Skip to content

Commit ad5358d

Browse files
tcharewicztcharewicz
committed
Set variable trusted_role_actions as a "Actions of STS"
1 parent 0a9230d commit ad5358d

File tree

12 files changed

+18
-18
lines changed

12 files changed

+18
-18
lines changed

‎modules/iam-assumable-role-with-saml/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ No modules.
5252
| <a name="input_role_permissions_boundary_arn"></a> [role\_permissions\_boundary\_arn](#input\_role\_permissions\_boundary\_arn) | Permissions boundary ARN to use for IAM role | `string` | `""` | no |
5353
| <a name="input_role_policy_arns"></a> [role\_policy\_arns](#input\_role\_policy\_arns) | List of ARNs of IAM policies to attach to IAM role | `list(string)` | `[]` | no |
5454
| <a name="input_tags"></a> [tags](#input\_tags) | A map of tags to add to IAM role resources | `map(string)` | `{}` | no |
55-
| <a name="input_trusted_role_actions"></a> [trusted\_role\_actions](#input\_trusted\_role\_actions) | Extra Actions of STS | `list(string)` | <pre>[<br> ""<br>]</pre> | no |
55+
| <a name="input_trusted_role_actions"></a> [trusted\_role\_actions](#input\_trusted\_role\_actions) | Actions of STS | `list(string)` | <pre>[<br> "sts:AssumeRoleWithSAML"<br>]</pre> | no |
5656

5757
## Outputs
5858

‎modules/iam-assumable-role-with-saml/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ data "aws_iam_policy_document" "assume_role_with_saml" {
3434

3535
statement {
3636
effect = "Allow"
37-
actions = compact(distinct(concat(["sts:AssumeRoleWithSAML"], var.trusted_role_actions)))
37+
actions = var.trusted_role_actions
3838

3939
principals {
4040
type = "Federated"

‎modules/iam-assumable-role-with-saml/variables.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ variable "allow_self_assume_role" {
8989
}
9090

9191
variable "trusted_role_actions" {
92-
description = "Extra Actions of STS"
92+
description = "Actions of STS"
9393
type = list(string)
94-
default = [""]
94+
default = ["sts:AssumeRoleWithSAML"]
9595
}

‎modules/iam-assumable-role/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ No modules.
6666
| <a name="input_role_session_name"></a> [role\_session\_name](#input\_role\_session\_name) | role\_session\_name for roles which require this parameter when being assumed. By default, you need to set your own username as role\_session\_name | `list(string)` | <pre>[<br> "${aws:username}"<br>]</pre> | no |
6767
| <a name="input_role_sts_externalid"></a> [role\_sts\_externalid](#input\_role\_sts\_externalid) | STS ExternalId condition values to use with a role (when MFA is not required) | `any` | `[]` | no |
6868
| <a name="input_tags"></a> [tags](#input\_tags) | A map of tags to add to IAM role resources | `map(string)` | `{}` | no |
69-
| <a name="input_trusted_role_actions"></a> [trusted\_role\_actions](#input\_trusted\_role\_actions) | Extra Actions of STS | `list(string)` | <pre>[<br> ""<br>]</pre> | no |
69+
| <a name="input_trusted_role_actions"></a> [trusted\_role\_actions](#input\_trusted\_role\_actions) | Actions of STS | `list(string)` | <pre>[<br> "sts:AssumeRole"<br>]</pre> | no |
7070
| <a name="input_trusted_role_arns"></a> [trusted\_role\_arns](#input\_trusted\_role\_arns) | ARNs of AWS entities who can assume these roles | `list(string)` | `[]` | no |
7171
| <a name="input_trusted_role_services"></a> [trusted\_role\_services](#input\_trusted\_role\_services) | AWS Services that can assume these roles | `list(string)` | `[]` | no |
7272

‎modules/iam-assumable-role/main.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ data "aws_iam_policy_document" "assume_role" {
3535

3636
statement {
3737
effect = "Allow"
38-
actions = compact(distinct(concat(["sts:AssumeRole"], var.trusted_role_actions)))
38+
actions = var.trusted_role_actions
3939

4040
principals {
4141
type = "AWS"
@@ -85,7 +85,7 @@ data "aws_iam_policy_document" "assume_role_with_mfa" {
8585

8686
statement {
8787
effect = "Allow"
88-
actions = compact(distinct(concat(["sts:AssumeRole"], var.trusted_role_actions)))
88+
actions = var.trusted_role_actions
8989

9090
principals {
9191
type = "AWS"

‎modules/iam-assumable-role/variables.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
variable "trusted_role_actions" {
2-
description = "Extra Actions of STS"
2+
description = "Actions of STS"
33
type = list(string)
4-
default = [""]
4+
default = ["sts:AssumeRole"]
55
}
66

77
variable "trusted_role_arns" {

‎modules/iam-assumable-roles-with-saml/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ No modules.
6666
| <a name="input_readonly_role_permissions_boundary_arn"></a> [readonly\_role\_permissions\_boundary\_arn](#input\_readonly\_role\_permissions\_boundary\_arn) | Permissions boundary ARN to use for readonly role | `string` | `""` | no |
6767
| <a name="input_readonly_role_policy_arns"></a> [readonly\_role\_policy\_arns](#input\_readonly\_role\_policy\_arns) | List of policy ARNs to use for readonly role | `list(string)` | <pre>[<br> "arn:aws:iam::aws:policy/ReadOnlyAccess"<br>]</pre> | no |
6868
| <a name="input_readonly_role_tags"></a> [readonly\_role\_tags](#input\_readonly\_role\_tags) | A map of tags to add to readonly role resource. | `map(string)` | `{}` | no |
69-
| <a name="input_trusted_role_actions"></a> [trusted\_role\_actions](#input\_trusted\_role\_actions) | Extra Actions of STS | `list(string)` | <pre>[<br> ""<br>]</pre> | no |
69+
| <a name="input_trusted_role_actions"></a> [trusted\_role\_actions](#input\_trusted\_role\_actions) | Actions of STS | `list(string)` | <pre>[<br> "sts:AssumeRoleWithSAML"<br>]</pre> | no |
7070

7171
## Outputs
7272

‎modules/iam-assumable-roles-with-saml/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ data "aws_iam_policy_document" "assume_role_with_saml" {
7777
statement {
7878
effect = "Allow"
7979

80-
actions = compact(distinct(concat(["sts:AssumeRoleWithSAML"], var.trusted_role_actions)))
80+
actions = var.trusted_role_actions
8181

8282
principals {
8383
type = "Federated"

‎modules/iam-assumable-roles-with-saml/variables.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,9 @@ variable "allow_self_assume_role" {
2323
}
2424

2525
variable "trusted_role_actions" {
26-
description = "Extra Actions of STS"
26+
description = "Actions of STS"
2727
type = list(string)
28-
default = [""]
28+
default = ["sts:AssumeRoleWithSAML"]
2929
}
3030

3131
# Admin

‎modules/iam-assumable-roles/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ No modules.
6666
| <a name="input_readonly_role_policy_arns"></a> [readonly\_role\_policy\_arns](#input\_readonly\_role\_policy\_arns) | List of policy ARNs to use for readonly role | `list(string)` | <pre>[<br> "arn:aws:iam::aws:policy/ReadOnlyAccess"<br>]</pre> | no |
6767
| <a name="input_readonly_role_requires_mfa"></a> [readonly\_role\_requires\_mfa](#input\_readonly\_role\_requires\_mfa) | Whether readonly role requires MFA | `bool` | `true` | no |
6868
| <a name="input_readonly_role_tags"></a> [readonly\_role\_tags](#input\_readonly\_role\_tags) | A map of tags to add to readonly role resource. | `map(string)` | `{}` | no |
69-
| <a name="input_trusted_role_actions"></a> [trusted\_role\_actions](#input\_trusted\_role\_actions) | Extra Actions of STS | `list(string)` | <pre>[<br> ""<br>]</pre> | no |
69+
| <a name="input_trusted_role_actions"></a> [trusted\_role\_actions](#input\_trusted\_role\_actions) | Actions of STS | `list(string)` | <pre>[<br> "sts:AssumeRole"<br>]</pre> | no |
7070
| <a name="input_trusted_role_arns"></a> [trusted\_role\_arns](#input\_trusted\_role\_arns) | ARNs of AWS entities who can assume these roles | `list(string)` | `[]` | no |
7171
| <a name="input_trusted_role_services"></a> [trusted\_role\_services](#input\_trusted\_role\_services) | AWS Services that can assume these roles | `list(string)` | `[]` | no |
7272

‎modules/iam-assumable-roles/main.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ data "aws_iam_policy_document" "assume_role" {
7575

7676
statement {
7777
effect = "Allow"
78-
actions = compact(distinct(concat(["sts:AssumeRole"], var.trusted_role_actions)))
78+
actions = var.trusted_role_actions
7979

8080
principals {
8181
type = "AWS"
@@ -158,7 +158,7 @@ data "aws_iam_policy_document" "assume_role_with_mfa" {
158158

159159
statement {
160160
effect = "Allow"
161-
actions = compact(distinct(concat(["sts:AssumeRole"], var.trusted_role_actions)))
161+
actions = var.trusted_role_actions
162162

163163
principals {
164164
type = "AWS"

‎modules/iam-assumable-roles/variables.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,9 @@ variable "allow_self_assume_role" {
2323
}
2424

2525
variable "trusted_role_actions" {
26-
description = "Extra Actions of STS"
26+
description = "Actions of STS"
2727
type = list(string)
28-
default = [""]
28+
default = ["sts:AssumeRole"]
2929
}
3030

3131
# Admin

0 commit comments

Comments
 (0)