Organize GitHub Actions OIDC IAM policy Sids

Divide policy Sids (statement IDs) into list, read, and write actions as
classified in the service authorization reference.

https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsidentityandaccessmanagementiam.html

Author: br3ndonland

README.md

@@ -14,106 +14,119 @@ In addition to this module, see other implementations from [Cloud Posse](https:/
 
 Authentication is required for the AWS provider so that OpenTofu can apply configurations. The [IAM best practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) recommend granting least privilege.
 
-<details><summary>Here are the minimum required permissions for running this module <em>(expand)</em>. Adjust the resource names as needed.</summary>
+<details><summary>Here are the minimum required permissions for running this module <em>(expand)</em>. Adjust the resource names as needed. Policy Sids (statement IDs) are organized by access level based on the <a href="https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsidentityandaccessmanagementiam.html">Service Authorization Reference</a>.</summary>
 
 ```json
 {
   "Version": "2012-10-17",
   "Statement": [
     {
-      "Sid": "IAMOIDCProviderProvisioningActions",
-      "Effect": "Allow",
       "Action": [
-        "iam:AddClientIDToOpenIDConnectProvider",
-        "iam:CreateOpenIDConnectProvider",
-        "iam:TagOpenIDConnectProvider",
-        "iam:UpdateOpenIDConnectProviderThumbprint"
+        "iam:ListOpenIDConnectProviders",
+        "iam:ListOpenIDConnectProviderTags"
       ],
-      "Resource": [
-        "arn:aws:iam::*:oidc-provider/token.actions.githubusercontent.com"
-      ]
+      "Effect": "Allow",
+      "Resource": ["*"],
+      "Sid": "IAMOIDCProviderListActions"
     },
     {
-      "Sid": "IAMOIDCProviderReadActions",
+      "Action": ["iam:GetOpenIDConnectProvider"],
       "Effect": "Allow",
+      "Resource": ["*"],
+      "Sid": "IAMOIDCProviderReadActions"
+    },
+    {
       "Action": [
-        "iam:GetOpenIDConnectProvider",
-        "iam:ListOpenIDConnectProviders",
-        "iam:ListOpenIDConnectProviderTags"
+        "iam:TagOpenIDConnectProvider",
+        "iam:UntagOpenIDConnectProvider"
       ],
-      "Resource": ["*"]
+      "Effect": "Allow",
+      "Resource": [
+        "arn:aws:iam::*:oidc-provider/token.actions.githubusercontent.com"
+      ],
+      "Sid": "IAMOIDCProviderTaggingActions"
     },
     {
-      "Sid": "IAMOIDCProviderCleanupActions",
-      "Effect": "Allow",
       "Action": [
+        "iam:AddClientIDToOpenIDConnectProvider",
+        "iam:CreateOpenIDConnectProvider",
         "iam:DeleteOpenIDConnectProvider",
         "iam:RemoveClientIDFromOpenIDConnectProvider",
-        "iam:UntagOpenIDConnectProvider"
+        "iam:UpdateOpenIDConnectProviderThumbprint"
       ],
+      "Effect": "Allow",
       "Resource": [
         "arn:aws:iam::*:oidc-provider/token.actions.githubusercontent.com"
-      ]
+      ],
+      "Sid": "IAMOIDCProviderWriteActions"
     },
     {
-      "Sid": "IAMRoleProvisioningActions",
-      "Effect": "Allow",
       "Action": [
-        "iam:AttachRolePolicy",
-        "iam:CreateRole",
-        "iam:PutRolePolicy",
-        "iam:UpdateRole",
-        "iam:UpdateRoleDescription",
-        "iam:UpdateAssumeRolePolicy"
+        "iam:ListEntitiesForPolicy",
+        "iam:ListPolicies",
+        "iam:ListPolicyVersions",
+        "iam:ListUserPolicies"
       ],
-      "Resource": ["arn:aws:iam::*:role/github*"]
+      "Effect": "Allow",
+      "Resource": ["*"],
+      "Sid": "IAMPolicyListActions"
+    },
+    {
+      "Action": ["iam:GetPolicy", "iam:GetPolicyVersion"],
+      "Effect": "Allow",
+      "Resource": ["*"],
+      "Sid": "IAMPolicyReadActions"
     },
     {
-      "Sid": "IAMRoleReadActions",
+      "Action": [
+        "iam:CreatePolicy",
+        "iam:CreatePolicyVersion",
+        "iam:DeletePolicy",
+        "iam:DeletePolicyVersion"
+      ],
       "Effect": "Allow",
+      "Resource": ["arn:aws:iam::*:policy/github*"],
+      "Sid": "IAMPolicyPermissionsManagementActions"
+    },
+    {
       "Action": [
-        "iam:GetRole",
         "iam:ListAttachedRolePolicies",
         "iam:ListInstanceProfilesForRole",
         "iam:ListRolePolicies",
         "iam:ListRoles"
       ],
-      "Resource": ["*"]
+      "Effect": "Allow",
+      "Resource": ["*"],
+      "Sid": "IAMRoleListActions"
     },
     {
-      "Sid": "IAMRoleCleanupActions",
+      "Action": ["iam:GetRole", "iam:GetRolePolicy"],
       "Effect": "Allow",
+      "Resource": ["*"],
+      "Sid": "IAMRoleReadActions"
+    },
+    {
       "Action": [
-        "iam:DeleteRole",
+        "iam:AttachRolePolicy",
         "iam:DeleteRolePolicy",
-        "iam:DetachRolePolicy"
+        "iam:DetachRolePolicy",
+        "iam:PutRolePolicy",
+        "iam:UpdateAssumeRolePolicy"
       ],
-      "Resource": ["arn:aws:iam::*:role/github*"]
-    },
-    {
-      "Sid": "IAMPolicyProvisioningActions",
       "Effect": "Allow",
-      "Action": ["iam:CreatePolicy", "iam:CreatePolicyVersion"],
-      "Resource": ["arn:aws:iam::*:policy/github*"]
+      "Resource": ["arn:aws:iam::*:role/github*"],
+      "Sid": "IAMRolePermissionsManagementActions"
     },
     {
-      "Sid": "IAMPolicyReadActions",
-      "Effect": "Allow",
       "Action": [
-        "iam:GetPolicy",
-        "iam:GetPolicyVersion",
-        "iam:ListEntitiesForPolicy",
-        "iam:ListPolicies",
-        "iam:ListPolicyVersions",
-        "iam:ListUserPolicies"
+        "iam:CreateRole",
+        "iam:DeleteRole",
+        "iam:UpdateRole",
+        "iam:UpdateRoleDescription"
       ],
-      "Resource": ["*"]
-    },
-    {
-      "Sid": "IAMPolicyCleanupActions",
+      "Resource": ["arn:aws:iam::*:role/github*"],
       "Effect": "Allow",
-      "Action": ["iam:DeletePolicy", "iam:DeletePolicyVersion"],
-      "Resource": ["arn:aws:iam::*:policy/github*"]
+      "Sid": "IAMRoleWriteActions"
     }
   ]
 }