airbnb / airbnb/streamalert

iam role creation fails with longer prefix + cluster names

Open
#427 3 comments 0 reactions 1 assignee Claimed by @securityclippy View on GitHub
Dominant language
Python
Stars
2.9k
Forks
324
PR merge metrics
No merged PRs in 30d

Description

## Background

During infrastructure creation, if the length of the prefix + the length of the cluster + "streamalert_rule_processor_role" is > 64 chars, the terraform build will fail due to the character limit on IAM roles.

This exists because of the way everything is joined upon creation in the terraform vars

###
```
streamalert/terraform/modules/tf_stream_alert/iam.tf
```

```
// IAM Role: Rule Processor Execution Role
resource "aws_iam_role" "streamalert_rule_processor_role" {
name = "${var.prefix}_${var.cluster}_streamalert_rule_processor_role"

assume_role_policy = "${data.aws_iam_policy_document.lambda_assume_role_policy.json}"
}
```

## Desired Change

There are several ways around this. However, I think the best option would be to add a check upon creation of the prefix as well as on initial run of the init scripts. Because this fails a good way through the infrastructure creation, rollback can be rather frustrating when terraform errors out. Rather than getting through 80% of the deploy and then finding the error, I think it would be good to perform a "pre-flight" length check on the described variables.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.