From 02056b2d76eaee2d04f80260d759e30cc0e31517 Mon Sep 17 00:00:00 2001
From: "Sven (AAMOS AI)" <sven@wavult.com>
Date: Tue, 11 Aug 2026 21:33:45 +0700
Subject: [PATCH] infra: add least-privilege iam role and instance profile

---
 infrastructure/terraform/iam.tf | 79 +++++++++++++++++++++++++++++++++
 1 file changed, 79 insertions(+)
 create mode 100644 infrastructure/terraform/iam.tf

diff --git a/infrastructure/terraform/iam.tf b/infrastructure/terraform/iam.tf
new file mode 100644
index 0000000..ce04013
--- /dev/null
+++ b/infrastructure/terraform/iam.tf
@@ -0,0 +1,79 @@
+resource "aws_iam_role" "app" {
+  name = "cibello-app"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = "sts:AssumeRole"
+        Effect = "Allow"
+        Principal = {
+          Service = "ec2.amazonaws.com"
+        }
+      }
+    ]
+  })
+
+  tags = {
+    Name = "cibello-app"
+  }
+}
+
+resource "aws_iam_role_policy" "app" {
+  name = "cibello-app-policy"
+  role = aws_iam_role.app.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid    = "AllowProductionS3"
+        Effect = "Allow"
+        Action = [
+          "s3:ListBucket",
+          "s3:GetObject",
+          "s3:PutObject",
+          "s3:DeleteObject"
+        ]
+        Resource = [
+          aws_s3_bucket.production.arn,
+          "${aws_s3_bucket.production.arn}/*"
+        ]
+      },
+      {
+        Sid    = "AllowSSMParameters"
+        Effect = "Allow"
+        Action = [
+          "ssm:GetParameter",
+          "ssm:GetParameters",
+          "ssm:GetParametersByPath"
+        ]
+        Resource = "arn:aws:ssm:eu-north-1:${data.aws_caller_identity.current.account_id}:parameter/cibello/prod/*"
+      },
+      {
+        Sid    = "AllowKMSDecrypt"
+        Effect = "Allow"
+        Action = [
+          "kms:Decrypt",
+          "kms:GenerateDataKey"
+        ]
+        Resource = "*"
+      }
+    ]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "app_ssm" {
+  role       = aws_iam_role.app.name
+  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
+}
+
+resource "aws_iam_instance_profile" "app" {
+  name = "cibello-prod-app-profile"
+  role = aws_iam_role.app.name
+  tags = {
+    Name = "cibello-prod-app-profile"
+  }
+}
+
+data "aws_caller_identity" "current" {}