feat: Add attributes to the trusted identity datasource (#118)

Author: nkraemer-sysdig

sysdig/data_source_sysdig_secure_trusted_cloud_identity.go

@@ -2,8 +2,10 @@ package sysdig
 
 import (
 	"context"
+	"strings"
 	"time"
 
+	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
@@ -29,6 +31,14 @@ func dataSourceSysdigSecureTrustedCloudIdentity() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"aws_account_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"aws_role_name": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 		},
 	}
 }
@@ -48,5 +58,15 @@ func dataSourceSysdigSecureTrustedCloudIdentityRead(ctx context.Context, d *sche
 	d.SetId(identity)
 	d.Set("identity", identity)
 
+	// If identity is an ARN, attempt to extract certain fields
+	parsedArn, err := arn.Parse(identity)
+	if err == nil {
+		d.Set("aws_account_id", parsedArn.AccountID)
+
+		if parsedArn.Service == "iam" && strings.HasPrefix(parsedArn.Resource, "role/") {
+			d.Set("aws_role_name", strings.TrimPrefix(parsedArn.Resource, "role/"))
+		}
+	}
+
 	return nil
 }

website/docs/d/sysdig_secure_trusted_cloud_identity.md

@@ -22,9 +22,13 @@ data "sysdig_secure_trusted_cloud_identity" "trusted_identity" {
 
 ## Argument Reference
 
-* `cloud_provider` - (Required) The cloud provider in which the account exists. Currently supported providers are `aws`, `gcp` and `azure` 
+* `cloud_provider` - (Required) The cloud provider in which the trusted identity will be used. Currently supported providers are `aws`, `gcp` and `azure` 
 
 
 ## Attributes Reference
 
 * `identity` - Sysdig's identity (User/Role/etc) that should be used to create a trust relationship allowing Sysdig access to your cloud account.
+
+* `aws_account_id` - If `identity` is an AWS ARN, this attribute contains the AWS Account ID to which the ARN belongs, otherwise it contains the empty string.
+
+* `aws_role_name` - If `identity` is a AWS IAM Role ARN, this attribute contains the name of the role, otherwise it contains the empty string.