Skip to content

Commit e13cb1e

Browse files
fatmcgavjanschumann
fatmcgav
and
janschumann
authored
feat: Add support for inline policy creation (#479)
Co-authored-by: Jan Schumann <js@schumann-it.com>
1 parent de95e21 commit e13cb1e

File tree

12 files changed

+236
-9
lines changed

12 files changed

+236
-9
lines changed

‎examples/iam-assumable-role-with-oidc/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ No providers.
3131
| Name | Source | Version |
3232
|------|--------|---------|
3333
| <a name="module_iam_assumable_role_admin"></a> [iam\_assumable\_role\_admin](#module\_iam\_assumable\_role\_admin) | ../../modules/iam-assumable-role-with-oidc | n/a |
34+
| <a name="module_iam_assumable_role_inline_policy"></a> [iam\_assumable\_role\_inline\_policy](#module\_iam\_assumable\_role\_inline\_policy) | ../../modules/iam-assumable-role-with-oidc | n/a |
3435
| <a name="module_iam_assumable_role_self_assume"></a> [iam\_assumable\_role\_self\_assume](#module\_iam\_assumable\_role\_self\_assume) | ../../modules/iam-assumable-role-with-oidc | n/a |
3536

3637
## Resources

‎examples/iam-assumable-role-with-oidc/main.tf‎

Lines changed: 48 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,13 @@ module "iam_assumable_role_admin" {
1616
Role = "role-with-oidc"
1717
}
1818

19-
provider_url = "oidc.eks.eu-west-1.amazonaws.com/id/BA9E170D464AF7B92084EF72A69B9DC8"
20-
provider_urls = ["oidc.eks.eu-west-1.amazonaws.com/id/AA9E170D464AF7B92084EF72A69B9DC8"]
19+
provider_url = "oidc.circleci.com/org/<CIRCLECI_ORG_UUID>"
20+
21+
oidc_fully_qualified_audiences = ["<CIRCLECI_ORG_UUID>"]
2122

2223
role_policy_arns = [
23-
"arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
24+
"arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser",
2425
]
25-
26-
oidc_fully_qualified_subjects = ["system:serviceaccount:default:sa1", "system:serviceaccount:default:sa2"]
2726
}
2827

2928
#####################################
@@ -41,12 +40,52 @@ module "iam_assumable_role_self_assume" {
4140
Role = "role-with-oidc-self-assume"
4241
}
4342

44-
provider_url = "oidc.eks.eu-west-1.amazonaws.com/id/BA9E170D464AF7B92084EF72A69B9DC8"
45-
provider_urls = ["oidc.eks.eu-west-1.amazonaws.com/id/AA9E170D464AF7B92084EF72A69B9DC8"]
43+
provider_url = "oidc.circleci.com/org/<CIRCLECI_ORG_UUID>"
44+
45+
oidc_fully_qualified_audiences = ["<CIRCLECI_ORG_UUID>"]
4646

4747
role_policy_arns = [
48-
"arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
48+
"arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser",
4949
]
50+
}
5051

51-
oidc_fully_qualified_subjects = ["system:serviceaccount:default:sa1", "system:serviceaccount:default:sa2"]
52+
#####################################
53+
# IAM assumable role with inline policy
54+
#####################################
55+
module "iam_assumable_role_inline_policy" {
56+
source = "../../modules/iam-assumable-role-with-oidc"
57+
58+
create_role = true
59+
60+
role_name = "role-with-oidc-inline-policy"
61+
62+
tags = {
63+
Role = "role-with-oidc-inline-policy"
64+
}
65+
66+
provider_url = "oidc.circleci.com/org/<CIRCLECI_ORG_UUID>"
67+
68+
oidc_fully_qualified_audiences = ["<CIRCLECI_ORG_UUID>"]
69+
70+
inline_policy_statements = [
71+
{
72+
sid = "AllowECRPushPull"
73+
actions = [
74+
"ecr:GetAuthorizationToken",
75+
"ecr:BatchGetImage",
76+
"ecr:GetDownloadUrlForLayer",
77+
"ecr:BatchCheckLayerAvailability",
78+
"ecr:DescribeImages",
79+
"ecr:DescribeRepositories",
80+
"ecr:GetDownloadUrlForLayer",
81+
"ecr:ListImages",
82+
"ecr:PutImage",
83+
"ecr:InitiateLayerUpload",
84+
"ecr:UploadLayerPart",
85+
"ecr:CompleteLayerUpload"
86+
]
87+
effect = "Allow"
88+
resources = ["*"]
89+
}
90+
]
5291
}

‎examples/iam-assumable-role/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ Run `terraform destroy` when you don't need these resources.
3737
| <a name="module_iam_assumable_role_admin"></a> [iam\_assumable\_role\_admin](#module\_iam\_assumable\_role\_admin) | ../../modules/iam-assumable-role | n/a |
3838
| <a name="module_iam_assumable_role_custom"></a> [iam\_assumable\_role\_custom](#module\_iam\_assumable\_role\_custom) | ../../modules/iam-assumable-role | n/a |
3939
| <a name="module_iam_assumable_role_custom_trust_policy"></a> [iam\_assumable\_role\_custom\_trust\_policy](#module\_iam\_assumable\_role\_custom\_trust\_policy) | ../../modules/iam-assumable-role | n/a |
40+
| <a name="module_iam_assumable_role_inline_policy"></a> [iam\_assumable\_role\_inline\_policy](#module\_iam\_assumable\_role\_inline\_policy) | ../../modules/iam-assumable-role | n/a |
4041
| <a name="module_iam_assumable_role_sts"></a> [iam\_assumable\_role\_sts](#module\_iam\_assumable\_role\_sts) | ../../modules/iam-assumable-role | n/a |
4142
| <a name="module_iam_policy"></a> [iam\_policy](#module\_iam\_policy) | ../../modules/iam-policy | n/a |
4243

‎examples/iam-assumable-role/main.tf‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,50 @@ module "iam_assumable_role_custom" {
6262
# number_of_custom_role_policy_arns = 3
6363
}
6464

65+
##########################################
66+
# IAM assumable role with inline policy
67+
##########################################
68+
module "iam_assumable_role_inline_policy" {
69+
source = "../../modules/iam-assumable-role"
70+
71+
trusted_role_arns = [
72+
"arn:aws:iam::307990089504:root",
73+
]
74+
75+
trusted_role_services = [
76+
"codedeploy.amazonaws.com"
77+
]
78+
79+
create_role = true
80+
81+
role_name_prefix = "custom-"
82+
role_requires_mfa = false
83+
84+
role_sts_externalid = "some-id-goes-here"
85+
86+
inline_policy_statements = [
87+
{
88+
sid = "AllowECRPushPull"
89+
actions = [
90+
"ecr:GetAuthorizationToken",
91+
"ecr:BatchGetImage",
92+
"ecr:GetDownloadUrlForLayer",
93+
"ecr:BatchCheckLayerAvailability",
94+
"ecr:DescribeImages",
95+
"ecr:DescribeRepositories",
96+
"ecr:GetDownloadUrlForLayer",
97+
"ecr:ListImages",
98+
"ecr:PutImage",
99+
"ecr:InitiateLayerUpload",
100+
"ecr:UploadLayerPart",
101+
"ecr:CompleteLayerUpload"
102+
]
103+
effect = "Allow"
104+
resources = ["*"]
105+
}
106+
]
107+
}
108+
65109
####################################################
66110
# IAM assumable role with multiple sts external ids
67111
####################################################

‎modules/iam-assumable-role-with-oidc/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,9 +29,11 @@ No modules.
2929
| Name | Type |
3030
|------|------|
3131
| [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
32+
| [aws_iam_role_policy.inline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
3233
| [aws_iam_role_policy_attachment.custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
3334
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
3435
| [aws_iam_policy_document.assume_role_with_oidc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
36+
| [aws_iam_policy_document.inline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
3537
| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
3638

3739
## Inputs
@@ -42,6 +44,7 @@ No modules.
4244
| <a name="input_aws_account_id"></a> [aws\_account\_id](#input\_aws\_account\_id) | The AWS account ID where the OIDC provider lives, leave empty to use the account for the AWS provider | `string` | `""` | no |
4345
| <a name="input_create_role"></a> [create\_role](#input\_create\_role) | Whether to create a role | `bool` | `false` | no |
4446
| <a name="input_force_detach_policies"></a> [force\_detach\_policies](#input\_force\_detach\_policies) | Whether policies should be detached from this role when destroying | `bool` | `false` | no |
47+
| <a name="input_inline_policy_statements"></a> [inline\_policy\_statements](#input\_inline\_policy\_statements) | List of inline policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) to attach to IAM role as an inline policy | `any` | `[]` | no |
4548
| <a name="input_max_session_duration"></a> [max\_session\_duration](#input\_max\_session\_duration) | Maximum CLI/API session duration in seconds between 3600 and 43200 | `number` | `3600` | no |
4649
| <a name="input_number_of_role_policy_arns"></a> [number\_of\_role\_policy\_arns](#input\_number\_of\_role\_policy\_arns) | Number of IAM policies to attach to IAM role | `number` | `null` | no |
4750
| <a name="input_oidc_fully_qualified_audiences"></a> [oidc\_fully\_qualified\_audiences](#input\_oidc\_fully\_qualified\_audiences) | The audience to be added to the role policy. Set to sts.amazonaws.com for cross-account assumable role. Leave empty otherwise. | `set(string)` | `[]` | no |

‎modules/iam-assumable-role-with-oidc/main.tf‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,3 +107,64 @@ resource "aws_iam_role_policy_attachment" "custom" {
107107
role = aws_iam_role.this[0].name
108108
policy_arn = var.role_policy_arns[count.index]
109109
}
110+
111+
###############################
112+
# IAM Role Inline policy
113+
###############################
114+
115+
locals {
116+
create_iam_role_inline_policy = var.create_role && length(var.inline_policy_statements) > 0
117+
}
118+
119+
data "aws_iam_policy_document" "inline" {
120+
count = local.create_iam_role_inline_policy ? 1 : 0
121+
122+
dynamic "statement" {
123+
for_each = var.inline_policy_statements
124+
125+
content {
126+
sid = try(statement.value.sid, null)
127+
actions = try(statement.value.actions, null)
128+
not_actions = try(statement.value.not_actions, null)
129+
effect = try(statement.value.effect, null)
130+
resources = try(statement.value.resources, null)
131+
not_resources = try(statement.value.not_resources, null)
132+
133+
dynamic "principals" {
134+
for_each = try(statement.value.principals, [])
135+
136+
content {
137+
type = principals.value.type
138+
identifiers = principals.value.identifiers
139+
}
140+
}
141+
142+
dynamic "not_principals" {
143+
for_each = try(statement.value.not_principals, [])
144+
145+
content {
146+
type = not_principals.value.type
147+
identifiers = not_principals.value.identifiers
148+
}
149+
}
150+
151+
dynamic "condition" {
152+
for_each = try(statement.value.conditions, [])
153+
154+
content {
155+
test = condition.value.test
156+
values = condition.value.values
157+
variable = condition.value.variable
158+
}
159+
}
160+
}
161+
}
162+
}
163+
164+
resource "aws_iam_role_policy" "inline" {
165+
count = local.create_iam_role_inline_policy ? 1 : 0
166+
167+
role = aws_iam_role.this[0].name
168+
name_prefix = "${var.role_name}_inline_"
169+
policy = data.aws_iam_policy_document.inline[0].json
170+
}

‎modules/iam-assumable-role-with-oidc/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,12 @@ variable "number_of_role_policy_arns" {
7676
default = null
7777
}
7878

79+
variable "inline_policy_statements" {
80+
description = "List of inline policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) to attach to IAM role as an inline policy"
81+
type = any
82+
default = []
83+
}
84+
7985
variable "oidc_fully_qualified_subjects" {
8086
description = "The fully qualified OIDC subjects to be added to the role policy"
8187
type = set(string)

‎modules/iam-assumable-role/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,13 +28,15 @@ No modules.
2828
|------|------|
2929
| [aws_iam_instance_profile.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_instance_profile) | resource |
3030
| [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
31+
| [aws_iam_role_policy.inline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
3132
| [aws_iam_role_policy_attachment.admin](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
3233
| [aws_iam_role_policy_attachment.custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
3334
| [aws_iam_role_policy_attachment.poweruser](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
3435
| [aws_iam_role_policy_attachment.readonly](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
3536
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
3637
| [aws_iam_policy_document.assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
3738
| [aws_iam_policy_document.assume_role_with_mfa](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
39+
| [aws_iam_policy_document.inline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
3840
| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
3941

4042
## Inputs
@@ -52,6 +54,7 @@ No modules.
5254
| <a name="input_custom_role_policy_arns"></a> [custom\_role\_policy\_arns](#input\_custom\_role\_policy\_arns) | List of ARNs of IAM policies to attach to IAM role | `list(string)` | `[]` | no |
5355
| <a name="input_custom_role_trust_policy"></a> [custom\_role\_trust\_policy](#input\_custom\_role\_trust\_policy) | A custom role trust policy. (Only valid if create\_custom\_role\_trust\_policy = true) | `string` | `""` | no |
5456
| <a name="input_force_detach_policies"></a> [force\_detach\_policies](#input\_force\_detach\_policies) | Whether policies should be detached from this role when destroying | `bool` | `false` | no |
57+
| <a name="input_inline_policy_statements"></a> [inline\_policy\_statements](#input\_inline\_policy\_statements) | List of inline policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) to attach to IAM role as an inline policy | `any` | `[]` | no |
5558
| <a name="input_max_session_duration"></a> [max\_session\_duration](#input\_max\_session\_duration) | Maximum CLI/API session duration in seconds between 3600 and 43200 | `number` | `3600` | no |
5659
| <a name="input_mfa_age"></a> [mfa\_age](#input\_mfa\_age) | Max age of valid MFA (in seconds) for roles which require MFA | `number` | `86400` | no |
5760
| <a name="input_number_of_custom_role_policy_arns"></a> [number\_of\_custom\_role\_policy\_arns](#input\_number\_of\_custom\_role\_policy\_arns) | Number of IAM policies to attach to IAM role | `number` | `null` | no |

‎modules/iam-assumable-role/main.tf‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -197,3 +197,64 @@ resource "aws_iam_instance_profile" "this" {
197197

198198
tags = var.tags
199199
}
200+
201+
###############################
202+
# IAM Role Inline policy
203+
###############################
204+
205+
locals {
206+
create_iam_role_inline_policy = var.create_role && length(var.inline_policy_statements) > 0
207+
}
208+
209+
data "aws_iam_policy_document" "inline" {
210+
count = local.create_iam_role_inline_policy ? 1 : 0
211+
212+
dynamic "statement" {
213+
for_each = var.inline_policy_statements
214+
215+
content {
216+
sid = try(statement.value.sid, null)
217+
actions = try(statement.value.actions, null)
218+
not_actions = try(statement.value.not_actions, null)
219+
effect = try(statement.value.effect, null)
220+
resources = try(statement.value.resources, null)
221+
not_resources = try(statement.value.not_resources, null)
222+
223+
dynamic "principals" {
224+
for_each = try(statement.value.principals, [])
225+
226+
content {
227+
type = principals.value.type
228+
identifiers = principals.value.identifiers
229+
}
230+
}
231+
232+
dynamic "not_principals" {
233+
for_each = try(statement.value.not_principals, [])
234+
235+
content {
236+
type = not_principals.value.type
237+
identifiers = not_principals.value.identifiers
238+
}
239+
}
240+
241+
dynamic "condition" {
242+
for_each = try(statement.value.conditions, [])
243+
244+
content {
245+
test = condition.value.test
246+
values = condition.value.values
247+
variable = condition.value.variable
248+
}
249+
}
250+
}
251+
}
252+
}
253+
254+
resource "aws_iam_role_policy" "inline" {
255+
count = local.create_iam_role_inline_policy ? 1 : 0
256+
257+
role = aws_iam_role.this[0].name
258+
name_prefix = "${var.role_name}_inline_"
259+
policy = data.aws_iam_policy_document.inline[0].json
260+
}

‎modules/iam-assumable-role/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,12 @@ variable "number_of_custom_role_policy_arns" {
100100
default = null
101101
}
102102

103+
variable "inline_policy_statements" {
104+
description = "List of inline policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) to attach to IAM role as an inline policy"
105+
type = any
106+
default = []
107+
}
108+
103109
# Pre-defined policies
104110
variable "admin_role_policy_arn" {
105111
description = "Policy ARN to use for admin role"

0 commit comments

Comments
 (0)