IAM et Sécurité

---

1 - Principe du moindre privilège

---

2 - Rôles pour les services Code*

2.1 Rôle CodePipeline

CodePipelineRole:
  Type: AWS::IAM::Role
  Properties:
    RoleName: CodePipelineRole
    AssumeRolePolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: Allow
          Principal:
            Service: codepipeline.amazonaws.com
          Action: sts:AssumeRole
    Policies:
      - PolicyName: CodePipelinePolicy
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - codecommit:GetBranch
                - codecommit:GetCommit
                - codecommit:GetRepository
                - codecommit:GetUploadArchiveStatus
                - codecommit:UploadArchive
                - codecommit:CancelUploadArchive
              Resource: !Sub arn:aws:codecommit:${AWS::Region}:${AWS::AccountId}:*
            - Effect: Allow
              Action:
                - codebuild:StartBuild
                - codebuild:BatchGetBuilds
              Resource: !Sub arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/*
            - Effect: Allow
              Action:
                - codedeploy:CreateDeployment
                - codedeploy:GetDeployment
                - codedeploy:GetDeploymentConfig
                - codedeploy:RegisterApplicationRevision
              Resource: '*'
            - Effect: Allow
              Action:
                - s3:GetObject
                - s3:PutObject
              Resource: !Sub ${ArtifactBucket.Arn}/*
            - Effect: Allow
              Action:
                - iam:PassRole
              Resource: '*'
              Condition:
                StringEquals:
                  iam:PassedToService:
                    - codebuild.amazonaws.com
                    - codedeploy.amazonaws.com
                    - ecs-tasks.amazonaws.com

2.2 Rôle CodeBuild

CodeBuildRole:
  Type: AWS::IAM::Role
  Properties:
    RoleName: CodeBuildRole
    AssumeRolePolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: Allow
          Principal:
            Service: codebuild.amazonaws.com
          Action: sts:AssumeRole
    Policies:
      - PolicyName: CodeBuildPolicy
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            # Logs
            - Effect: Allow
              Action:
                - logs:CreateLogGroup
                - logs:CreateLogStream
                - logs:PutLogEvents
              Resource: !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/*
            # S3 Artifacts
            - Effect: Allow
              Action:
                - s3:GetObject
                - s3:PutObject
              Resource: !Sub ${ArtifactBucket.Arn}/*
            # ECR
            - Effect: Allow
              Action:
                - ecr:GetAuthorizationToken
              Resource: '*'
            - Effect: Allow
              Action:
                - ecr:BatchCheckLayerAvailability
                - ecr:GetDownloadUrlForLayer
                - ecr:BatchGetImage
                - ecr:PutImage
                - ecr:InitiateLayerUpload
                - ecr:UploadLayerPart
                - ecr:CompleteLayerUpload
              Resource: !Sub arn:aws:ecr:${AWS::Region}:${AWS::AccountId}:repository/*
            # Secrets Manager
            - Effect: Allow
              Action:
                - secretsmanager:GetSecretValue
              Resource: !Sub arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:prod/*
            # Parameter Store
            - Effect: Allow
              Action:
                - ssm:GetParameters
                - ssm:GetParameter
              Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/app/*

---

3 - AWS Secrets Manager

3.1 Créer et utiliser des secrets

# Créer un secret
aws secretsmanager create-secret \
    --name prod/database/credentials \
    --secret-string '{"username":"admin","password":"supersecret"}'

# Récupérer un secret
aws secretsmanager get-secret-value \
    --secret-id prod/database/credentials

3.2 Dans CodeBuild

# buildspec.yml
env:
  secrets-manager:
    DB_PASSWORD: prod/database/credentials:password
    API_KEY: prod/api-keys:main

phases:
  build:
    commands:
      - echo "DB Password: $DB_PASSWORD"

3.3 Rotation automatique

DatabaseSecret:
  Type: AWS::SecretsManager::Secret
  Properties:
    Name: prod/database/credentials
    GenerateSecretString:
      SecretStringTemplate: '{"username": "admin"}'
      GenerateStringKey: "password"
      PasswordLength: 32
      ExcludeCharacters: '"@/\'

SecretRotationSchedule:
  Type: AWS::SecretsManager::RotationSchedule
  Properties:
    SecretId: !Ref DatabaseSecret
    RotationLambdaARN: !GetAtt RotationLambda.Arn
    RotationRules:
      AutomaticallyAfterDays: 30

---

4 - Parameter Store

4.1 Stocker des paramètres

# Paramètre standard
aws ssm put-parameter \
    --name "/app/config/api-url" \
    --value "https://api.example.com" \
    --type String

# Paramètre sécurisé (chiffré)
aws ssm put-parameter \
    --name "/app/secrets/api-key" \
    --value "sk-12345" \
    --type SecureString \
    --key-id alias/aws/ssm

4.2 Dans CodeBuild

env:
  parameter-store:
    API_URL: /app/config/api-url
    API_KEY: /app/secrets/api-key

---

5 - VPC et sécurité réseau

5.1 CodeBuild dans un VPC

CodeBuildProject:
  Type: AWS::CodeBuild::Project
  Properties:
    VpcConfig:
      VpcId: !Ref VPC
      Subnets:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
      SecurityGroupIds:
        - !Ref CodeBuildSecurityGroup

CodeBuildSecurityGroup:
  Type: AWS::EC2::SecurityGroup
  Properties:
    GroupDescription: CodeBuild security group
    VpcId: !Ref VPC
    SecurityGroupEgress:
      - IpProtocol: tcp
        FromPort: 443
        ToPort: 443
        CidrIp: 0.0.0.0/0
      - IpProtocol: tcp
        FromPort: 5432
        ToPort: 5432
        DestinationSecurityGroupId: !Ref DatabaseSecurityGroup

---

6 - Audit avec CloudTrail

6.1 Configuration

CloudTrail:
  Type: AWS::CloudTrail::Trail
  Properties:
    TrailName: devops-audit-trail
    S3BucketName: !Ref AuditBucket
    IsMultiRegionTrail: true
    EnableLogFileValidation: true
    IncludeGlobalServiceEvents: true
    EventSelectors:
      - ReadWriteType: All
        IncludeManagementEvents: true
        DataResources:
          - Type: AWS::S3::Object
            Values:
              - !Sub ${ArtifactBucket.Arn}/

6.2 Requêtes CloudTrail Insights

-- Actions CodePipeline
SELECT eventTime, eventName, userIdentity.arn, errorCode
FROM cloudtrail_logs
WHERE eventSource = 'codepipeline.amazonaws.com'
  AND eventTime > date_add('day', -7, now())
ORDER BY eventTime DESC

-- Échecs de déploiement
SELECT eventTime, eventName, errorMessage
FROM cloudtrail_logs
WHERE eventSource = 'codedeploy.amazonaws.com'
  AND errorCode IS NOT NULL

---

7 - Bonnes pratiques sécurité

7.1 Checklist

• Utiliser des rôles IAM (pas d'access keys)
• Appliquer le principe du moindre privilège
• Chiffrer les secrets avec Secrets Manager
• Activer le scan ECR sur push
• Configurer des alarmes sur échecs de sécurité
• Activer CloudTrail pour l'audit
• Utiliser des VPC endpoints pour les services AWS
• Implémenter MFA pour les approbations manuelles

7.2 Conditions IAM avancées

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "codepipeline:StartPipelineExecution",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:PrincipalTag/Team": "DevOps"
        },
        "IpAddress": {
          "aws:SourceIp": ["10.0.0.0/8"]
        }
      }
    }
  ]
}

---

Résumé

Dans ce chapitre, nous avons appris :

• Les rôles IAM pour les services Code*
• L'utilisation de Secrets Manager et Parameter Store
• La configuration VPC pour CodeBuild
• L'audit avec CloudTrail
• Les bonnes pratiques de sécurité

---

Prochaine étape

Dans le prochain chapitre, nous verrons les Bonnes pratiques globales.

→ Chapitre suivant : Bonnes pratiques

---

← Retour à la table des matières