Installer permissions v1.0

.github/workflows/installer_permissions_template.yml

@@ -0,0 +1,30 @@
+name: Installer Permissions Template
+on:
+  push:
+    branches: [main]
+jobs:
+  publish:
+    name: ${{ matrix.region }}
+    strategy:
+      matrix:
+        include:
+          - region: us-west-2
+            aws-account-id: "080825576347"
+            aws-partition: aws
+          - region: us-gov-west-1
+            aws-account-id: "282774566237"
+            aws-partition: aws-us-gov
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:${{ matrix.aws-partition }}:iam::${{ matrix.aws-account-id }}:role/GitHubActionsHotsockInstallerPermissionsTemplatesRole
+          aws-region: ${{ matrix.region }}
+      - uses: actions/checkout@v4
+      - run: |
+          aws s3 cp \
+            installer-permissions.yml \
+            s3://hotsock-stack-templates-${{ matrix.region }}/installer-permissions.yml

LICENSE

@@ -0,0 +1,20 @@
+Copyright (c) JK Tech, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

README.md

@@ -0,0 +1,14 @@
+# Hotsock Installer Permissions
+
+This repository contains the permissions CloudFormation template used [during Hotsock installation](https://www.hotsock.io/docs/installation/initial-setup/#installer-permissions-stack).
+
+It is provided here for easy auditability and change history.
+
+## Included Resources
+
+When creating a stack with the [installer-permissions.yml](./installer-permissions.yml) template, the following resources will be created in your AWS account.
+
+- **`HotsockInstallerRole`**: IAM role that allows CloudFormation to manage Hotsock installations with appropriate permissions. It grants IAM role and policy management permissions within the `/hotsock/` IAM path and grants permissions in the `HotsockMaximumPermissions` managed policy described below.
+- **`HotsockSupportRole`**: IAM role that can allow Hotsock support staff to access your account to triage issues upon your request. **Access is denied by default** with an expired date condition in the assume role trust relationship, which must be set to a date in the future to grant access.
+- **`HotsockLicensingRole`**: IAM role that allows Hotsock to perform licensing operations and collect usage data for installation metering.
+- **`HotsockMaximumPermissions`**: IAM managed policy that specifies the maximum permissions needed for Hotsock, used to grant permissions to `HotsockInstallerRole` and `HotsockSupportRole` and used as the mandatory [Permissions Boundary](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html) for all roles created by `HotsockInstallerRole`.