github_actions_oidc,
  on modules/aws-gha-oidc-providers/main.tf line 54, in resource "aws_iam_role" "github_actions_oidc":
  54:   managed_policy_arns = var.policy_arns

managed_policy_arns is deprecated. Use the aws_iam_role_policy_attachment
resource instead. If Terraform should exclusively manage all managed policy
attachments (the current behavior of this argument), use the
aws_iam_role_policy_attachments_exclusive resource as well.

📝 Plan generated in Write Terraform Plan to Pull Request #92

[Benettonkkb]

Ah! I also remember that I looked into policy_arns = ["arn:aws:iam::aws:policy/AdministratorAccess"] because it came up as deprecated when I was trying to figure out how to attach the AdministratorAccess.