Merge pull request #149 from michaelryanmcneill/ROSA-786

ROSAENG-57757 | feat: add trust_policy_external_id to account-iam-resources

Author: openshift-merge-bot[bot]

modules/account-iam-resources/README.md

@@ -56,7 +56,6 @@ module "account_iam_resources" {
 | [null_resource.validate_openshift_version](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
 | [random_string.default_random](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
 | [time_sleep.account_iam_resources_wait](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
-| [aws_iam_policy_document.custom_trust_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
 | [rhcs_info.current](https://registry.terraform.io/providers/terraform-redhat/rhcs/latest/docs/data-sources/info) | data source |
 | [rhcs_policies.all_policies](https://registry.terraform.io/providers/terraform-redhat/rhcs/latest/docs/data-sources/policies) | data source |
@@ -71,6 +70,7 @@ module "account_iam_resources" {
 | <a name="input_path"></a> [path](#input\_path) | The ARN path for the account/operator roles as well as their policies. | `string` | `"/"` | no |
 | <a name="input_permissions_boundary"></a> [permissions\_boundary](#input\_permissions\_boundary) | The ARN of the policy that is used to set the permissions boundary for the IAM roles in STS clusters. | `string` | `""` | no |
 | <a name="input_tags"></a> [tags](#input\_tags) | List of AWS resource tags to apply. | `map(string)` | `null` | no |
+| <a name="input_trust_policy_external_id"></a> [trust\_policy\_external\_id](#input\_trust\_policy\_external\_id) | External ID for trust policy condition in installer and support account roles. | `string` | `null` | no |
 
 ## Outputs
 
@@ -80,4 +80,5 @@ module "account_iam_resources" {
 | <a name="output_account_roles_arn"></a> [account\_roles\_arn](#output\_account\_roles\_arn) | A map of Amazon Resource Names (ARNs) associated with the AWS IAM roles created. The key in the map represents the name of an AWS IAM role, while the corresponding value represents the associated Amazon Resource Name (ARN) of that role. |
 | <a name="output_openshift_version"></a> [openshift\_version](#output\_openshift\_version) | The Openshift cluster version of the cluster those account roles are used for. |
 | <a name="output_path"></a> [path](#output\_path) | The arn path for the account/operator roles as well as their policies. |
+| <a name="output_trust_policy_external_id"></a> [trust\_policy\_external\_id](#output\_trust\_policy\_external\_id) | External ID for trust policy condition in account roles |
 <!-- END_AUTOMATED_TF_DOCS_BLOCK -->

modules/account-iam-resources/main.tf

@@ -4,13 +4,17 @@
 locals {
   path                    = coalesce(var.path, "/")
   short_openshift_version = format("%s.%s", split(".", var.openshift_version)[0], split(".", var.openshift_version)[1])
+  trust_policy_external_id = (
+    var.trust_policy_external_id != null && var.trust_policy_external_id != ""
+  ) ? var.trust_policy_external_id : null
   account_roles_properties = [
     {
       role_name            = "Installer"
       role_type            = "installer"
       policy_details       = data.rhcs_policies.all_policies.account_role_policies["sts_installer_permission_policy"]
       principal_type       = "AWS"
       principal_identifier = "arn:${data.aws_partition.current.partition}:iam::${data.rhcs_info.current.ocm_aws_account_id}:role/RH-Managed-OpenShift-Installer"
+      external_id          = local.trust_policy_external_id
     },
     {
       role_name      = "Support"
@@ -19,24 +23,31 @@ locals {
       principal_type = "AWS"
       // This is a SRE RH Support role which is used to assume this support role
       principal_identifier = data.rhcs_policies.all_policies.account_role_policies["sts_support_rh_sre_role"]
+      external_id          = local.trust_policy_external_id
     },
     {
       role_name            = "Worker"
       role_type            = "instance_worker"
       policy_details       = data.rhcs_policies.all_policies.account_role_policies["sts_instance_worker_permission_policy"]
       principal_type       = "Service"
       principal_identifier = "ec2.amazonaws.com"
+      external_id          = null
     },
     {
       role_name            = "ControlPlane"
       role_type            = "instance_controlplane"
       policy_details       = data.rhcs_policies.all_policies.account_role_policies["sts_instance_controlplane_permission_policy"]
       principal_type       = "Service"
       principal_identifier = "ec2.amazonaws.com"
+      external_id          = null
     }
   ]
   account_roles_count = null_resource.validate_openshift_version != null ? length(local.account_roles_properties) : 0
-  patch_version_list  = [for s in data.rhcs_versions.all_versions.items : s.name]
+  # terraform test cannot mock ListNested attributes (items) reliably; fall back to singular item.
+  patch_version_list = distinct(concat(
+    try([for s in data.rhcs_versions.all_versions.items : s.name], []),
+    try([data.rhcs_versions.all_versions.item.name], []),
+  ))
   minor_version_list = length(local.patch_version_list) > 0 ? (
     distinct([for s in local.patch_version_list : format("%s.%s", split(".", s)[0], split(".", s)[1])])
     ) : (
@@ -47,19 +58,32 @@ locals {
     ) : (
     "account-role-${random_string.default_random[0].result}"
   )
-}
-
-data "aws_iam_policy_document" "custom_trust_policy" {
-  count = local.account_roles_count
-
-  statement {
-    effect  = "Allow"
-    actions = ["sts:AssumeRole"]
-    principals {
-      type        = local.account_roles_properties[count.index].principal_type
-      identifiers = [local.account_roles_properties[count.index].principal_identifier]
-    }
-  }
+  # Hand-rolled jsonencode instead of aws_iam_policy_document for terraform test compatibility.
+  custom_trust_policy_json = [
+    for idx in range(local.account_roles_count) : jsonencode({
+      Version = "2012-10-17"
+      Statement = [
+        merge(
+          {
+            Effect = "Allow"
+            Action = "sts:AssumeRole"
+            Principal = local.account_roles_properties[idx].principal_type == "AWS" ? {
+              AWS = local.account_roles_properties[idx].principal_identifier
+              } : {
+              Service = local.account_roles_properties[idx].principal_identifier
+            }
+          },
+          local.account_roles_properties[idx].external_id != null ? {
+            Condition = {
+              StringEquals = {
+                "sts:ExternalId" = local.account_roles_properties[idx].external_id
+              }
+            }
+          } : {}
+        )
+      ]
+    })
+  ]
 }
 
 module "account_iam_role" {
@@ -77,7 +101,7 @@ module "account_iam_role" {
   role_permissions_boundary_arn = var.permissions_boundary
 
   create_custom_role_trust_policy = true
-  custom_role_trust_policy        = data.aws_iam_policy_document.custom_trust_policy[count.index].json
+  custom_role_trust_policy        = local.custom_trust_policy_json[count.index]
 
   tags = merge(var.tags, {
     red-hat-managed        = true
@@ -140,11 +164,12 @@ resource "time_sleep" "account_iam_resources_wait" {
   destroy_duration = "10s"
   create_duration  = "10s"
   triggers = {
-    account_iam_role_name = jsonencode([for value in aws_iam_role_policy_attachment.role_policy_attachment : value.role])
-    account_roles_arn     = jsonencode({ for idx, value in module.account_iam_role : local.account_roles_properties[idx].role_name => value.iam_role_arn })
-    account_role_prefix   = local.account_role_prefix_valid
-    openshift_version     = var.openshift_version
-    path                  = var.path
+    account_iam_role_name    = jsonencode([for value in aws_iam_role_policy_attachment.role_policy_attachment : value.role])
+    account_roles_arn        = jsonencode({ for idx, value in module.account_iam_role : local.account_roles_properties[idx].role_name => value.iam_role_arn })
+    account_role_prefix      = local.account_role_prefix_valid
+    openshift_version        = var.openshift_version
+    path                     = var.path
+    trust_policy_external_id = local.trust_policy_external_id != null ? local.trust_policy_external_id : ""
   }
 }
 

modules/account-iam-resources/outputs.tf

@@ -20,3 +20,12 @@ output "path" {
   value       = time_sleep.account_iam_resources_wait.triggers["path"]
   description = "The arn path for the account/operator roles as well as their policies."
 }
+
+output "trust_policy_external_id" {
+  value = (
+    time_sleep.account_iam_resources_wait.triggers["trust_policy_external_id"] != ""
+    ? time_sleep.account_iam_resources_wait.triggers["trust_policy_external_id"]
+    : null
+  )
+  description = "External ID for trust policy condition in account roles"
+}