Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Add path option to IAM roles created under this module #311

Merged
merged 9 commits into from
Oct 13, 2022

Conversation

sf-walsh
Copy link
Contributor

Description

Add path variable to main.tf for resource aws_iam_role.ecs_task_execution to allow for creating this role under more than the default path /

Motivation and Context

This resolves an issue for accounts that don't allow creation of roles under the default "/" path. Like permissions_boundary the path is needed if governance rules only allow IAM role creation under /mycustomrole/path/

  + resource "aws_iam_role" "ecs_task_execution" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = [
                              + "ssm.amazonaws.com",
                              + "ecs-tasks.amazonaws.com",
                            ]
                        }
                      + Sid       = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "atlantis-ecs-ecs_task_execution"
      + name_prefix           = (known after apply)
      + path                  = "/delegatedadmin/developer/"
      + permissions_boundary  = "arn:aws:iam::<redacted>:policy/cloud/developer-boundary-policy"
      + tags                  = {
          + "Environment" = "dev"
          + "Name"        = "atlantis-ecs"
          + "Owner"       = "myself"
        }
      + tags_all              = {
          + "Environment" = "dev"
          + "Name"        = "atlantis-ecs"
          + "Owner"       = "myself"
        }
      + unique_id             = (known after apply)

      + inline_policy {
          + name   = (known after apply)
          + policy = (known after apply)
        }
    }

Breaking Changes

No

How Has This Been Tested?

  • I have updated at least one of the examples/* to demonstrate and validate my change(s)
  • I have tested and validated these changes using one or more of the provided examples/* projects
  • I have executed pre-commit run -a on my pull request

[Sean Walsh] added 2 commits October 12, 2022 15:32
…ce to allow a path for accounts that need to specify paths over the defaul '/'. Added that variable to variables.tf and tested the deployment with perms boundary and updated path variable set via module in an existing AWS account
@sf-walsh sf-walsh changed the title Add path option to IAM roles created under this module feat: Add path option to IAM roles created under this module Oct 12, 2022
…o options for permsissions boundary and the path variable option added in my previous commit
@antonbabenko
Copy link
Member

@sf-walsh Please fix the failing GH Actions checks.

@sf-walsh
Copy link
Contributor Author

sf-walsh commented Oct 13, 2022

@sf-walsh Please fix the failing GH Actions checks.

@antonbabenko Corrected and pushed with checks passing...

Terraform fmt............................................................Passed
Terraform docs...........................................................Passed

@sf-walsh
Copy link
Contributor Author

@antonbabenko Not sure if you can direct me at what is wrong... i ran the pre-commit on all files, i ran terraform validate manually.

pre-commit run --all-files
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
$ terraform validate
Success! The configuration is valid.

@antonbabenko antonbabenko merged commit fe833a0 into terraform-aws-modules:master Oct 13, 2022
@antonbabenko
Copy link
Member

Thank you @sf-walsh !

antonbabenko pushed a commit that referenced this pull request Oct 13, 2022
## [3.22.0](v3.21.0...v3.22.0) (2022-10-13)

### Features

* Add path option to IAM roles created under this module ([#311](#311)) ([fe833a0](fe833a0))
@antonbabenko
Copy link
Member

This PR is included in version 3.22.0 🎉

@github-actions
Copy link

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Nov 13, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants