CCM-8742: Grafana cross account access trust pol condition

Author: sidnhs

infrastructure/terraform/components/acct/variables.tf

@@ -70,8 +70,3 @@ variable "initial_cli_secrets_provision_override" {
   # Usage like:
   #  ... -a apply -- -var initial_cli_secrets_provision_override={\"github_pat\":\"l0ngstr1ng"}
 }
-
-variable "observability_account_id" {
-  type        = string
-  description = "The Observability Account ID that needs access"
-}

…mponents/acct/iam_role_grafana_access.tf …omponents/app/iam_role_grafana_access.tfinfrastructure/terraform/components/acct/iam_role_grafana_access.tf renamed to infrastructure/terraform/components/app/iam_role_grafana_access.tf infrastructure/terraform/components/acct/iam_role_grafana_access.tf renamed to infrastructure/terraform/components/app/iam_role_grafana_access.tf

@@ -1,5 +1,5 @@
 resource "aws_iam_role" "grafana_access" {
-  name               = "${local.csi}-grafana-cross-access-role"
+  name               = replace("${local.csi}-grafana-cross-access-role", "-${var.component}", "")
   assume_role_policy = data.aws_iam_policy_document.observability_grafana_role_assume_role_policy.json
 }
 
@@ -9,7 +9,17 @@ data "aws_iam_policy_document" "observability_grafana_role_assume_role_policy" {
     effect  = "Allow"
     principals {
       type        = "AWS"
-      identifiers = ["arn:aws:iam::${var.observability_account_id}:role/${local.csi}-grafana-workspace-role"]
+      identifiers = [
+         "arn:aws:iam::${var.observability_account_id}:root"
+      ]
+    }
+    condition {
+      test     = "ArnLike"
+      variable = "aws:PrincipalArn"
+
+      values = [
+        "arn:aws:iam::${var.observability_account_id}:role/*grafana-workspace-role"
+      ]
     }
   }
 }

infrastructure/terraform/components/app/variables.tf

@@ -187,3 +187,8 @@ variable "enable_letters" {
   description = "Feature flag for letters"
   default     = false
 }
+
+variable "observability_account_id" {
+  type        = string
+  description = "The Observability Account ID that needs access"
+}