ROSAENG-57757 | feat: add trust_policy_external_id to account-iam-resources

Inject optional sts:ExternalId into installer and support account role trust
policies, expose module input/output, and regenerate module documentation.

Part of ROSA-786.

Signed-off-by: michaelryanmcneill <michael@michaelryanmcneill.com>

Author: michaelryanmcneill

modules/account-iam-resources/README.md

@@ -71,6 +71,7 @@ module "account_iam_resources" {
 | <a name="input_path"></a> [path](#input\_path) | The ARN path for the account/operator roles as well as their policies. | `string` | `"/"` | no |
 | <a name="input_permissions_boundary"></a> [permissions\_boundary](#input\_permissions\_boundary) | The ARN of the policy that is used to set the permissions boundary for the IAM roles in STS clusters. | `string` | `""` | no |
 | <a name="input_tags"></a> [tags](#input\_tags) | List of AWS resource tags to apply. | `map(string)` | `null` | no |
+| <a name="input_trust_policy_external_id"></a> [trust\_policy\_external\_id](#input\_trust\_policy\_external\_id) | External ID for trust policy condition in installer and support account roles. | `string` | `null` | no |
 
 ## Outputs
 
@@ -80,4 +81,5 @@ module "account_iam_resources" {
 | <a name="output_account_roles_arn"></a> [account\_roles\_arn](#output\_account\_roles\_arn) | A map of Amazon Resource Names (ARNs) associated with the AWS IAM roles created. The key in the map represents the name of an AWS IAM role, while the corresponding value represents the associated Amazon Resource Name (ARN) of that role. |
 | <a name="output_openshift_version"></a> [openshift\_version](#output\_openshift\_version) | The Openshift cluster version of the cluster those account roles are used for. |
 | <a name="output_path"></a> [path](#output\_path) | The arn path for the account/operator roles as well as their policies. |
+| <a name="output_trust_policy_external_id"></a> [trust\_policy\_external\_id](#output\_trust\_policy\_external\_id) | External ID for trust policy condition in account roles |
 <!-- END_AUTOMATED_TF_DOCS_BLOCK -->

modules/account-iam-resources/main.tf

@@ -4,13 +4,17 @@
 locals {
   path                    = coalesce(var.path, "/")
   short_openshift_version = format("%s.%s", split(".", var.openshift_version)[0], split(".", var.openshift_version)[1])
+  trust_policy_external_id = (
+    var.trust_policy_external_id != null && var.trust_policy_external_id != ""
+  ) ? var.trust_policy_external_id : null
   account_roles_properties = [
     {
       role_name            = "Installer"
       role_type            = "installer"
       policy_details       = data.rhcs_policies.all_policies.account_role_policies["sts_installer_permission_policy"]
       principal_type       = "AWS"
       principal_identifier = "arn:${data.aws_partition.current.partition}:iam::${data.rhcs_info.current.ocm_aws_account_id}:role/RH-Managed-OpenShift-Installer"
+      external_id          = local.trust_policy_external_id
     },
     {
       role_name      = "Support"
@@ -19,20 +23,23 @@ locals {
       principal_type = "AWS"
       // This is a SRE RH Support role which is used to assume this support role
       principal_identifier = data.rhcs_policies.all_policies.account_role_policies["sts_support_rh_sre_role"]
+      external_id          = local.trust_policy_external_id
     },
     {
       role_name            = "Worker"
       role_type            = "instance_worker"
       policy_details       = data.rhcs_policies.all_policies.account_role_policies["sts_instance_worker_permission_policy"]
       principal_type       = "Service"
       principal_identifier = "ec2.amazonaws.com"
+      external_id          = null
     },
     {
       role_name            = "ControlPlane"
       role_type            = "instance_controlplane"
       policy_details       = data.rhcs_policies.all_policies.account_role_policies["sts_instance_controlplane_permission_policy"]
       principal_type       = "Service"
       principal_identifier = "ec2.amazonaws.com"
+      external_id          = null
     }
   ]
   account_roles_count = null_resource.validate_openshift_version != null ? length(local.account_roles_properties) : 0
@@ -59,6 +66,15 @@ data "aws_iam_policy_document" "custom_trust_policy" {
       type        = local.account_roles_properties[count.index].principal_type
       identifiers = [local.account_roles_properties[count.index].principal_identifier]
     }
+
+    dynamic "condition" {
+      for_each = local.account_roles_properties[count.index].external_id != null ? [1] : []
+      content {
+        test     = "StringEquals"
+        variable = "sts:ExternalId"
+        values   = [local.account_roles_properties[count.index].external_id]
+      }
+    }
   }
 }
 
@@ -140,11 +156,12 @@ resource "time_sleep" "account_iam_resources_wait" {
   destroy_duration = "10s"
   create_duration  = "10s"
   triggers = {
-    account_iam_role_name = jsonencode([for value in aws_iam_role_policy_attachment.role_policy_attachment : value.role])
-    account_roles_arn     = jsonencode({ for idx, value in module.account_iam_role : local.account_roles_properties[idx].role_name => value.iam_role_arn })
-    account_role_prefix   = local.account_role_prefix_valid
-    openshift_version     = var.openshift_version
-    path                  = var.path
+    account_iam_role_name    = jsonencode([for value in aws_iam_role_policy_attachment.role_policy_attachment : value.role])
+    account_roles_arn        = jsonencode({ for idx, value in module.account_iam_role : local.account_roles_properties[idx].role_name => value.iam_role_arn })
+    account_role_prefix      = local.account_role_prefix_valid
+    openshift_version        = var.openshift_version
+    path                     = var.path
+    trust_policy_external_id = local.trust_policy_external_id
   }
 }
 

modules/account-iam-resources/outputs.tf

@@ -20,3 +20,8 @@ output "path" {
   value       = time_sleep.account_iam_resources_wait.triggers["path"]
   description = "The arn path for the account/operator roles as well as their policies."
 }
+
+output "trust_policy_external_id" {
+  value       = time_sleep.account_iam_resources_wait.triggers["trust_policy_external_id"]
+  description = "External ID for trust policy condition in account roles"
+}

modules/account-iam-resources/variables.tf

@@ -29,3 +29,9 @@ variable "tags" {
   default     = null
   description = "List of AWS resource tags to apply."
 }
+
+variable "trust_policy_external_id" {
+  type        = string
+  default     = null
+  description = "External ID for trust policy condition in installer and support account roles."
+}