@intentius/chant-lexicon-terraform 0.101.0 → 0.104.0

package/src/lint/post-synth/fixtures/TF030/negative.tf

@@ -0,0 +1,55 @@
+# Vendored for TF030 from https://github.com/aws-samples/web-hosting-architecture-examples-for-china-region-terraform
+# Path: eks/security-groups.tf
+# Commit: 718a45d536672e7f5f4e1fa6011e3acb27ab4f5a
+# Licence: MIT-0, https://github.com/aws-samples/web-hosting-architecture-examples-for-china-region-terraform/blob/718a45d536672e7f5f4e1fa6011e3acb27ab4f5a/LICENSE
+# The whole file, unmodified.
+#
+# TF030: silent. Every group opens 22, but only to private ranges.
+
+
+resource "aws_security_group" "worker_group_mgmt_one" {
+  name_prefix = "worker_group_mgmt_one"
+  vpc_id      = module.vpc.vpc_id
+
+  ingress {
+    from_port = 22
+    to_port   = 22
+    protocol  = "tcp"
+
+    cidr_blocks = [
+      "10.0.0.0/8",
+    ]
+  }
+}
+
+resource "aws_security_group" "worker_group_mgmt_two" {
+  name_prefix = "worker_group_mgmt_two"
+  vpc_id      = module.vpc.vpc_id
+
+  ingress {
+    from_port = 22
+    to_port   = 22
+    protocol  = "tcp"
+
+    cidr_blocks = [
+      "192.168.0.0/16",
+    ]
+  }
+}
+
+resource "aws_security_group" "all_worker_mgmt" {
+  name_prefix = "all_worker_management"
+  vpc_id      = module.vpc.vpc_id
+
+  ingress {
+    from_port = 22
+    to_port   = 22
+    protocol  = "tcp"
+
+    cidr_blocks = [
+      "10.0.0.0/8",
+      "172.16.0.0/12",
+      "192.168.0.0/16",
+    ]
+  }
+}

package/src/lint/post-synth/fixtures/TF030/not-determined-port.tf

@@ -0,0 +1,28 @@
+# Vendored for TF030 from https://github.com/gruntwork-io/terratest
+# Path: examples/terraform-ssh-example/main.tf
+# Commit: 75a9f881c31f71255b474149edada4a1850bce22
+# Licence: Apache-2.0, https://github.com/gruntwork-io/terratest/blob/75a9f881c31f71255b474149edada4a1850bce22/LICENSE
+# Excerpt: lines 61-80, the aws_security_group.example block, unmodified.
+#
+# TF030: one info, Not determined: the CIDR is 0.0.0.0/0 but from_port and to_port are var.ssh_port. The open egress is not reported.
+
+resource "aws_security_group" "example" {
+  name = var.instance_name
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+    from_port = var.ssh_port
+    to_port   = var.ssh_port
+    protocol  = "tcp"
+
+    # To keep this example simple, we allow incoming SSH requests from any IP. In real-world usage, you should only
+    # allow SSH requests from trusted servers, such as a bastion host or VPN server.
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}

package/src/lint/post-synth/fixtures/TF030/not-determined-standalone.tf

@@ -0,0 +1,32 @@
+# Vendored for TF030 from https://github.com/aws-samples/terraform-sample-workshop
+# Path: module_1/one_file_tf/simple_nginx_stack/main.tf
+# Commit: 0a265e356a3cf4fd0f15ba821b7bedf712a32239
+# Licence: MIT-0, https://github.com/aws-samples/terraform-sample-workshop/blob/0a265e356a3cf4fd0f15ba821b7bedf712a32239/LICENSE
+# Excerpt: lines 127-150, unmodified.
+#
+# TF030: one info, Not determined: allow_ssh_internal opens 22 to cidr_blocks = [var.cidr_vpc]. egress_allow_all (protocol "all", 0.0.0.0/0) is egress and is not reported.
+
+resource "aws_security_group" "vpc_security_group" {
+  name   = "aws-${var.vpc_name}-vpc-sg"
+  vpc_id = aws_vpc.vpc.id
+}
+
+resource "aws_security_group_rule" "allow_ssh_internal" {
+  type        = "ingress"
+  from_port   = 22
+  to_port     = 22
+  protocol    = "tcp"
+  cidr_blocks = [var.cidr_vpc]
+
+  security_group_id = aws_security_group.vpc_security_group.id
+}
+
+resource "aws_security_group_rule" "egress_allow_all" {
+  type        = "egress"
+  from_port   = 0
+  to_port     = 65535
+  protocol    = "all"
+  cidr_blocks = ["0.0.0.0/0"]
+
+  security_group_id = aws_security_group.vpc_security_group.id
+}

package/src/lint/post-synth/fixtures/TF030/not-determined-vpc-rule.tf

@@ -0,0 +1,21 @@
+# Vendored for TF030 from https://github.com/aws-samples/sample-parallel-computing-service
+# Path: modules/vpc/main.tf
+# Commit: e74e5806f8fa203b268532f9f6c64e649b35708e
+# Licence: MIT-0, https://github.com/aws-samples/sample-parallel-computing-service/blob/e74e5806f8fa203b268532f9f6c64e649b35708e/LICENSE
+# Excerpt: lines 81-93, unmodified. The for_each map it reads, local.pcs_public_security_group_rules.ingress (lines 37-51 of the same file), does open 22 to 0.0.0.0/0.
+#
+# TF030: one info, Not determined: every attribute is each.value.*, so the rule cannot see the open SSH port that the locals declare. This is what the info finding is for.
+
+resource "aws_security_group" "pcs_public" {
+  name   = "${var.project}-public-sg"
+  vpc_id = aws_vpc.pcs.id
+}
+
+resource "aws_vpc_security_group_ingress_rule" "pcs_public_allow_ingress" {
+  for_each          = local.pcs_public_security_group_rules.ingress
+  security_group_id = aws_security_group.pcs_public.id
+  cidr_ipv4         = each.value.cidr_ipv4
+  from_port         = each.value.from_port
+  ip_protocol       = each.value.ip_protocol
+  to_port           = each.value.to_port
+}

package/src/lint/post-synth/fixtures/TF030/not-determined.tf

@@ -0,0 +1,39 @@
+# Vendored for TF030 from https://github.com/aws-samples/sample-issac-lab-on-aws
+# Path: main.tf
+# Commit: 50ea76d87d873c1d69bed92c450ab144894f437e
+# Licence: MIT-0, https://github.com/aws-samples/sample-issac-lab-on-aws/blob/50ea76d87d873c1d69bed92c450ab144894f437e/LICENSE
+# Excerpt: lines 116-146, the aws_security_group.isaac block, unmodified.
+#
+# TF030: one info, Not determined: port 22 is open to cidr_blocks = var.allowed_ssh_cidrs, which the parse cannot read. No error.
+
+resource "aws_security_group" "isaac" {
+  name_prefix = "${var.project_name}-sg-"
+  description = "Isaac Lab training instance security group"
+  vpc_id      = aws_vpc.isaac.id
+
+  # SSH
+  ingress {
+    description = "SSH"
+    from_port   = 22
+    to_port     = 22
+    protocol    = "tcp"
+    cidr_blocks = var.allowed_ssh_cidrs
+  }
+
+  # All outbound
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = {
+    Name    = "${var.project_name}-sg"
+    Project = var.project_name
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}

package/src/lint/post-synth/fixtures/TF030/positive-ipv6.tf

@@ -0,0 +1,44 @@
+# Vendored for TF030 from https://github.com/bridgecrewio/checkov
+# Path: tests/terraform/checks/resource/aws/example_SecurityGroupUnrestrictedIngress22/main.tf
+# Commit: 4ef6eb50e33f60d8a204138f08883e12494ac230
+# Licence: Apache-2.0, https://github.com/bridgecrewio/checkov/blob/4ef6eb50e33f60d8a204138f08883e12494ac230/LICENSE
+# Checkov's own test corpus for CKV_AWS_24. Excerpt: lines 63-98, the aws_security_group.fail4 and aws_security_group.fail-ipv6 blocks, unmodified.
+#
+# TF030: two errors: fail4 writes ingress in attribute syntax with protocol "-1" (every port), fail-ipv6 opens 22 to ::/0.
+
+resource "aws_security_group" "fail4" {
+  description = "SG with inline rules"
+  ingress = [
+    {
+      cidr_blocks      = ["0.0.0.0/0"]
+      description      = "Wide Open"
+      from_port        = 0
+      ipv6_cidr_blocks = []
+      prefix_list_ids  = []
+      security_groups  = []
+      protocol         = "-1"
+      self             = false
+      to_port          = 65535
+    }
+  ]
+}
+
+resource "aws_security_group" "fail-ipv6" {
+  name   = "sg-bar"
+  vpc_id = aws_vpc.main.id
+
+  ingress {
+    from_port = 22
+    to_port   = 22
+    protocol  = "tcp"
+    ipv6_cidr_blocks = ["192.168.0.0/16", "::/0"]
+    description = "foo"
+  }
+
+  egress {
+    from_port = 0
+    to_port   = 0
+    protocol  = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}

package/src/lint/post-synth/fixtures/TF030/positive-mixed.tf

@@ -0,0 +1,36 @@
+# Vendored for TF030 from https://github.com/aws-samples/aws-database-acceleration-toolkit
+# Path: modules/tffiles-jenkins/jenkins.tf
+# Commit: dbb3d2df6a53ef95049e04b7bbe69aa70c607f81
+# Licence: MIT-0, https://github.com/aws-samples/aws-database-acceleration-toolkit/blob/dbb3d2df6a53ef95049e04b7bbe69aa70c607f81/LICENSE
+# Excerpt: lines 38-65, the aws_security_group.jenkins_port block, unmodified.
+#
+# TF030: one error, on the second ingress (port 22 from 0.0.0.0/0). The first ingress opens 8080, which is not on the sensitive list, and the egress is not ingress.
+
+resource "aws_security_group" "jenkins_port" {
+    vpc_id = var.vpc_id
+    provider = aws.primary
+
+    egress {
+        from_port = 0
+        to_port = 0
+        protocol = -1
+        cidr_blocks = ["0.0.0.0/0"]
+    }    
+  
+
+     ingress {
+        from_port = 8080
+        to_port = 8080
+        protocol = "tcp"
+        cidr_blocks = ["0.0.0.0/0"]
+    } 
+
+       ingress {
+        from_port = 22
+        to_port = 22
+        protocol = "tcp"
+        cidr_blocks = ["0.0.0.0/0"]
+    } 
+
+    lifecycle { create_before_destroy = true }
+}

package/src/lint/post-synth/fixtures/TF030/positive-standalone.tf

@@ -0,0 +1,25 @@
+# Vendored for TF030 from https://github.com/bridgecrewio/checkov
+# Path: tests/terraform/checks/resource/aws/example_SecurityGroupUnrestrictedIngress22/main.tf
+# Commit: 4ef6eb50e33f60d8a204138f08883e12494ac230
+# Licence: Apache-2.0, https://github.com/bridgecrewio/checkov/blob/4ef6eb50e33f60d8a204138f08883e12494ac230/LICENSE
+# Checkov's own test corpus for CKV_AWS_24. Excerpt: lines 100-116, the aws_security_group_rule.fail and aws_vpc_security_group_ingress_rule.fail blocks, unmodified.
+#
+# TF030: two errors, one per standalone shape: a 0.0.0.0/0 among other CIDRs on 22, and cidr_ipv4 = "0.0.0.0/0" on 22.
+
+resource "aws_security_group_rule" "fail" {
+  type              = "ingress"
+  from_port         = 22
+  to_port           = 22
+  protocol          = "tcp"
+  cidr_blocks       = ["192.168.0.0/16", "0.0.0.0/0"]
+  security_group_id = aws_security_group.bar-sg.id
+}
+
+resource "aws_vpc_security_group_ingress_rule" "fail" {
+  security_group_id = aws_security_group.example.id
+
+  cidr_ipv4   = "0.0.0.0/0"
+  from_port   = 22
+  ip_protocol = "tcp"
+  to_port     = 22
+}

package/src/lint/post-synth/fixtures/TF030/positive.tf

@@ -0,0 +1,43 @@
+# Vendored for TF030 from https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline
+# Path: sec-groups.tf
+# Commit: 68c34a21e966afc11c572677c319f2cc8379ec94
+# Licence: MIT-0, https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/68c34a21e966afc11c572677c319f2cc8379ec94/LICENSE
+# The whole file, unmodified.
+#
+# TF030: one error, on the "Ephemeral" ingress: tcp 1025-65535 from 0.0.0.0/0 spans 3306, 3389 and 5432. The TLS ingress on 443 is not reported.
+
+resource "aws_security_group" "image_builder_sg" {
+  depends_on = [
+    aws_vpc.hardening_pipeline
+  ]
+  name        = "${var.image_name}-sg"
+  description = "Security group for EC2 Image Builder"
+  vpc_id      = aws_vpc.hardening_pipeline.id
+
+  ingress {
+    description = "TLS"
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+    description = "Ephemeral"
+    from_port   = 1025
+    to_port     = 65535
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  egress {
+    description      = "Allow all eggress"
+    from_port        = 0
+    to_port          = 0
+    protocol         = "-1"
+    cidr_blocks      = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = ["::/0"]
+  }
+
+  tags = local.core_tags
+}

package/src/lint/post-synth/fixtures/TF031/negative.tf

@@ -0,0 +1,89 @@
+# Vendored for TF031 (chant #2286), unmodified below this header.
+# Source: https://github.com/alphagov/tech-ops/blob/122e78d1c6477825b22dd52f32e185a4a7838683/reliability-engineering/terraform/modules/concourse-monitoring/prometheus-ecs-iam.tf
+# Repository: alphagov/tech-ops, path reliability-engineering/terraform/modules/concourse-monitoring/prometheus-ecs-iam.tf, commit 122e78d1c6477825b22dd52f32e185a4a7838683
+# Licence: MIT
+#
+# Scoped policies only: every action is named and every resource is an
+# attribute of a managed resource, which can never be "*". TF031 reports
+# nothing, and not "not determined" either.
+#
+# Copyright (c) 2018 Government Digital Service
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+data "aws_iam_policy_document" "ecs_assume_role" {
+  statement {
+    actions = ["sts:AssumeRole"]
+    principals {
+      type        = "Service"
+      identifiers = ["ecs-tasks.amazonaws.com"]
+    }
+  }
+}
+
+resource "aws_iam_role" "prometheus_execution" {
+  name               = "${var.deployment}-prometheus-execution"
+  assume_role_policy = data.aws_iam_policy_document.ecs_assume_role.json
+}
+
+data "aws_iam_policy_document" "prometheus_data_volume_access" {
+  statement {
+    principals {
+      type        = "AWS"
+      identifiers = [aws_iam_role.concourse_prometheus.arn]
+    }
+
+    actions = [
+      "elasticfilesystem:ClientMount",
+      "elasticfilesystem:ClientWrite",
+    ]
+
+    condition {
+      test     = "StringEquals"
+      variable = "elasticfilesystem:AccessPointArn"
+      values   = [aws_efs_access_point.prometheus.arn]
+    }
+
+    resources = [aws_efs_file_system.prometheus.arn]
+  }
+}
+
+data "aws_iam_policy_document" "prometheus_cloudwatch_access" {
+  statement {
+    actions = [
+      "logs:CreateLogStream",
+      "logs:PutLogEvents",
+    ]
+
+    resources = [
+      aws_cloudwatch_log_group.prometheus.arn,
+      "${aws_cloudwatch_log_group.prometheus.arn}:log-stream:*",
+    ]
+  }
+}
+
+resource "aws_iam_policy" "prometheus_cloudwatch_access" {
+  name   = "${var.deployment}-prometheus-cloudwatch-access"
+  policy = data.aws_iam_policy_document.prometheus_cloudwatch_access.json
+}
+
+resource "aws_iam_role_policy_attachment" "prometheus_cloudwatch_access" {
+  role       = aws_iam_role.prometheus_execution.name
+  policy_arn = aws_iam_policy.prometheus_cloudwatch_access.arn
+}

package/src/lint/post-synth/fixtures/TF031/not-determined.tf

@@ -0,0 +1,139 @@
+# Vendored for TF031 (chant #2286), unmodified below this header.
+# Source: https://github.com/alphagov/tech-ops/blob/122e78d1c6477825b22dd52f32e185a4a7838683/reliability-engineering/terraform/modules/concourse-secrets-admin/iam.tf
+# Repository: alphagov/tech-ops, path reliability-engineering/terraform/modules/concourse-secrets-admin/iam.tf, commit 122e78d1c6477825b22dd52f32e185a4a7838683
+# Licence: MIT
+#
+# Both documents build Statement with concat(...) and a for-expression, so
+# TF031 cannot read them and reports not determined, never a warning. The
+# Deny statement with Action "*" and Resource "*" inside the concat is a guard
+# rail and would not fire even if it were readable.
+#
+# Copyright (c) 2018 Government Digital Service
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+resource "aws_iam_role" "concourse_secrets_admin" {
+  name = "${var.deployment}-${var.concourse_team_name}-concourse-secrets-admin"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = concat(
+      [
+        for team_id in concat(
+          var.trusted_github_team_id == "" ? [] : [var.trusted_github_team_id],
+          var.trusted_github_team_ids
+        ) : {
+          Effect = "Allow"
+          Principal = {
+            Federated = var.iam_oidc_provider_arn
+          }
+          Action = "sts:AssumeRoleWithWebIdentity"
+          Condition = {
+            StringEquals = {
+              "${var.oidc_host_path}:aud" = var.github_oauth_client_id
+              "aws:RequestTag/t${team_id}" = "t"
+            }
+          }
+        }
+      ],
+      [
+        {
+          Sid = "AllowPassSessionTagsAndTransitive"
+          Effect = "Allow"
+          Action = "sts:TagSession"
+          Principal = {
+            Federated = var.iam_oidc_provider_arn
+          }
+        }
+      ],
+      (length(var.allowed_cidrs) == 0 ? [] : [{
+          Sid = "DisallowAssumeFromUntrustedCIDR"
+          Effect = "Deny"
+          Principal = {
+            Federated = var.iam_oidc_provider_arn
+          }
+          Action = "sts:AssumeRoleWithWebIdentity"
+          Condition = {
+            NotIpAddress = {
+              "aws:SourceIp" = var.allowed_cidrs
+            }
+          }
+        }
+      ])
+    )
+  })
+}
+
+resource "aws_iam_role_policy" "concourse_secrets_admin" {
+  name = "${var.deployment}-${var.concourse_team_name}-concourse-secrets-admin-policy"
+  role = aws_iam_role.concourse_secrets_admin.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = concat(
+      [
+        {
+          Action = [
+            "ssm:GetParameter",
+            "ssm:GetParameterHistory",
+            "ssm:GetParameters",
+            "ssm:GetParametersByPath",
+            "ssm:DeleteParameter",
+            "ssm:PutParameter",
+          ]
+          Effect = "Allow"
+          Resource = [
+            "arn:aws:ssm:eu-west-2:${data.aws_caller_identity.account.account_id}:parameter/${var.deployment}/concourse/pipelines/${var.concourse_team_name}/*"
+          ]
+        }, {
+          Action = [
+            "ssm:DeleteParameter",
+            "ssm:PutParameter",
+          ]
+          Effect = "Deny"
+          Resource = [
+            "arn:aws:ssm:eu-west-2:${data.aws_caller_identity.account.account_id}:parameter/${var.deployment}/concourse/pipelines/${var.concourse_team_name}/readonly_*"
+          ]
+        }, {
+          Action = [
+            "kms:ListKeys",
+            "kms:ListAliases",
+            "kms:Describe*",
+            "kms:Decrypt",
+            "kms:Encrypt",
+          ]
+          Effect = "Allow"
+          Resource = var.kms_key_arn
+        }
+      ],
+      (length(var.allowed_cidrs) == 0 ? [] : [{
+          Sid = "DisallowAllFromUntrustedCIDR"
+          Effect = "Deny"
+          Action = "*"
+          Resource = "*"
+          Condition = {
+            NotIpAddress = {
+              "aws:SourceIp" = var.allowed_cidrs
+            }
+          }
+        }
+      ])
+    )
+  })
+}

package/src/lint/post-synth/fixtures/TF031/positive-data-source.tf

@@ -0,0 +1,57 @@
+# Vendored for TF031 (chant #2286), unmodified below this header.
+# Source: https://github.com/alphagov/tech-ops/blob/122e78d1c6477825b22dd52f32e185a4a7838683/cyber-security/modules/gds_security_audit_role/inline_policies.tf
+# Repository: alphagov/tech-ops, path cyber-security/modules/gds_security_audit_role/inline_policies.tf, commit 122e78d1c6477825b22dd52f32e185a4a7838683
+# Licence: MIT
+#
+# TF031 fires on both aws_iam_policy_document data sources (resources = ["*"]).
+# The two aws_iam_role_policy resources name those documents' .json and are
+# not reported again.
+#
+# Copyright (c) 2018 Government Digital Service
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+data "aws_iam_policy_document" "support_inline_policy_document" {
+  statement {
+    effect    = "Allow"
+    actions   = ["support:*"]
+    resources = ["*"]
+  }
+}
+
+resource "aws_iam_role_policy" "support_inline_policy" {
+  name   = "${var.prefix}GDSSecurityAuditInlineSupportPolicy"
+  role   = aws_iam_role.gds_security_audit_role.id
+  policy = data.aws_iam_policy_document.support_inline_policy_document.json
+}
+
+data "aws_iam_policy_document" "sts_inline_policy_document" {
+  statement {
+    effect    = "Allow"
+    actions   = ["sts:GetCallerIdentity"]
+    resources = ["*"]
+  }
+}
+
+resource "aws_iam_role_policy" "sts_inline_policy" {
+  name   = "${var.prefix}GDSSecurityAuditInlineSTSPolicy"
+  role   = aws_iam_role.gds_security_audit_role.id
+  policy = data.aws_iam_policy_document.sts_inline_policy_document.json
+}
+