Include TagSession privilege for assumed roles. (#189)

Add privileges to be compatible with GitHub AWS Auth action

Author: jgadling

aws-iam-group-assume-role/main.tf

@@ -26,7 +26,7 @@ data "aws_iam_policy_document" "assume-role" {
   statement {
     sid       = "assume0"
     resources = local.account_arns
-    actions   = ["sts:AssumeRole"]
+    actions   = ["sts:AssumeRole", "sts:TagSession"]
   }
 }
 

aws-iam-role-crossacct/main.tf

@@ -6,7 +6,7 @@ data "aws_iam_policy_document" "assume-role" {
         type        = "AWS"
         identifiers = ["arn:aws:iam::${statement.value}:root"]
       }
-      actions = ["sts:AssumeRole"]
+      actions = ["sts:AssumeRole", "sts:TagSession"]
     }
   }
 
@@ -17,7 +17,7 @@ data "aws_iam_policy_document" "assume-role" {
         type        = "AWS"
         identifiers = ["arn:aws:iam::${statement.value}:root"]
       }
-      actions = ["sts:AssumeRole"]
+      actions = ["sts:AssumeRole", "sts:TagSession"]
     }
   }
 
@@ -29,7 +29,7 @@ data "aws_iam_policy_document" "assume-role" {
         identifiers = [statement.value]
       }
 
-      actions = ["sts:AssumeRoleWithSAML"]
+      actions = ["sts:AssumeRoleWithSAML", "sts:TagSession"]
 
       condition {
         test     = "StringEquals"
@@ -49,7 +49,7 @@ data "aws_iam_policy_document" "assume-role" {
         identifiers = [oidc.value["idp_arn"]]
       }
 
-      actions = ["sts:AssumeRoleWithWebIdentity"]
+      actions = ["sts:AssumeRoleWithWebIdentity", "sts:TagSession"]
       condition {
         test     = "StringEquals"
         variable = "${oidc.value["provider"]}:aud"