ROSAENG-57757 | feat: add trust_policy_external_id to account-iam-resources

Inject optional sts:ExternalId into installer and support account role trust
policies, expose module input/output, and regenerate module documentation.

Part of ROSA-786.

Signed-off-by: michaelryanmcneill <michael@michaelryanmcneill.com>

Author: michaelryanmcneill

modules/account-iam-resources/README.md

@@ -56,7 +56,6 @@ module "account_iam_resources" {
 | [null_resource.validate_openshift_version](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
 | [random_string.default_random](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
 | [time_sleep.account_iam_resources_wait](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
-| [aws_iam_policy_document.custom_trust_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
 | [rhcs_info.current](https://registry.terraform.io/providers/terraform-redhat/rhcs/latest/docs/data-sources/info) | data source |
 | [rhcs_policies.all_policies](https://registry.terraform.io/providers/terraform-redhat/rhcs/latest/docs/data-sources/policies) | data source |
@@ -71,13 +70,16 @@ module "account_iam_resources" {
 | <a name="input_path"></a> [path](#input\_path) | The ARN path for the account/operator roles as well as their policies. | `string` | `"/"` | no |
 | <a name="input_permissions_boundary"></a> [permissions\_boundary](#input\_permissions\_boundary) | The ARN of the policy that is used to set the permissions boundary for the IAM roles in STS clusters. | `string` | `""` | no |
 | <a name="input_tags"></a> [tags](#input\_tags) | List of AWS resource tags to apply. | `map(string)` | `null` | no |
+| <a name="input_trust_policy_external_id"></a> [trust\_policy\_external\_id](#input\_trust\_policy\_external\_id) | External ID for trust policy condition in installer and support account roles. | `string` | `null` | no |
 
 ## Outputs
 
 | Name | Description |
 | ---- | ----------- |
 | <a name="output_account_role_prefix"></a> [account\_role\_prefix](#output\_account\_role\_prefix) | The prefix used for all generated AWS resources. |
 | <a name="output_account_roles_arn"></a> [account\_roles\_arn](#output\_account\_roles\_arn) | A map of Amazon Resource Names (ARNs) associated with the AWS IAM roles created. The key in the map represents the name of an AWS IAM role, while the corresponding value represents the associated Amazon Resource Name (ARN) of that role. |
+| <a name="output_custom_trust_policy_json"></a> [custom\_trust\_policy\_json](#output\_custom\_trust\_policy\_json) | Rendered IAM trust policy JSON for each account role (Installer, Support, Worker, ControlPlane order). |
 | <a name="output_openshift_version"></a> [openshift\_version](#output\_openshift\_version) | The Openshift cluster version of the cluster those account roles are used for. |
 | <a name="output_path"></a> [path](#output\_path) | The arn path for the account/operator roles as well as their policies. |
+| <a name="output_trust_policy_external_id"></a> [trust\_policy\_external\_id](#output\_trust\_policy\_external\_id) | External ID for trust policy condition in account roles |
 <!-- END_AUTOMATED_TF_DOCS_BLOCK -->

modules/account-iam-resources/main.tf

@@ -4,13 +4,17 @@
 locals {
   path                    = coalesce(var.path, "/")
   short_openshift_version = format("%s.%s", split(".", var.openshift_version)[0], split(".", var.openshift_version)[1])
+  trust_policy_external_id = (
+    var.trust_policy_external_id != null && var.trust_policy_external_id != ""
+  ) ? var.trust_policy_external_id : null
   account_roles_properties = [
     {
       role_name            = "Installer"
       role_type            = "installer"
       policy_details       = data.rhcs_policies.all_policies.account_role_policies["sts_installer_permission_policy"]
       principal_type       = "AWS"
       principal_identifier = "arn:${data.aws_partition.current.partition}:iam::${data.rhcs_info.current.ocm_aws_account_id}:role/RH-Managed-OpenShift-Installer"
+      external_id          = local.trust_policy_external_id
     },
     {
       role_name      = "Support"
@@ -19,24 +23,30 @@ locals {
       principal_type = "AWS"
       // This is a SRE RH Support role which is used to assume this support role
       principal_identifier = data.rhcs_policies.all_policies.account_role_policies["sts_support_rh_sre_role"]
+      external_id          = local.trust_policy_external_id
     },
     {
       role_name            = "Worker"
       role_type            = "instance_worker"
       policy_details       = data.rhcs_policies.all_policies.account_role_policies["sts_instance_worker_permission_policy"]
       principal_type       = "Service"
       principal_identifier = "ec2.amazonaws.com"
+      external_id          = null
     },
     {
       role_name            = "ControlPlane"
       role_type            = "instance_controlplane"
       policy_details       = data.rhcs_policies.all_policies.account_role_policies["sts_instance_controlplane_permission_policy"]
       principal_type       = "Service"
       principal_identifier = "ec2.amazonaws.com"
+      external_id          = null
     }
   ]
   account_roles_count = null_resource.validate_openshift_version != null ? length(local.account_roles_properties) : 0
-  patch_version_list  = [for s in data.rhcs_versions.all_versions.items : s.name]
+  patch_version_list = distinct(concat(
+    [for s in data.rhcs_versions.all_versions.items : s.name],
+    try([data.rhcs_versions.all_versions.item.name], []),
+  ))
   minor_version_list = length(local.patch_version_list) > 0 ? (
     distinct([for s in local.patch_version_list : format("%s.%s", split(".", s)[0], split(".", s)[1])])
     ) : (
@@ -47,19 +57,31 @@ locals {
     ) : (
     "account-role-${random_string.default_random[0].result}"
   )
-}
-
-data "aws_iam_policy_document" "custom_trust_policy" {
-  count = local.account_roles_count
-
-  statement {
-    effect  = "Allow"
-    actions = ["sts:AssumeRole"]
-    principals {
-      type        = local.account_roles_properties[count.index].principal_type
-      identifiers = [local.account_roles_properties[count.index].principal_identifier]
-    }
-  }
+  custom_trust_policy_json = [
+    for idx in range(local.account_roles_count) : jsonencode({
+      Version = "2012-10-17"
+      Statement = [
+        merge(
+          {
+            Effect = "Allow"
+            Action = "sts:AssumeRole"
+            Principal = local.account_roles_properties[idx].principal_type == "AWS" ? {
+              AWS = local.account_roles_properties[idx].principal_identifier
+            } : {
+              Service = local.account_roles_properties[idx].principal_identifier
+            }
+          },
+          local.account_roles_properties[idx].external_id != null ? {
+            Condition = {
+              StringEquals = {
+                "sts:ExternalId" = local.account_roles_properties[idx].external_id
+              }
+            }
+          } : {}
+        )
+      ]
+    })
+  ]
 }
 
 module "account_iam_role" {
@@ -77,7 +99,7 @@ module "account_iam_role" {
   role_permissions_boundary_arn = var.permissions_boundary
 
   create_custom_role_trust_policy = true
-  custom_role_trust_policy        = data.aws_iam_policy_document.custom_trust_policy[count.index].json
+  custom_role_trust_policy        = local.custom_trust_policy_json[count.index]
 
   tags = merge(var.tags, {
     red-hat-managed        = true
@@ -140,11 +162,12 @@ resource "time_sleep" "account_iam_resources_wait" {
   destroy_duration = "10s"
   create_duration  = "10s"
   triggers = {
-    account_iam_role_name = jsonencode([for value in aws_iam_role_policy_attachment.role_policy_attachment : value.role])
-    account_roles_arn     = jsonencode({ for idx, value in module.account_iam_role : local.account_roles_properties[idx].role_name => value.iam_role_arn })
-    account_role_prefix   = local.account_role_prefix_valid
-    openshift_version     = var.openshift_version
-    path                  = var.path
+    account_iam_role_name    = jsonencode([for value in aws_iam_role_policy_attachment.role_policy_attachment : value.role])
+    account_roles_arn        = jsonencode({ for idx, value in module.account_iam_role : local.account_roles_properties[idx].role_name => value.iam_role_arn })
+    account_role_prefix      = local.account_role_prefix_valid
+    openshift_version        = var.openshift_version
+    path                     = var.path
+    trust_policy_external_id = local.trust_policy_external_id
   }
 }
 

modules/account-iam-resources/outputs.tf

@@ -20,3 +20,13 @@ output "path" {
   value       = time_sleep.account_iam_resources_wait.triggers["path"]
   description = "The arn path for the account/operator roles as well as their policies."
 }
+
+output "trust_policy_external_id" {
+  value       = time_sleep.account_iam_resources_wait.triggers["trust_policy_external_id"]
+  description = "External ID for trust policy condition in account roles"
+}
+
+output "custom_trust_policy_json" {
+  value       = local.custom_trust_policy_json
+  description = "Rendered IAM trust policy JSON for each account role (Installer, Support, Worker, ControlPlane order)."
+}