Add caller identity data to the lambda module

jameslinnell · jameslinnell · commit 42a40bcf94c7 · 2025-08-07T13:11:01.000+01:00
diff --git a/infrastructure/modules/lambda/main.tf b/infrastructure/modules/lambda/main.tf
@@ -33,6 +33,8 @@ resource "aws_cloudwatch_log_group" "lambda_logs" {
   retention_in_days = 1
 }
 
+data "aws_caller_identity" "current" {}
+
 data "aws_iam_policy_document" "lambda_kms_policy" {
   statement {
     sid    = "AllowRootAccountAccess"
@@ -41,7 +43,7 @@ data "aws_iam_policy_document" "lambda_kms_policy" {
     principals {
       type = "AWS"
       identifiers = [
-        "arn:aws:iam::${var.account_id}:root"
+        "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
       ]
     }
 

Original file line number	Diff line number	Diff line change
`@@ -33,6 +33,8 @@ resource "aws_cloudwatch_log_group" "lambda_logs" {`
`33`	`33`	`retention_in_days = 1`
`34`	`34`	`}`
`35`	`35`
	`36`	`+data "aws_caller_identity" "current" {}`
	`37`	`+`
`36`	`38`	`data "aws_iam_policy_document" "lambda_kms_policy" {`
`37`	`39`	`statement {`
`38`	`40`	`sid = "AllowRootAccountAccess"`
`@@ -41,7 +43,7 @@ data "aws_iam_policy_document" "lambda_kms_policy" {`
`41`	`43`	`principals {`
`42`	`44`	`type = "AWS"`
`43`	`45`	`identifiers = [`
`44`		`- "arn:aws:iam::${var.account_id}:root"`
	`46`	`+ "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"`
`45`	`47`	`]`
`46`	`48`	`}`
`47`	`49`