Skip to content

Commit c59aa0e

Browse files
author
Eduardo Lopez
authored
[feature] Adds support for SAML trust relationship to existing roles (#154)
1 parent 8bc7c98 commit c59aa0e

File tree

27 files changed

+345
-88
lines changed

27 files changed

+345
-88
lines changed

‎aws-iam-role-cloudfront-poweruser/README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,8 @@ This module will create a role which is granted poweruser control over AWS Cloud
1010
| iam\_path | | string | `"/"` | no |
1111
| role\_name | Name of the role to create | string | n/a | yes |
1212
| s3\_bucket\_prefixes | Limits role permissions to buckets with specific prefixes. Empty for all buckets. | list | `<list>` | no |
13-
| source\_account\_id | AWS Account that can assume this role. | string | n/a | yes |
13+
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. | string | '' | no |
14+
| saml\_idp\_arn | The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided. | string | '' | no |
1415

1516
## Outputs
1617

‎aws-iam-role-cloudfront-poweruser/main.tf

+25-5
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,31 @@
11
data "aws_iam_policy_document" "assume-role" {
2-
statement {
3-
principals {
4-
type = "AWS"
5-
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
2+
dynamic "statement" {
3+
for_each = compact([var.source_account_id])
4+
content {
5+
principals {
6+
type = "AWS"
7+
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
8+
}
9+
actions = ["sts:AssumeRole"]
610
}
11+
}
12+
13+
dynamic "statement" {
14+
for_each = compact([var.saml_idp_arn])
15+
content {
16+
principals {
17+
type = "Federated"
18+
identifiers = ["${var.saml_idp_arn}"]
19+
}
720

8-
actions = ["sts:AssumeRole"]
21+
actions = ["sts:AssumeRoleWithSAML"]
22+
23+
condition {
24+
test = "StringEquals"
25+
variable = "SAML:aud"
26+
values = ["https://signin.aws.amazon.com/saml"]
27+
}
28+
}
929
}
1030
}
1131

‎aws-iam-role-cloudfront-poweruser/variables.tf

+12-5
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,3 @@
1-
variable "source_account_id" {
2-
type = "string"
3-
description = "AWS Account that can assume this role."
4-
}
5-
61
variable "role_name" {
72
type = "string"
83
description = "Name of the role to create"
@@ -21,3 +16,15 @@ variable "iam_path" {
2116
type = "string"
2217
default = "/"
2318
}
19+
20+
variable "source_account_id" {
21+
type = "string"
22+
default = ""
23+
description = "The source AWS account to establish a trust relationship. Ignored if empty or not provided."
24+
}
25+
26+
variable "saml_idp_arn" {
27+
type = "string"
28+
default = ""
29+
description = "The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided."
30+
}

‎aws-iam-role-crossacct/README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,8 @@ module "group" {
2323
|------|-------------|:----:|:-----:|:-----:|
2424
| iam\_path | The IAM path to put this role in. | string | `"/"` | no |
2525
| role\_name | The name of the role. | string | n/a | yes |
26-
| source\_account\_id | The AWS account id that should be able to assume this role. | string | n/a | yes |
26+
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. | string | '' | no |
27+
| saml\_idp\_arn | The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided. | string | '' | no |
2728

2829
## Outputs
2930

‎aws-iam-role-crossacct/main.tf

+25-5
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,31 @@
11
data "aws_iam_policy_document" "assume-role" {
2-
statement {
3-
principals {
4-
type = "AWS"
5-
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
2+
dynamic "statement" {
3+
for_each = compact([var.source_account_id])
4+
content {
5+
principals {
6+
type = "AWS"
7+
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
8+
}
9+
actions = ["sts:AssumeRole"]
610
}
11+
}
12+
13+
dynamic "statement" {
14+
for_each = compact([var.saml_idp_arn])
15+
content {
16+
principals {
17+
type = "Federated"
18+
identifiers = ["${var.saml_idp_arn}"]
19+
}
720

8-
actions = ["sts:AssumeRole"]
21+
actions = ["sts:AssumeRoleWithSAML"]
22+
23+
condition {
24+
test = "StringEquals"
25+
variable = "SAML:aud"
26+
values = ["https://signin.aws.amazon.com/saml"]
27+
}
28+
}
929
}
1030
}
1131

‎aws-iam-role-crossacct/variables.tf

+8-1
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,13 @@ variable "iam_path" {
99
}
1010

1111
variable "source_account_id" {
12-
description = "The AWS account id that should be able to assume this role."
1312
type = "string"
13+
default = ""
14+
description = "The source AWS account to establish a trust relationship. Ignored if empty or not provided."
15+
}
16+
17+
variable "saml_idp_arn" {
18+
type = "string"
19+
default = ""
20+
description = "The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided."
1421
}

‎aws-iam-role-ec2-poweruser/README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,8 @@ module "ec2-poweruser" {
2525
|------|-------------|:----:|:-----:|:-----:|
2626
| iam\_path | | string | `"/"` | no |
2727
| role\_name | | string | n/a | yes |
28-
| source\_account\_id | | string | n/a | yes |
28+
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. | string | '' | no |
29+
| saml\_idp\_arn | The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided. | string | '' | no |
2930

3031
## Outputs
3132

‎aws-iam-role-ec2-poweruser/main.tf

+25-5
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,31 @@
11
data "aws_iam_policy_document" "assume-role" {
2-
statement {
3-
principals {
4-
type = "AWS"
5-
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
2+
dynamic "statement" {
3+
for_each = compact([var.source_account_id])
4+
content {
5+
principals {
6+
type = "AWS"
7+
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
8+
}
9+
actions = ["sts:AssumeRole"]
610
}
11+
}
12+
13+
dynamic "statement" {
14+
for_each = compact([var.saml_idp_arn])
15+
content {
16+
principals {
17+
type = "Federated"
18+
identifiers = ["${var.saml_idp_arn}"]
19+
}
720

8-
actions = ["sts:AssumeRole"]
21+
actions = ["sts:AssumeRoleWithSAML"]
22+
23+
condition {
24+
test = "StringEquals"
25+
variable = "SAML:aud"
26+
values = ["https://signin.aws.amazon.com/saml"]
27+
}
28+
}
929
}
1030
}
1131

‎aws-iam-role-ec2-poweruser/variables.tf

+12-4
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,3 @@
1-
variable "source_account_id" {
2-
type = "string"
3-
}
4-
51
variable "role_name" {
62
type = "string"
73
}
@@ -10,3 +6,15 @@ variable "iam_path" {
106
type = "string"
117
default = "/"
128
}
9+
10+
variable "source_account_id" {
11+
type = "string"
12+
default = ""
13+
description = "The source AWS account to establish a trust relationship. Ignored if empty or not provided."
14+
}
15+
16+
variable "saml_idp_arn" {
17+
type = "string"
18+
default = ""
19+
description = "The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided."
20+
}

‎aws-iam-role-ecs-poweruser/README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,8 @@ module "ec2-poweruser" {
2424
|------|-------------|:----:|:-----:|:-----:|
2525
| iam\_path | | string | `"/"` | no |
2626
| role\_name | | string | n/a | yes |
27-
| source\_account\_id | | string | n/a | yes |
27+
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. | string | '' | no |
28+
| saml\_idp\_arn | The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided. | string | '' | no |
2829

2930
## Outputs
3031

‎aws-iam-role-ecs-poweruser/main.tf

+25-5
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,31 @@
11
data "aws_iam_policy_document" "assume-role" {
2-
statement {
3-
principals {
4-
type = "AWS"
5-
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
2+
dynamic "statement" {
3+
for_each = compact([var.source_account_id])
4+
content {
5+
principals {
6+
type = "AWS"
7+
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
8+
}
9+
actions = ["sts:AssumeRole"]
610
}
11+
}
12+
13+
dynamic "statement" {
14+
for_each = compact([var.saml_idp_arn])
15+
content {
16+
principals {
17+
type = "Federated"
18+
identifiers = ["${var.saml_idp_arn}"]
19+
}
720

8-
actions = ["sts:AssumeRole"]
21+
actions = ["sts:AssumeRoleWithSAML"]
22+
23+
condition {
24+
test = "StringEquals"
25+
variable = "SAML:aud"
26+
values = ["https://signin.aws.amazon.com/saml"]
27+
}
28+
}
929
}
1030
}
1131

‎aws-iam-role-ecs-poweruser/variables.tf

+12-4
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,3 @@
1-
variable "source_account_id" {
2-
type = "string"
3-
}
4-
51
variable "role_name" {
62
type = "string"
73
}
@@ -10,3 +6,15 @@ variable "iam_path" {
106
type = "string"
117
default = "/"
128
}
9+
10+
variable "source_account_id" {
11+
type = "string"
12+
default = ""
13+
description = "The source AWS account to establish a trust relationship. Ignored if empty or not provided."
14+
}
15+
16+
variable "saml_idp_arn" {
17+
type = "string"
18+
default = ""
19+
description = "The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided."
20+
}

‎aws-iam-role-infraci/README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,9 @@ Creates a role useful for running `terraform plan` in CI jobs.
99
|------|-------------|:----:|:-----:|:-----:|
1010
| iam\_path | | string | `"/"` | no |
1111
| role\_name | | string | `"infraci"` | no |
12-
| source\_account\_id | | string | n/a | yes |
1312
| terraform\_state\_lock\_dynamodb\_arns | "A list of unique identifiers (ARNs) of state file DynamoDB tables" | string | `[]` | yes |
13+
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. | string | '' | no |
14+
| saml\_idp\_arn | The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided. | string | '' | no |
1415

1516
## Outputs
1617

‎aws-iam-role-infraci/main.tf

+25-5
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,31 @@
11
data "aws_iam_policy_document" "assume-role" {
2-
statement {
3-
principals {
4-
type = "AWS"
5-
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
2+
dynamic "statement" {
3+
for_each = compact([var.source_account_id])
4+
content {
5+
principals {
6+
type = "AWS"
7+
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
8+
}
9+
actions = ["sts:AssumeRole"]
610
}
11+
}
712

8-
actions = ["sts:AssumeRole"]
13+
dynamic "statement" {
14+
for_each = compact([var.saml_idp_arn])
15+
content {
16+
principals {
17+
type = "Federated"
18+
identifiers = ["${var.saml_idp_arn}"]
19+
}
20+
21+
actions = ["sts:AssumeRoleWithSAML"]
22+
23+
condition {
24+
test = "StringEquals"
25+
variable = "SAML:aud"
26+
values = ["https://signin.aws.amazon.com/saml"]
27+
}
28+
}
929
}
1030
}
1131

‎aws-iam-role-infraci/variables.tf

+12-4
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,3 @@
1-
variable "source_account_id" {
2-
type = "string"
3-
}
4-
51
variable "role_name" {
62
default = "infraci"
73
}
@@ -15,3 +11,15 @@ variable "terraform_state_lock_dynamodb_arns" {
1511
default = []
1612
description = "ARNs of the state file DynamoDB tables"
1713
}
14+
15+
variable "source_account_id" {
16+
type = "string"
17+
default = ""
18+
description = "The source AWS account to establish a trust relationship. Ignored if empty or not provided."
19+
}
20+
21+
variable "saml_idp_arn" {
22+
type = "string"
23+
default = ""
24+
description = "The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided."
25+
}

‎aws-iam-role-poweruser/README.md

+3-2
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ module "group" {
1111
# defaults to "poweruser"
1212
role_name = "..."
1313
14-
# The id of the other AWS account that can assume this role.
14+
# The id of the other AWS account that can assume this role.
1515
source_account_id = "..."
1616
}
1717
```
@@ -23,7 +23,8 @@ module "group" {
2323
|------|-------------|:----:|:-----:|:-----:|
2424
| iam\_path | | string | `"/"` | no |
2525
| role\_name | | string | `"poweruser"` | no |
26-
| source\_account\_id | | string | n/a | yes |
26+
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. | string | '' | no |
27+
| saml\_idp\_arn | The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided. | string | '' | no |
2728

2829
## Outputs
2930

0 commit comments

Comments
 (0)