feat: Replace dynamic DNS suffix resolution for trusted service endpo…

…ints with static `*.amazonaws.com` (#125) Co-authored-by: Bryant Biggs <bryantbiggs@gmail.com>
terraform-aws-modules · Oct 31, 2023 · f84dc7d · f84dc7d
1 parent e987d95
commit f84dc7d
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 8 deletions.
diff --git a/modules/cluster/README.md b/modules/cluster/README.md
@@ -161,7 +161,6 @@ No modules.
 | [aws_iam_role_policy_attachment.task_exec_additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
 | [aws_iam_policy_document.task_exec](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.task_exec_assume](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
-| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
 
 ## Inputs
 

diff --git a/modules/cluster/main.tf b/modules/cluster/main.tf
@@ -1,5 +1,3 @@
-data "aws_partition" "current" {}
-
 ################################################################################
 # Cluster
 ################################################################################
@@ -194,7 +192,7 @@ data "aws_iam_policy_document" "task_exec_assume" {
 
     principals {
       type        = "Service"
-      identifiers = ["ecs-tasks.${data.aws_partition.current.dns_suffix}"]
+      identifiers = ["ecs-tasks.amazonaws.com"]
     }
   }
 }

diff --git a/modules/service/main.tf b/modules/service/main.tf
@@ -4,7 +4,6 @@ data "aws_caller_identity" "current" {}
 
 locals {
   account_id = data.aws_caller_identity.current.account_id
-  dns_suffix = data.aws_partition.current.dns_suffix
   partition  = data.aws_partition.current.partition
   region     = data.aws_region.current.name
 }
@@ -419,7 +418,7 @@ data "aws_iam_policy_document" "service_assume" {
 
     principals {
       type        = "Service"
-      identifiers = ["ecs.${local.dns_suffix}"]
+      identifiers = ["ecs.amazonaws.com"]
     }
   }
 }
@@ -760,7 +759,7 @@ data "aws_iam_policy_document" "task_exec_assume" {
 
     principals {
       type        = "Service"
-      identifiers = ["ecs-tasks.${local.dns_suffix}"]
+      identifiers = ["ecs-tasks.amazonaws.com"]
     }
   }
 }
@@ -911,7 +910,7 @@ data "aws_iam_policy_document" "tasks_assume" {
 
     principals {
       type        = "Service"
-      identifiers = ["ecs-tasks.${local.dns_suffix}"]
+      identifiers = ["ecs-tasks.amazonaws.com"]
     }
 
     # https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html#create_task_iam_policy_and_role