Skip to content

Commit 8af6d28

Browse files
enverEnver Cicakbryantbiggssirantdenver-multibank
authored
fix: Add missing locals in iam-assumable-role module (#290)
Co-authored-by: Enver Cicak <[email protected]> Co-authored-by: Bryant Biggs <[email protected]> Co-authored-by: Dmytro Sirant <[email protected]> Co-authored-by: Enver Cicak <[email protected]> Co-authored-by: Anton Babenko <[email protected]>
1 parent 23b50cb commit 8af6d28

File tree

21 files changed

+171
-13
lines changed

21 files changed

+171
-13
lines changed

‎examples/iam-assumable-role-with-oidc/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ No providers.
3131
| Name | Source | Version |
3232
|------|--------|---------|
3333
| <a name="module_iam_assumable_role_admin"></a> [iam\_assumable\_role\_admin](#module\_iam\_assumable\_role\_admin) | ../../modules/iam-assumable-role-with-oidc | n/a |
34+
| <a name="module_iam_assumable_role_self_assume"></a> [iam\_assumable\_role\_self\_assume](#module\_iam\_assumable\_role\_self\_assume) | ../../modules/iam-assumable-role-with-oidc | n/a |
3435

3536
## Resources
3637

‎examples/iam-assumable-role-with-oidc/main.tf

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,3 +25,28 @@ module "iam_assumable_role_admin" {
2525

2626
oidc_fully_qualified_subjects = ["system:serviceaccount:default:sa1", "system:serviceaccount:default:sa2"]
2727
}
28+
29+
#####################################
30+
# IAM assumable role with self assume
31+
#####################################
32+
module "iam_assumable_role_self_assume" {
33+
source = "../../modules/iam-assumable-role-with-oidc"
34+
35+
create_role = true
36+
allow_self_assume_role = true
37+
38+
role_name = "role-with-oidc-self-assume"
39+
40+
tags = {
41+
Role = "role-with-oidc-self-assume"
42+
}
43+
44+
provider_url = "oidc.eks.eu-west-1.amazonaws.com/id/BA9E170D464AF7B92084EF72A69B9DC8"
45+
provider_urls = ["oidc.eks.eu-west-1.amazonaws.com/id/AA9E170D464AF7B92084EF72A69B9DC8"]
46+
47+
role_policy_arns = [
48+
"arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
49+
]
50+
51+
oidc_fully_qualified_subjects = ["system:serviceaccount:default:sa1", "system:serviceaccount:default:sa2"]
52+
}

‎examples/iam-assumable-role-with-saml/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ Run `terraform destroy` when you don't need these resources.
3333
| Name | Source | Version |
3434
|------|--------|---------|
3535
| <a name="module_iam_assumable_role_admin"></a> [iam\_assumable\_role\_admin](#module\_iam\_assumable\_role\_admin) | ../../modules/iam-assumable-role-with-saml | n/a |
36+
| <a name="module_iam_assumable_role_self_assume"></a> [iam\_assumable\_role\_self\_assume](#module\_iam\_assumable\_role\_self\_assume) | ../../modules/iam-assumable-role-with-saml | n/a |
3637

3738
## Resources
3839

‎examples/iam-assumable-role-with-saml/main.tf

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,3 +33,26 @@ module "iam_assumable_role_admin" {
3333
"arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
3434
]
3535
}
36+
37+
#####################################
38+
# IAM assumable role with self assume
39+
#####################################
40+
module "iam_assumable_role_self_assume" {
41+
source = "../../modules/iam-assumable-role-with-saml"
42+
43+
create_role = true
44+
allow_self_assume_role = true
45+
46+
role_name = "role-with-saml-self-assume"
47+
48+
tags = {
49+
Role = "role-with-saml-self-assume"
50+
}
51+
52+
provider_id = aws_iam_saml_provider.idp_saml.id
53+
provider_ids = [aws_iam_saml_provider.second_idp_saml.id]
54+
55+
role_policy_arns = [
56+
"arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
57+
]
58+
}

‎examples/iam-assumable-roles-with-saml/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ Run `terraform destroy` when you don't need these resources.
3535
| <a name="module_iam_assumable_roles_with_saml"></a> [iam\_assumable\_roles\_with\_saml](#module\_iam\_assumable\_roles\_with\_saml) | ../../modules/iam-assumable-roles-with-saml | n/a |
3636
| <a name="module_iam_assumable_roles_with_saml_custom"></a> [iam\_assumable\_roles\_with\_saml\_custom](#module\_iam\_assumable\_roles\_with\_saml\_custom) | ../../modules/iam-assumable-roles-with-saml | n/a |
3737
| <a name="module_iam_assumable_roles_with_saml_second_provider"></a> [iam\_assumable\_roles\_with\_saml\_second\_provider](#module\_iam\_assumable\_roles\_with\_saml\_second\_provider) | ../../modules/iam-assumable-roles-with-saml | n/a |
38+
| <a name="module_iam_assumable_roles_with_saml_with_self_assume"></a> [iam\_assumable\_roles\_with\_saml\_with\_self\_assume](#module\_iam\_assumable\_roles\_with\_saml\_with\_self\_assume) | ../../modules/iam-assumable-roles-with-saml | n/a |
3839

3940
## Resources
4041

‎examples/iam-assumable-roles-with-saml/main.tf

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,9 @@ module "iam_assumable_roles_with_saml_second_provider" {
3939
create_admin_role = true
4040

4141
create_poweruser_role = true
42-
poweruser_role_name = "developer"
42+
admin_role_name = "Admin-Role-Name"
43+
poweruser_role_name = "Poweruser-Role-Name"
44+
readonly_role_name = "Readonly-Role-Name"
4345

4446
create_readonly_role = true
4547

@@ -58,3 +60,20 @@ module "iam_assumable_roles_with_saml_custom" {
5860

5961
provider_id = aws_iam_saml_provider.idp_saml.id
6062
}
63+
64+
################################################
65+
# IAM assumable roles with SAML with self assume
66+
################################################
67+
module "iam_assumable_roles_with_saml_with_self_assume" {
68+
source = "../../modules/iam-assumable-roles-with-saml"
69+
70+
create_admin_role = true
71+
allow_self_assume_role = true
72+
create_poweruser_role = true
73+
admin_role_name = "Admin-Role-Name-Self-Assume"
74+
poweruser_role_name = "Poweruser-Role-Name-Self-Assume"
75+
readonly_role_name = "Readonly-Role-Name-Self-Assume"
76+
create_readonly_role = true
77+
78+
provider_id = aws_iam_saml_provider.idp_saml.id
79+
}

‎examples/iam-assumable-roles/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ No providers.
3131
| Name | Source | Version |
3232
|------|--------|---------|
3333
| <a name="module_iam_assumable_roles"></a> [iam\_assumable\_roles](#module\_iam\_assumable\_roles) | ../../modules/iam-assumable-roles | n/a |
34+
| <a name="module_iam_assumable_roles_with_self_assume"></a> [iam\_assumable\_roles\_with\_self\_assume](#module\_iam\_assumable\_roles\_with\_self\_assume) | ../../modules/iam-assumable-roles | n/a |
3435

3536
## Resources
3637

‎examples/iam-assumable-roles/main.tf

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,3 +26,30 @@ module "iam_assumable_roles" {
2626
create_readonly_role = true
2727
readonly_role_requires_mfa = false
2828
}
29+
30+
######################################
31+
# IAM assumable roles with self assume
32+
######################################
33+
module "iam_assumable_roles_with_self_assume" {
34+
source = "../../modules/iam-assumable-roles"
35+
36+
trusted_role_arns = [
37+
"arn:aws:iam::307990089504:root",
38+
"arn:aws:iam::835367859851:user/anton",
39+
]
40+
41+
trusted_role_services = [
42+
"codedeploy.amazonaws.com"
43+
]
44+
45+
create_admin_role = true
46+
allow_self_assume_role = true
47+
create_poweruser_role = true
48+
admin_role_name = "Admin-Role-Name-Self-Assume"
49+
poweruser_role_name = "Billing-And-Support-Access-Self-Assume"
50+
poweruser_role_policy_arns = ["arn:aws:iam::aws:policy/job-function/Billing", "arn:aws:iam::aws:policy/AWSSupportAccess"]
51+
readonly_role_name = "Read-Only-Role-Name-Self-Assume"
52+
53+
create_readonly_role = true
54+
readonly_role_requires_mfa = false
55+
}

‎examples/iam-eks-role/README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,13 +36,14 @@ Run `terraform destroy` when you don't need these resources.
3636
|------|--------|---------|
3737
| <a name="module_eks"></a> [eks](#module\_eks) | terraform-aws-modules/eks/aws | ~> 18.0 |
3838
| <a name="module_iam_eks_role"></a> [iam\_eks\_role](#module\_iam\_eks\_role) | ../../modules/iam-eks-role | n/a |
39+
| <a name="module_iam_eks_role_with_self_assume"></a> [iam\_eks\_role\_with\_self\_assume](#module\_iam\_eks\_role\_with\_self\_assume) | ../../modules/iam-eks-role | n/a |
3940

4041
## Resources
4142

4243
| Name | Type |
4344
|------|------|
4445
| [random_pet.this](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/pet) | resource |
45-
| [aws_subnet_ids.all](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/subnet_ids) | data source |
46+
| [aws_subnets.all](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/subnets) | data source |
4647
| [aws_vpc.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc) | data source |
4748

4849
## Inputs

‎examples/iam-eks-role/main.tf

Lines changed: 27 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,27 @@ module "iam_eks_role" {
1919
}
2020
}
2121

22+
###############################
23+
# IAM EKS role with self assume
24+
###############################
25+
module "iam_eks_role_with_self_assume" {
26+
source = "../../modules/iam-eks-role"
27+
role_name = "my-app-self-assume"
28+
29+
allow_self_assume_role = true
30+
cluster_service_accounts = {
31+
(random_pet.this.id) = ["default:my-app"]
32+
}
33+
34+
tags = {
35+
Name = "eks-role"
36+
}
37+
38+
role_policy_arns = {
39+
AmazonEKS_CNI_Policy = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
40+
}
41+
}
42+
2243
##################
2344
# Extra resources
2445
##################
@@ -35,7 +56,7 @@ module "eks" {
3556
cluster_version = "1.21"
3657

3758
vpc_id = data.aws_vpc.default.id
38-
subnet_ids = data.aws_subnet_ids.all.ids
59+
subnet_ids = data.aws_subnets.all.ids
3960
}
4061

4162
##################################################################
@@ -46,6 +67,9 @@ data "aws_vpc" "default" {
4667
default = true
4768
}
4869

49-
data "aws_subnet_ids" "all" {
50-
vpc_id = data.aws_vpc.default.id
70+
data "aws_subnets" "all" {
71+
filter {
72+
name = "vpc-id"
73+
values = [data.aws_vpc.default.id]
74+
}
5175
}

‎modules/iam-assumable-role-with-oidc/main.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
locals {
22
aws_account_id = var.aws_account_id != "" ? var.aws_account_id : data.aws_caller_identity.current.account_id
3+
partition = data.aws_partition.current.partition
34
# clean URLs of https:// prefix
45
urls = [
56
for url in compact(distinct(concat(var.provider_urls, [var.provider_url]))) :
@@ -32,7 +33,7 @@ data "aws_iam_policy_document" "assume_role_with_oidc" {
3233
condition {
3334
test = "ArnLike"
3435
variable = "aws:PrincipalArn"
35-
values = ["arn:${local.partition}:iam::${local.account_id}:role${var.role_path}${local.role_name_condition}"]
36+
values = ["arn:${local.partition}:iam::${data.aws_caller_identity.current.account_id}:role${var.role_path}${local.role_name_condition}"]
3637
}
3738
}
3839
}

‎modules/iam-assumable-role-with-saml/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,9 @@ No modules.
2929
|------|------|
3030
| [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
3131
| [aws_iam_role_policy_attachment.custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
32+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
3233
| [aws_iam_policy_document.assume_role_with_saml](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
34+
| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
3335

3436
## Inputs
3537

‎modules/iam-assumable-role-with-saml/main.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
1+
data "aws_caller_identity" "current" {}
2+
data "aws_partition" "current" {}
3+
14
locals {
5+
account_id = data.aws_caller_identity.current.account_id
26
identifiers = compact(distinct(concat(var.provider_ids, [var.provider_id])))
37
number_of_role_policy_arns = coalesce(var.number_of_role_policy_arns, length(var.role_policy_arns))
8+
partition = data.aws_partition.current.partition
49
role_name_condition = var.role_name != null ? var.role_name : "${var.role_name_prefix}*"
510
}
611

‎modules/iam-assumable-role/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,10 @@ No modules.
3232
| [aws_iam_role_policy_attachment.custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
3333
| [aws_iam_role_policy_attachment.poweruser](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
3434
| [aws_iam_role_policy_attachment.readonly](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
35+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
3536
| [aws_iam_policy_document.assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
3637
| [aws_iam_policy_document.assume_role_with_mfa](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
38+
| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
3739

3840
## Inputs
3941

‎modules/iam-assumable-role/main.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
1+
data "aws_caller_identity" "current" {}
2+
data "aws_partition" "current" {}
3+
14
locals {
5+
account_id = data.aws_caller_identity.current.account_id
6+
partition = data.aws_partition.current.partition
27
role_sts_externalid = flatten([var.role_sts_externalid])
38
role_name_condition = var.role_name != null ? var.role_name : "${var.role_name_prefix}*"
49
}

‎modules/iam-assumable-roles-with-saml/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,9 @@ No modules.
3434
| [aws_iam_role_policy_attachment.admin](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
3535
| [aws_iam_role_policy_attachment.poweruser](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
3636
| [aws_iam_role_policy_attachment.readonly](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
37+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
3738
| [aws_iam_policy_document.assume_role_with_saml](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
39+
| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
3840

3941
## Inputs
4042

‎modules/iam-assumable-roles-with-saml/main.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
1+
data "aws_caller_identity" "current" {}
2+
data "aws_partition" "current" {}
3+
14
locals {
5+
account_id = data.aws_caller_identity.current.account_id
26
identifiers = compact(distinct(concat(var.provider_ids, [var.provider_id])))
7+
partition = data.aws_partition.current.partition
38
}
49

510
data "aws_iam_policy_document" "assume_role_with_saml" {

‎modules/iam-assumable-roles/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,10 @@ No modules.
3232
| [aws_iam_role_policy_attachment.admin](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
3333
| [aws_iam_role_policy_attachment.poweruser](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
3434
| [aws_iam_role_policy_attachment.readonly](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
35+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
3536
| [aws_iam_policy_document.assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
3637
| [aws_iam_policy_document.assume_role_with_mfa](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
38+
| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
3739

3840
## Inputs
3941

‎modules/iam-assumable-roles/main.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,11 @@
1+
data "aws_caller_identity" "current" {}
2+
data "aws_partition" "current" {}
3+
4+
locals {
5+
account_id = data.aws_caller_identity.current.account_id
6+
partition = data.aws_partition.current.partition
7+
}
8+
19
data "aws_iam_policy_document" "assume_role" {
210
dynamic "statement" {
311
# https://aws.amazon.com/blogs/security/announcing-an-update-to-iam-role-trust-policy-behavior/

‎modules/iam-eks-role/main.tf

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@ data "aws_caller_identity" "current" {}
22
data "aws_partition" "current" {}
33

44
locals {
5+
account_id = data.aws_caller_identity.current.account_id
6+
partition = data.aws_partition.current.partition
57
role_name_condition = var.role_name != null ? var.role_name : "${var.role_name_prefix}*"
68
}
79

@@ -45,7 +47,7 @@ data "aws_iam_policy_document" "assume_role_with_oidc" {
4547
type = "Federated"
4648

4749
identifiers = [
48-
"arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:oidc-provider/${replace(data.aws_eks_cluster.main[statement.key].identity[0].oidc[0].issuer, "https://", "")}"
50+
"arn:${local.partition}:iam::${local.account_id}:oidc-provider/${replace(data.aws_eks_cluster.main[statement.key].identity[0].oidc[0].issuer, "https://", "")}"
4951
]
5052
}
5153

‎modules/iam-group-with-policies/policies.tf

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ data "aws_partition" "current" {}
66

77
locals {
88
aws_account_id = try(data.aws_caller_identity.current[0].account_id, var.aws_account_id)
9+
partition = data.aws_partition.current.partition
910
}
1011

1112
data "aws_iam_policy_document" "iam_self_management" {
@@ -40,9 +41,9 @@ data "aws_iam_policy_document" "iam_self_management" {
4041

4142
# Allow for both users with "path" and without it
4243
resources = [
43-
"arn:${data.aws_partition.current.partition}:iam::${local.aws_account_id}:user/*/$${aws:username}",
44-
"arn:${data.aws_partition.current.partition}:iam::${local.aws_account_id}:user/$${aws:username}",
45-
"arn:${data.aws_partition.current.partition}:iam::${local.aws_account_id}:mfa/$${aws:username}",
44+
"arn:${local.partition}:iam::${local.aws_account_id}:user/*/$${aws:username}",
45+
"arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}",
46+
"arn:${local.partition}:iam::${local.aws_account_id}:mfa/$${aws:username}",
4647
]
4748
}
4849

@@ -70,9 +71,9 @@ data "aws_iam_policy_document" "iam_self_management" {
7071

7172
# Allow for both users with "path" and without it
7273
resources = [
73-
"arn:${data.aws_partition.current.partition}:iam::${local.aws_account_id}:user/*/$${aws:username}",
74-
"arn:${data.aws_partition.current.partition}:iam::${local.aws_account_id}:user/$${aws:username}",
75-
"arn:${data.aws_partition.current.partition}:iam::${local.aws_account_id}:mfa/$${aws:username}",
74+
"arn:${local.partition}:iam::${local.aws_account_id}:user/*/$${aws:username}",
75+
"arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}",
76+
"arn:${local.partition}:iam::${local.aws_account_id}:mfa/$${aws:username}",
7677
]
7778

7879
condition {

0 commit comments

Comments
 (0)