diff --git a/services/terraform/remote/aws_iam.tf b/services/terraform/remote/aws_iam.tf --- a/services/terraform/remote/aws_iam.tf +++ b/services/terraform/remote/aws_iam.tf @@ -319,3 +319,53 @@ domain_name = module.shared.opensearch_domain_identity.domain_name access_policies = data.aws_iam_policy_document.opensearch_domain_access.json } + +resource "aws_iam_role" "scheduler" { + name = "cron-scheduler-role" + assume_role_policy = jsonencode({ + Version = "2012-10-17" + Statement = [ + { + Effect = "Allow" + Principal = { + Service = ["scheduler.amazonaws.com"] + } + Action = "sts:AssumeRole" + } + ] + }) +} + +resource "aws_iam_role_policy_attachment" "scheduler" { + policy_arn = aws_iam_policy.scheduler.arn + role = aws_iam_role.scheduler.name +} + +resource "aws_iam_policy" "scheduler" { + name = "cron-scheduler-policy" + policy = jsonencode({ + Version = "2012-10-17" + Statement = [ + # Allow scheduler to execute the task + { + + Effect = "Allow", + Action = [ + "ecs:RunTask" + ] + Resource = aws_ecs_task_definition.blob_cleanup.arn_without_revision + }, + # Allow scheduler to set the IAM roles of the ECS task + { + Effect = "Allow", + Action = [ + "iam:PassRole" + ] + Resource = [ + aws_ecs_task_definition.blob_cleanup.execution_role_arn, + aws_ecs_task_definition.blob_cleanup.task_role_arn + ] + }, + ] + }) +} diff --git a/services/terraform/remote/task_blob_cleanup.tf b/services/terraform/remote/task_blob_cleanup.tf --- a/services/terraform/remote/task_blob_cleanup.tf +++ b/services/terraform/remote/task_blob_cleanup.tf @@ -80,53 +80,3 @@ } } } - -resource "aws_iam_role" "scheduler" { - name = "cron-scheduler-role" - assume_role_policy = jsonencode({ - Version = "2012-10-17" - Statement = [ - { - Effect = "Allow" - Principal = { - Service = ["scheduler.amazonaws.com"] - } - Action = "sts:AssumeRole" - } - ] - }) -} - -resource "aws_iam_role_policy_attachment" "scheduler" { - policy_arn = aws_iam_policy.scheduler.arn - role = aws_iam_role.scheduler.name -} - -resource "aws_iam_policy" "scheduler" { - name = "cron-scheduler-policy" - policy = jsonencode({ - Version = "2012-10-17" - Statement = [ - # Allow scheduler to execute the task - { - - Effect = "Allow", - Action = [ - "ecs:RunTask" - ] - Resource = aws_ecs_task_definition.blob_cleanup.arn_without_revision - }, - # Allow scheduler to set the IAM roles of the ECS task - { - Effect = "Allow", - Action = [ - "iam:PassRole" - ] - Resource = [ - aws_ecs_task_definition.blob_cleanup.execution_role_arn, - aws_ecs_task_definition.blob_cleanup.task_role_arn - ] - }, - ] - }) -}