Skip to content

Commit 2916e5c

Browse files
unfuncounfunco
authored
chore! Make all IAM variable names consistent (#81)
1 parent 2eb9470 commit 2916e5c

File tree

6 files changed

+87
-63
lines changed

6 files changed

+87
-63
lines changed

‎README.md‎

Lines changed: 29 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -81,34 +81,38 @@ applied, the JWT will contain an updated `iss` claim.
8181

8282
## Inputs
8383

84-
| Name | Description | Type | Default | Required |
85-
| ------------------------------- | ---------------------------------------------------------------------------- | -------------- | ----------------- | :------: |
86-
| additional_audiences | Additional OIDC audiences allowed to assume the role. | `list(string)` | `null` | no |
87-
| additional_thumbprints | Additional thumbprints for the OIDC provider. | `list(string)` | `[]` | no |
88-
| attach_read_only_policy | Enable/disable the attachment of the ReadOnly policy. | `bool` | `false` | no |
89-
| create | Enable/disable the creation of all resources. | `bool` | `true` | no |
90-
| create_iam_role | Enable/disable creation of the IAM role. | `bool` | `true` | no |
91-
| create_oidc_provider | Enable/disable the creation of the GitHub OIDC provider. | `bool` | `true` | no |
92-
| dangerously_attach_admin_policy | Enable/disable the attachment of the AdministratorAccess policy. | `bool` | `false` | no |
93-
| enterprise_slug | Enterprise slug for GitHub Enterprise Cloud customers. | `string` | `""` | no |
94-
| force_detach_policies | Force detachment of policies attached to the IAM role. | `bool` | `false` | no |
95-
| github_repositories | GitHub organization/repository names authorized to assume the role. | `list(string)` | n/a | yes |
96-
| iam_role_inline_policies | Inline policies map with policy name as key and json as value. | `map(string)` | `{}` | no |
97-
| iam_role_name | The name of the IAM role to be created and made assumable by GitHub Actions. | `string` | `"GitHubActions"` | no |
98-
| iam_role_path | The path under which to create IAM role. | `string` | `"/"` | no |
99-
| iam_role_permissions_boundary | The ARN of the permissions boundary to be used by the IAM role. | `string` | `""` | no |
100-
| iam_role_policy_arns | IAM policy ARNs to attach to the IAM role. | `list(string)` | `[]` | no |
101-
| max_session_duration | The maximum session duration in seconds. | `number` | `3600` | no |
102-
| tags | Tags to be applied to all applicable resources. | `map(string)` | `{}` | no |
84+
| Name | Description | Type | Default | Required |
85+
| ------------------------------- | ---------------------------------------------------------------------------- | -------------- | ---------------------------------------- | :------: |
86+
| additional_audiences | Additional OIDC audiences allowed to assume the role. | `list(string)` | `null` | no |
87+
| additional_thumbprints | Additional thumbprints for the OIDC provider. | `list(string)` | `[]` | no |
88+
| attach_read_only_policy | Enable/disable the attachment of the ReadOnly policy. | `bool` | `false` | no |
89+
| create | Enable/disable the creation of all resources. | `bool` | `true` | no |
90+
| create_iam_role | Enable/disable creation of the IAM role. | `bool` | `true` | no |
91+
| create_oidc_provider | Enable/disable the creation of the GitHub OIDC provider. | `bool` | `true` | no |
92+
| dangerously_attach_admin_policy | Enable/disable the attachment of the AdministratorAccess policy. | `bool` | `false` | no |
93+
| enterprise_slug | Enterprise slug for GitHub Enterprise Cloud customers. | `string` | `""` | no |
94+
| github_repositories | GitHub organization/repository names authorized to assume the role. | `list(string)` | n/a | yes |
95+
| iam_role_description | Description of the IAM role to be created. | `string` | `"Assumed by the GitHub OIDC provider."` | no |
96+
| iam_role_force_detach_policies | Force detachment of policies attached to the IAM role. | `bool` | `false` | no |
97+
| iam_role_inline_policies | Inline policies map with policy name as key and json as value. | `map(string)` | `{}` | no |
98+
| iam_role_max_session_duration | The maximum session duration in seconds. | `number` | `3600` | no |
99+
| iam_role_name | The name of the IAM role to be created and made assumable by GitHub Actions. | `string` | `"GitHubActions"` | no |
100+
| iam_role_path | The path under which to create IAM role. | `string` | `"/"` | no |
101+
| iam_role_permissions_boundary | The ARN of the permissions boundary to be used by the IAM role. | `string` | `""` | no |
102+
| iam_role_policy_arns | IAM policy ARNs to attach to the IAM role. | `list(string)` | `[]` | no |
103+
| iam_role_tags | Additional tags to be applied to the IAM role. | `map(string)` | `{}` | no |
104+
| oidc_provider_tags | Tags to be applied to the OIDC provider. | `map(string)` | `{}` | no |
105+
| tags | Tags to be applied to all applicable resources. | `map(string)` | `{}` | no |
103106

104107
## Outputs
105108

106-
| Name | Description |
107-
| ----------------- | ----------------------------- |
108-
| iam_role_arn | The ARN of the IAM role. |
109-
| iam_role_name | The name of the IAM role. |
110-
| oidc_provider_arn | The ARN of the OIDC provider. |
111-
| oidc_provider_url | The URL of the OIDC provider. |
109+
| Name | Description |
110+
| --------------------------- | ----------------------------------------------------------------------- |
111+
| assume_role_policy_document | The assume role policy document that can be attached to your IAM roles. |
112+
| iam_role_arn | The ARN of the IAM role. |
113+
| iam_role_name | The name of the IAM role. |
114+
| oidc_provider_arn | The ARN of the OIDC provider. |
115+
| oidc_provider_url | The URL of the OIDC provider. |
112116

113117
<!-- END_TF_DOCS -->
114118

‎data.tf‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
11
// SPDX-FileCopyrightText: 2024 Daniel Morris <daniel@honestempire.com>
22
// SPDX-License-Identifier: MIT
33

4-
data "aws_partition" "this" {}
4+
data "aws_partition" "this" {
5+
count = var.create ? 1 : 0
6+
}
57

68
data "aws_iam_policy_document" "assume_role" {
7-
count = local.create_oidc_provider ? 1 : 0
9+
count = var.create ? 1 : 0
810

911
version = "2012-10-17"
1012

@@ -24,9 +26,9 @@ data "aws_iam_policy_document" "assume_role" {
2426
condition {
2527
test = "StringEquals"
2628
values = var.additional_audiences != null ? concat(
27-
[local.audience],
29+
format("sts.%v", data.aws_partition.this[0].dns_suffix),
2830
var.additional_audiences,
29-
) : [local.audience]
31+
) : format("sts.%v", data.aws_partition.this[0].dns_suffix)
3032
variable = "token.actions.githubusercontent.com:aud"
3133
}
3234

‎examples/complete/main.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,13 @@ module "aws_oidc_github" {
1414
create_oidc_provider = var.create_oidc_provider
1515
dangerously_attach_admin_policy = var.dangerously_attach_admin_policy
1616
enterprise_slug = var.enterprise_slug
17-
force_detach_policies = var.force_detach_policies
17+
iam_role_force_detach_policies = var.force_detach_policies
1818
iam_role_name = var.iam_role_name
1919
iam_role_path = var.iam_role_path
2020
iam_role_permissions_boundary = var.iam_role_permissions_boundary
2121
iam_role_policy_arns = var.iam_role_policy_arns
2222
github_repositories = var.github_repositories
23-
max_session_duration = var.max_session_duration
23+
iam_role_max_session_duration = var.max_session_duration
2424
tags = var.tags
2525

2626
iam_role_inline_policies = {

‎main.tf‎

Lines changed: 9 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -8,15 +8,10 @@ locals {
88
attach_read_only_policy = local.create_iam_role && var.attach_read_only_policy
99
dangerously_attach_admin_policy = local.create_iam_role && var.dangerously_attach_admin_policy
1010

11-
audience = format("sts.%v", local.dns_suffix)
12-
1311
github_organizations = toset([
1412
for repo in var.github_repositories : split("/", repo)[0]
1513
])
1614

17-
dns_suffix = data.aws_partition.this.dns_suffix
18-
partition = data.aws_partition.this.partition
19-
2015
oidc_provider_arn = (
2116
var.create_oidc_provider ?
2217
aws_iam_openid_connect_provider.github[0].arn :
@@ -28,13 +23,13 @@ resource "aws_iam_role" "github" {
2823
count = local.create_iam_role ? 1 : 0
2924

3025
assume_role_policy = data.aws_iam_policy_document.assume_role[0].json
31-
description = "Assumed by the GitHub OIDC provider."
32-
force_detach_policies = var.force_detach_policies
33-
max_session_duration = var.max_session_duration
26+
description = var.iam_role_description
27+
force_detach_policies = var.iam_role_force_detach_policies
28+
max_session_duration = var.iam_role_max_session_duration
3429
name = var.iam_role_name
3530
path = var.iam_role_path
3631
permissions_boundary = var.iam_role_permissions_boundary
37-
tags = var.tags
32+
tags = merge(var.tags, var.iam_role_tags)
3833
}
3934

4035
resource "aws_iam_role_policy" "inline_policies" {
@@ -48,14 +43,14 @@ resource "aws_iam_role_policy" "inline_policies" {
4843
resource "aws_iam_role_policy_attachment" "admin" {
4944
count = local.create_iam_role && var.dangerously_attach_admin_policy ? 1 : 0
5045

51-
policy_arn = "arn:${local.partition}:iam::aws:policy/AdministratorAccess"
46+
policy_arn = "arn:${data.aws_partition.this[0].partition}:iam::aws:policy/AdministratorAccess"
5247
role = aws_iam_role.github[0].id
5348
}
5449

5550
resource "aws_iam_role_policy_attachment" "read_only" {
5651
count = local.create_iam_role && var.attach_read_only_policy ? 1 : 0
5752

58-
policy_arn = "arn:${local.partition}:iam::aws:policy/ReadOnlyAccess"
53+
policy_arn = "arn:${data.aws_partition.this[0].partition}:iam::aws:policy/ReadOnlyAccess"
5954
role = aws_iam_role.github[0].id
6055
}
6156

@@ -65,7 +60,7 @@ resource "aws_iam_role_policy_attachment" "custom" {
6560
role = aws_iam_role.github[0].id
6661
policy_arn = format(
6762
"arn:%v:iam::aws:policy/AdministratorAccess",
68-
local.partition,
63+
data.aws_partition.this[0].partition,
6964
)
7065
}
7166

@@ -74,10 +69,10 @@ resource "aws_iam_openid_connect_provider" "github" {
7469

7570
client_id_list = concat(
7671
[for org in local.github_organizations : format("https://github.com/%v", org)],
77-
[local.audience],
72+
format("sts.%v", data.aws_partition.this[0].dns_suffix),
7873
)
7974

80-
tags = var.tags
75+
tags = merge(var.tags, var.oidc_provider_tags)
8176

8277
thumbprint_list = toset(
8378
concat(

‎outputs.tf‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,27 @@
11
// SPDX-FileCopyrightText: 2024 Daniel Morris <daniel@honestempire.com>
22
// SPDX-License-Identifier: MIT
33

4+
output "assume_role_policy_document" {
5+
description = "The assume role policy document that can be attached to your IAM roles."
6+
value = local.create_oidc_provider ? data.aws_iam_policy_document.assume_role[0] : ""
7+
}
8+
49
output "iam_role_arn" {
510
description = "The ARN of the IAM role."
6-
value = var.create && var.create_iam_role ? aws_iam_role.github[0].arn : ""
11+
value = local.create_iam_role ? aws_iam_role.github[0].arn : ""
712
}
813

914
output "iam_role_name" {
1015
description = "The name of the IAM role."
11-
value = var.create && var.create_iam_role ? aws_iam_role.github[0].name : ""
16+
value = local.create_iam_role ? aws_iam_role.github[0].name : ""
1217
}
1318

1419
output "oidc_provider_arn" {
1520
description = "The ARN of the OIDC provider."
16-
value = var.create_oidc_provider ? aws_iam_openid_connect_provider.github[0].arn : data.aws_iam_openid_connect_provider.github[0].arn
21+
value = local.create_oidc_provider ? aws_iam_openid_connect_provider.github[0].arn : data.aws_iam_openid_connect_provider.github[0].arn
1722
}
1823

1924
output "oidc_provider_url" {
2025
description = "The URL of the OIDC provider."
21-
value = var.create_oidc_provider ? aws_iam_openid_connect_provider.github[0].url : data.aws_iam_openid_connect_provider.github[0].url
26+
value = local.create_oidc_provider ? aws_iam_openid_connect_provider.github[0].url : data.aws_iam_openid_connect_provider.github[0].url
2227
}

‎variables.tf‎

Lines changed: 32 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -54,12 +54,6 @@ variable "enterprise_slug" {
5454
type = string
5555
}
5656

57-
variable "force_detach_policies" {
58-
default = false
59-
description = "Force detachment of policies attached to the IAM role."
60-
type = bool
61-
}
62-
6357
variable "github_repositories" {
6458
description = "GitHub organization/repository names authorized to assume the role."
6559
type = list(string)
@@ -75,6 +69,29 @@ variable "github_repositories" {
7569
}
7670
}
7771

72+
variable "iam_role_description" {
73+
default = "Assumed by the GitHub OIDC provider."
74+
description = "Description of the IAM role to be created."
75+
type = string
76+
}
77+
78+
variable "iam_role_force_detach_policies" {
79+
default = false
80+
description = "Force detachment of policies attached to the IAM role."
81+
type = bool
82+
}
83+
84+
variable "iam_role_max_session_duration" {
85+
default = 3600
86+
description = "The maximum session duration in seconds."
87+
type = number
88+
89+
validation {
90+
condition = var.iam_role_max_session_duration >= 3600 && var.iam_role_max_session_duration <= 43200
91+
error_message = "The maximum session duration must be between 3600 and 43200 seconds."
92+
}
93+
}
94+
7895
variable "iam_role_name" {
7996
default = "GitHubActions"
8097
description = "The name of the IAM role to be created and made assumable by GitHub Actions."
@@ -105,15 +122,16 @@ variable "iam_role_inline_policies" {
105122
type = map(string)
106123
}
107124

108-
variable "max_session_duration" {
109-
default = 3600
110-
description = "The maximum session duration in seconds."
111-
type = number
125+
variable "iam_role_tags" {
126+
default = {}
127+
description = "Additional tags to be applied to the IAM role."
128+
type = map(string)
129+
}
112130

113-
validation {
114-
condition = var.max_session_duration >= 3600 && var.max_session_duration <= 43200
115-
error_message = "The maximum session duration must be between 3600 and 43200 seconds."
116-
}
131+
variable "oidc_provider_tags" {
132+
default = {}
133+
description = "Tags to be applied to the OIDC provider."
134+
type = map(string)
117135
}
118136

119137
variable "tags" {

0 commit comments

Comments
 (0)