|
| 1 | +# This is the default providers.tf when account map is disabled. |
| 2 | + |
1 | 3 | variable "account_map_enabled" { |
2 | 4 | type = bool |
3 | | - description = <<-EOT |
4 | | - When true, uses the account-map component to look up account IDs dynamically. |
5 | | - When false, uses the static account_map variable instead. Set to false when |
6 | | - using Atmos Auth profiles and static account mappings. |
7 | | - EOT |
8 | | - default = true |
| 5 | + description = "Enable the account map component" |
| 6 | + default = false |
9 | 7 | } |
10 | 8 |
|
11 | 9 | variable "account_map" { |
12 | 10 | type = object({ |
13 | | - full_account_map = map(string) |
14 | | - audit_account_account_name = optional(string, "") |
15 | | - root_account_account_name = optional(string, "") |
| 11 | + full_account_map = map(string) |
| 12 | + audit_account_account_name = optional(string, "") |
| 13 | + root_account_account_name = optional(string, "") |
| 14 | + identity_account_account_name = optional(string, "") |
| 15 | + aws_partition = optional(string, "aws") |
| 16 | + iam_role_arn_templates = optional(map(string), {}) |
16 | 17 | }) |
17 | | - description = <<-EOT |
18 | | - Static account map used when account_map_enabled is false. |
19 | | - Provides account name to account ID mapping without requiring the account-map component. |
20 | | - EOT |
| 18 | + description = "Map of account names (tenant-stage format) to account IDs. Used to verify we're targeting the correct AWS account. Optional attributes support component-specific functionality (e.g., audit_account_account_name for cloudtrail, root_account_account_name for aws-sso)." |
21 | 19 | default = { |
22 | | - full_account_map = {} |
23 | | - audit_account_account_name = "" |
24 | | - root_account_account_name = "" |
| 20 | + full_account_map = {} |
| 21 | + audit_account_account_name = "" |
| 22 | + root_account_account_name = "" |
| 23 | + identity_account_account_name = "" |
| 24 | + aws_partition = "aws" |
| 25 | + iam_role_arn_templates = {} |
25 | 26 | } |
26 | 27 | } |
27 | 28 |
|
28 | | -# This component is unusual in that part of it must be deployed to the `root` |
29 | | -# account. You have the option of where to deploy the remaining part, and |
30 | | -# Cloud Posse recommends you deploy it also to the `root` account, however |
31 | | -# it can be deployed to the `identity` account instead. In the discussion |
32 | | -# below, when we talk about where this module is being deployed, we are |
33 | | -# referring to the part of the module that is not deployed to the `root` |
34 | | -# account and is configured by setting `stage` etc.. |
35 | | - |
36 | | -# If you have Dynamic Terraform Roles enabled, leave the backend `role_arn` at |
37 | | -# its default value. If deploying only to the `root` account, leave `privileged: false` |
38 | | -# and use either SuperAdmin or an appropriate `aws-team` (such as `managers`). |
39 | | -# If deploying to the `identity` account, set `privileged: true` |
40 | | -# and use SuperAdmin or any other role in the `root` account with Admin access. |
41 | | -# |
42 | | -# For those not using dynamic Terraform roles: |
43 | | -# |
44 | | -# Set the stack configuration for this component to set `privileged: true` |
45 | | -# and backend `role_arn` to `null`, and deploy it using either the SuperAdmin |
46 | | -# role or any other role in the `root` account with Admin access. |
47 | | -# |
48 | | -# If you are deploying this to the "identity" account and have a team empowered |
49 | | -# to deploy to both the "identity" and "root" accounts, then you have the option to set |
50 | | -# `privileged: false` and leave the backend `role_arn` at its default value, but |
51 | | -# then SuperAdmin will not be able to deploy this component, |
52 | | -# only the team with access to both accounts will be able to deploy it. |
53 | | -# |
54 | | - |
55 | 29 | provider "aws" { |
56 | 30 | region = var.region |
57 | | - |
58 | | - profile = !var.privileged && module.iam_roles.profiles_enabled ? module.iam_roles.terraform_profile_name : null |
59 | | - dynamic "assume_role" { |
60 | | - for_each = !var.privileged && module.iam_roles.profiles_enabled ? [] : ( |
61 | | - var.privileged ? compact([module.iam_roles.org_role_arn]) : compact([module.iam_roles.terraform_role_arn]) |
62 | | - ) |
63 | | - content { |
64 | | - role_arn = assume_role.value |
65 | | - } |
66 | | - } |
67 | 31 | } |
68 | 32 |
|
69 | | - |
| 33 | +# dummy module to satisfy the module dependency |
70 | 34 | module "iam_roles" { |
71 | | - source = "../account-map/modules/iam-roles" |
72 | | - privileged = var.privileged |
73 | | - |
74 | | - context = module.this.context |
75 | | -} |
76 | | - |
77 | | -provider "aws" { |
78 | | - alias = "root" |
79 | | - region = var.region |
80 | | - |
81 | | - profile = !var.privileged && module.iam_roles_root.profiles_enabled ? module.iam_roles_root.terraform_profile_name : null |
82 | | - dynamic "assume_role" { |
83 | | - for_each = !var.privileged && module.iam_roles_root.profiles_enabled ? [] : ( |
84 | | - var.privileged ? compact([module.iam_roles_root.org_role_arn]) : compact([module.iam_roles_root.terraform_role_arn]) |
85 | | - ) |
86 | | - content { |
87 | | - role_arn = assume_role.value |
88 | | - } |
89 | | - } |
90 | | -} |
91 | | - |
92 | | - |
93 | | -module "iam_roles_root" { |
94 | | - source = "../account-map/modules/iam-roles" |
95 | | - |
96 | | - privileged = var.privileged |
97 | | - tenant = module.iam_roles.global_tenant_name |
98 | | - stage = module.iam_roles.global_stage_name |
99 | | - environment = module.iam_roles.global_environment_name |
100 | | - |
| 35 | + source = "cloudposse/label/null" |
101 | 36 | context = module.this.context |
102 | 37 | } |
0 commit comments