Skip to content

Commit 50ef023

Browse files
mbarrienmbarrien
authored
[feature] aws-iam-role-*: Allow multiple accounts to assume role, deprecate source_account_id (#185)
[feature] aws-iam-role-*: Allow multiple accounts to assume role, deprecate source_account_idAdds a source_account_ids field to aws-iam-role-* modules, which will allow multiple accounts' root to assume role, assuming the user/role in the other accounts allow the role assumption. Either source_account_id or source_account_ids or both work; the intent is to keep backwards compatibility for now, but potentially eliminate source_account_id. Officially document that source_account_id is deprecated.
1 parent 4fcd6f9 commit 50ef023

File tree

30 files changed

+211
-52
lines changed

30 files changed

+211
-52
lines changed

‎aws-iam-role-bless/README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,8 @@ output "..." {
3333
| bless\_lambda\_arns | List of bless lambda arns | `list` | n/a | yes |
3434
| iam\_path | IAM path | `string` | `"/"` | no |
3535
| role\_name | The name for the role | `string` | n/a | yes |
36-
| source\_account\_id | The source aws account id to allow sts:AssumeRole | `string` | n/a | yes |
36+
| source\_account\_id | The source aws account id to allow sts:AssumeRole. DEPRECATED: Please use source\_account\_ids | `string` | n/a | yes |
37+
| source\_account\_ids | The source aws account ids to allow sts:AssumeRole | `set(string)` | `[]` | no |
3738

3839
## Outputs
3940

‎aws-iam-role-bless/main.tf

+4-3
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,8 @@ resource "aws_iam_role_policy" "client" {
1515
module "client" {
1616
source = "../aws-iam-role-crossacct"
1717

18-
role_name = var.role_name
19-
iam_path = var.iam_path
20-
source_account_id = var.source_account_id
18+
role_name = var.role_name
19+
iam_path = var.iam_path
20+
source_account_id = var.source_account_id
21+
source_account_ids = var.source_account_ids
2122
}

‎aws-iam-role-bless/variables.tf

+7-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,13 @@ variable "role_name" {
55

66
variable "source_account_id" {
77
type = string
8-
description = "The source aws account id to allow sts:AssumeRole"
8+
description = "The source aws account id to allow sts:AssumeRole. DEPRECATED: Please use source_account_ids"
9+
}
10+
11+
variable "source_account_ids" {
12+
type = set(string)
13+
default = []
14+
description = "The source aws account ids to allow sts:AssumeRole"
915
}
1016

1117
variable "bless_lambda_arns" {

‎aws-iam-role-cloudfront-poweruser/README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,8 @@ This module will create a role which is granted poweruser control over AWS Cloud
1717
| role\_name | Name of the role to create | `string` | n/a | yes |
1818
| s3\_bucket\_prefixes | Limits role permissions to buckets with specific prefixes. Empty for all buckets. | `list` | <pre>[<br> ""<br>]</pre> | no |
1919
| saml\_idp\_arn | The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided. | `string` | `""` | no |
20-
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. | `string` | `""` | no |
20+
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. DEPRECATED: Please use source\_account\_ids. | `string` | `""` | no |
21+
| source\_account\_ids | The source AWS account IDs to establish a trust relationship. Ignored if empty or not provided. | `set(string)` | `[]` | no |
2122

2223
## Outputs
2324

‎aws-iam-role-cloudfront-poweruser/main.tf

+13-2
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,18 @@ data "aws_iam_policy_document" "assume-role" {
44
content {
55
principals {
66
type = "AWS"
7-
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
7+
identifiers = ["arn:aws:iam::${statement.value}:root"]
8+
}
9+
actions = ["sts:AssumeRole"]
10+
}
11+
}
12+
13+
dynamic "statement" {
14+
for_each = var.source_account_ids
15+
content {
16+
principals {
17+
type = "AWS"
18+
identifiers = ["arn:aws:iam::${statement.value}:root"]
819
}
920
actions = ["sts:AssumeRole"]
1021
}
@@ -15,7 +26,7 @@ data "aws_iam_policy_document" "assume-role" {
1526
content {
1627
principals {
1728
type = "Federated"
18-
identifiers = ["${var.saml_idp_arn}"]
29+
identifiers = [statement.value]
1930
}
2031

2132
actions = ["sts:AssumeRoleWithSAML"]

‎aws-iam-role-cloudfront-poweruser/variables.tf

+7-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,13 @@ variable "iam_path" {
2020
variable "source_account_id" {
2121
type = string
2222
default = ""
23-
description = "The source AWS account to establish a trust relationship. Ignored if empty or not provided."
23+
description = "The source AWS account to establish a trust relationship. Ignored if empty or not provided. DEPRECATED: Please use source_account_ids."
24+
}
25+
26+
variable "source_account_ids" {
27+
type = set(string)
28+
default = []
29+
description = "The source AWS account IDs to establish a trust relationship. Ignored if empty or not provided."
2430
}
2531

2632
variable "saml_idp_arn" {

‎aws-iam-role-crossacct/README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,8 @@ module "group" {
3131
| oidc | A list of AWS OIDC IDPs to establish a trust relationship for this role. | <pre>list(object(<br> {<br> idp_arn : string, # the AWS IAM IDP arn<br> client_ids : list(string), # a list of oidc client ids<br> provider : string # your provider url, such as foo.okta.com<br> }<br> ))</pre> | `[]` | no |
3232
| role\_name | The name of the role. | `string` | n/a | yes |
3333
| saml\_idp\_arn | The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided. | `string` | `""` | no |
34-
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. | `string` | `""` | no |
34+
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. DEPRECATED: Please use source\_account\_ids. | `string` | `""` | no |
35+
| source\_account\_ids | The source AWS account IDs to establish a trust relationship. Ignored if empty or not provided. | `set(string)` | `[]` | no |
3536

3637
## Outputs
3738

‎aws-iam-role-crossacct/main.tf

+13-2
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,18 @@ data "aws_iam_policy_document" "assume-role" {
44
content {
55
principals {
66
type = "AWS"
7-
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
7+
identifiers = ["arn:aws:iam::${statement.value}:root"]
8+
}
9+
actions = ["sts:AssumeRole"]
10+
}
11+
}
12+
13+
dynamic "statement" {
14+
for_each = var.source_account_ids
15+
content {
16+
principals {
17+
type = "AWS"
18+
identifiers = ["arn:aws:iam::${statement.value}:root"]
819
}
920
actions = ["sts:AssumeRole"]
1021
}
@@ -15,7 +26,7 @@ data "aws_iam_policy_document" "assume-role" {
1526
content {
1627
principals {
1728
type = "Federated"
18-
identifiers = ["${var.saml_idp_arn}"]
29+
identifiers = [statement.value]
1930
}
2031

2132
actions = ["sts:AssumeRoleWithSAML"]

‎aws-iam-role-crossacct/variables.tf

+7-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,13 @@ variable "iam_path" {
1111
variable "source_account_id" {
1212
type = string
1313
default = ""
14-
description = "The source AWS account to establish a trust relationship. Ignored if empty or not provided."
14+
description = "The source AWS account to establish a trust relationship. Ignored if empty or not provided. DEPRECATED: Please use source_account_ids."
15+
}
16+
17+
variable "source_account_ids" {
18+
type = set(string)
19+
default = []
20+
description = "The source AWS account IDs to establish a trust relationship. Ignored if empty or not provided."
1521
}
1622

1723
variable "saml_idp_arn" {

‎aws-iam-role-ec2-poweruser/README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,8 @@ module "ec2-poweruser" {
3232
| iam\_path | n/a | `string` | `"/"` | no |
3333
| role\_name | n/a | `string` | n/a | yes |
3434
| saml\_idp\_arn | The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided. | `string` | `""` | no |
35-
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. | `string` | `""` | no |
35+
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. DEPRECATED: Please use source\_account\_ids. | `string` | `""` | no |
36+
| source\_account\_ids | The source AWS account IDs to establish a trust relationship. Ignored if empty or not provided. | `set(string)` | `[]` | no |
3637

3738
## Outputs
3839

‎aws-iam-role-ec2-poweruser/main.tf

+13-2
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,18 @@ data "aws_iam_policy_document" "assume-role" {
44
content {
55
principals {
66
type = "AWS"
7-
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
7+
identifiers = ["arn:aws:iam::${statement.value}:root"]
8+
}
9+
actions = ["sts:AssumeRole"]
10+
}
11+
}
12+
13+
dynamic "statement" {
14+
for_each = var.source_account_ids
15+
content {
16+
principals {
17+
type = "AWS"
18+
identifiers = ["arn:aws:iam::${statement.value}:root"]
819
}
920
actions = ["sts:AssumeRole"]
1021
}
@@ -15,7 +26,7 @@ data "aws_iam_policy_document" "assume-role" {
1526
content {
1627
principals {
1728
type = "Federated"
18-
identifiers = ["${var.saml_idp_arn}"]
29+
identifiers = [statement.value]
1930
}
2031

2132
actions = ["sts:AssumeRoleWithSAML"]

‎aws-iam-role-ec2-poweruser/variables.tf

+7-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,13 @@ variable "iam_path" {
1010
variable "source_account_id" {
1111
type = string
1212
default = ""
13-
description = "The source AWS account to establish a trust relationship. Ignored if empty or not provided."
13+
description = "The source AWS account to establish a trust relationship. Ignored if empty or not provided. DEPRECATED: Please use source_account_ids."
14+
}
15+
16+
variable "source_account_ids" {
17+
type = set(string)
18+
default = []
19+
description = "The source AWS account IDs to establish a trust relationship. Ignored if empty or not provided."
1420
}
1521

1622
variable "saml_idp_arn" {

‎aws-iam-role-ecs-poweruser/README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,8 @@ module "ec2-poweruser" {
3131
| iam\_path | n/a | `string` | `"/"` | no |
3232
| role\_name | n/a | `string` | n/a | yes |
3333
| saml\_idp\_arn | The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided. | `string` | `""` | no |
34-
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. | `string` | `""` | no |
34+
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. DEPRECATED: Please use source\_account\_ids. | `string` | `""` | no |
35+
| source\_account\_ids | The source AWS account IDs to establish a trust relationship. Ignored if empty or not provided. | `set(string)` | `[]` | no |
3536

3637
## Outputs
3738

‎aws-iam-role-ecs-poweruser/main.tf

+13-2
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,18 @@ data "aws_iam_policy_document" "assume-role" {
44
content {
55
principals {
66
type = "AWS"
7-
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
7+
identifiers = ["arn:aws:iam::${statement.value}:root"]
8+
}
9+
actions = ["sts:AssumeRole"]
10+
}
11+
}
12+
13+
dynamic "statement" {
14+
for_each = var.source_account_ids
15+
content {
16+
principals {
17+
type = "AWS"
18+
identifiers = ["arn:aws:iam::${statement.value}:root"]
819
}
920
actions = ["sts:AssumeRole"]
1021
}
@@ -15,7 +26,7 @@ data "aws_iam_policy_document" "assume-role" {
1526
content {
1627
principals {
1728
type = "Federated"
18-
identifiers = ["${var.saml_idp_arn}"]
29+
identifiers = [statement.value]
1930
}
2031

2132
actions = ["sts:AssumeRoleWithSAML"]

‎aws-iam-role-ecs-poweruser/variables.tf

+7-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,13 @@ variable "iam_path" {
1010
variable "source_account_id" {
1111
type = string
1212
default = ""
13-
description = "The source AWS account to establish a trust relationship. Ignored if empty or not provided."
13+
description = "The source AWS account to establish a trust relationship. Ignored if empty or not provided. DEPRECATED: Please use source_account_ids."
14+
}
15+
16+
variable "source_account_ids" {
17+
type = set(string)
18+
default = []
19+
description = "The source AWS account IDs to establish a trust relationship. Ignored if empty or not provided."
1420
}
1521

1622
variable "saml_idp_arn" {

‎aws-iam-role-infraci/README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,8 @@ Creates a role useful for running `terraform plan` in CI jobs.
1616
| iam\_path | n/a | `string` | `"/"` | no |
1717
| role\_name | n/a | `string` | `"infraci"` | no |
1818
| saml\_idp\_arn | The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided. | `string` | `""` | no |
19-
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. | `string` | `""` | no |
19+
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. DEPRECATED: Pleaase use source\_account\_ids. | `string` | `""` | no |
20+
| source\_account\_ids | The source AWS account IDs to establish a trust relationship. Ignored if empty or not provided. | `set(string)` | `[]` | no |
2021
| terraform\_state\_lock\_dynamodb\_arns | ARNs of the state file DynamoDB tables | `list(string)` | `[]` | no |
2122

2223
## Outputs

‎aws-iam-role-infraci/main.tf

+13-2
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,18 @@ data "aws_iam_policy_document" "assume-role" {
44
content {
55
principals {
66
type = "AWS"
7-
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
7+
identifiers = ["arn:aws:iam::${statement.value}:root"]
8+
}
9+
actions = ["sts:AssumeRole"]
10+
}
11+
}
12+
13+
dynamic "statement" {
14+
for_each = var.source_account_ids
15+
content {
16+
principals {
17+
type = "AWS"
18+
identifiers = ["arn:aws:iam::${statement.value}:root"]
819
}
920
actions = ["sts:AssumeRole"]
1021
}
@@ -15,7 +26,7 @@ data "aws_iam_policy_document" "assume-role" {
1526
content {
1627
principals {
1728
type = "Federated"
18-
identifiers = ["${var.saml_idp_arn}"]
29+
identifiers = [statement.value]
1930
}
2031

2132
actions = ["sts:AssumeRoleWithSAML"]

‎aws-iam-role-infraci/variables.tf

+7-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,13 @@ variable "terraform_state_lock_dynamodb_arns" {
1515
variable "source_account_id" {
1616
type = string
1717
default = ""
18-
description = "The source AWS account to establish a trust relationship. Ignored if empty or not provided."
18+
description = "The source AWS account to establish a trust relationship. Ignored if empty or not provided. DEPRECATED: Pleaase use source_account_ids."
19+
}
20+
21+
variable "source_account_ids" {
22+
type = set(string)
23+
default = []
24+
description = "The source AWS account IDs to establish a trust relationship. Ignored if empty or not provided."
1925
}
2026

2127
variable "saml_idp_arn" {

‎aws-iam-role-poweruser/README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,8 @@ module "group" {
3030
| iam\_path | n/a | `string` | `"/"` | no |
3131
| role\_name | n/a | `string` | `"poweruser"` | no |
3232
| saml\_idp\_arn | The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided. | `string` | `""` | no |
33-
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. | `string` | `""` | no |
33+
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. DEPRECATED: Please use source\_account\_ids. | `string` | `""` | no |
34+
| source\_account\_ids | The source AWS account IDs to establish a trust relationship. Ignored if empty or not provided. | `set(string)` | `[]` | no |
3435

3536
## Outputs
3637

‎aws-iam-role-poweruser/main.tf

+13-13
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,18 @@ data "aws_iam_policy_document" "assume-role" {
44
content {
55
principals {
66
type = "AWS"
7-
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
7+
identifiers = ["arn:aws:iam::${statement.value}:root"]
8+
}
9+
actions = ["sts:AssumeRole"]
10+
}
11+
}
12+
13+
dynamic "statement" {
14+
for_each = var.source_account_ids
15+
content {
16+
principals {
17+
type = "AWS"
18+
identifiers = ["arn:aws:iam::${statement.value}:root"]
819
}
920
actions = ["sts:AssumeRole"]
1021
}
@@ -15,7 +26,7 @@ data "aws_iam_policy_document" "assume-role" {
1526
content {
1627
principals {
1728
type = "Federated"
18-
identifiers = ["${var.saml_idp_arn}"]
29+
identifiers = [statement.value]
1930
}
2031

2132
actions = ["sts:AssumeRoleWithSAML"]
@@ -40,17 +51,6 @@ resource "aws_iam_role_policy_attachment" "poweruser" {
4051
policy_arn = "arn:aws:iam::aws:policy/PowerUserAccess"
4152
}
4253

43-
data "aws_iam_policy_document" "poweruser" {
44-
statement {
45-
sid = "misc"
46-
47-
principals {
48-
type = "AWS"
49-
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
50-
}
51-
}
52-
}
53-
5454
# These are extra permissions we're adding that
5555
# the PowerUserAcess policy does not have
5656
data "aws_iam_policy_document" "misc" {

‎aws-iam-role-poweruser/variables.tf

+7-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,13 @@ variable "role_name" {
66
variable "source_account_id" {
77
type = string
88
default = ""
9-
description = "The source AWS account to establish a trust relationship. Ignored if empty or not provided."
9+
description = "The source AWS account to establish a trust relationship. Ignored if empty or not provided. DEPRECATED: Please use source_account_ids."
10+
}
11+
12+
variable "source_account_ids" {
13+
type = set(string)
14+
default = []
15+
description = "The source AWS account IDs to establish a trust relationship. Ignored if empty or not provided."
1016
}
1117

1218
variable "saml_idp_arn" {

‎aws-iam-role-readonly/README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,8 @@ output "role_name" {
3434
| iam\_path | n/a | `string` | `"/"` | no |
3535
| role\_name | n/a | `string` | `"readonly"` | no |
3636
| saml\_idp\_arn | The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided. | `string` | `""` | no |
37-
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. | `string` | `""` | no |
37+
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. DEPRECATED: Please use source\_account\_ids. | `string` | `""` | no |
38+
| source\_account\_ids | The source AWS account IDs to establish a trust relationship. Ignored if empty or not provided. | `set(string)` | `[]` | no |
3839

3940
## Outputs
4041

0 commit comments

Comments
 (0)