ensure roles are unique

Author: npalm

modules/ami-housekeeper/main.tf

@@ -55,7 +55,7 @@ resource "aws_cloudwatch_log_group" "ami_housekeeper" {
 }
 
 resource "aws_iam_role" "ami_housekeeper" {
-  name                 = substr("${var.prefix}-ami-housekeeper-role", 0, 63)
+  name                 = "${substr("${var.prefix}-ami-housekeeper-role", 0, 54)}-${substr(md5("${var.prefix}-ami-housekeeper-role"), 0, 8)}"
   assume_role_policy   = data.aws_iam_policy_document.lambda_assume_role_policy.json
   path                 = local.role_path
   permissions_boundary = var.role_permissions_boundary

modules/lambda/main.tf

@@ -60,7 +60,7 @@ resource "aws_cloudwatch_log_group" "main" {
 }
 
 resource "aws_iam_role" "main" {
-  name                 = substr("${var.lambda.prefix}-${var.lambda.name}", 0, 63)
+  name                 = "${substr("${var.lambda.prefix}-${var.lambda.name}", 0, 54)}-${substr(md5("${var.lambda.prefix}-${var.lambda.name}"), 0, 8)}"
   assume_role_policy   = data.aws_iam_policy_document.lambda_assume_role_policy.json
   path                 = local.role_path
   permissions_boundary = var.lambda.role_permissions_boundary

modules/runners/policies-runner.tf

@@ -1,7 +1,7 @@
 data "aws_caller_identity" "current" {}
 
 resource "aws_iam_role" "runner" {
-  name                 = substr("${var.prefix}-runner-role", 0, 63)
+  name                 = "${substr("${var.prefix}-runner-role", 0, 54)}-${substr(md5("${var.prefix}-runner-role"), 0, 8)}"
   assume_role_policy   = templatefile("${path.module}/policies/instance-role-trust-policy.json", {})
   path                 = local.role_path
   permissions_boundary = var.role_permissions_boundary

modules/runners/pool/main.tf

@@ -74,7 +74,7 @@ resource "aws_cloudwatch_log_group" "pool" {
 }
 
 resource "aws_iam_role" "pool" {
-  name                 = substr("${var.config.prefix}-action-pool-lambda-role", 0, 63)
+  name                 = "${substr("${var.config.prefix}-action-pool-lambda-role", 0, 54)}-${substr(md5("${var.config.prefix}-action-pool-lambda-role"), 0, 8)}"
   assume_role_policy   = data.aws_iam_policy_document.lambda_assume_role_policy.json
   path                 = var.config.role_path
   permissions_boundary = var.config.role_permissions_boundary

modules/runners/scale-down.tf

@@ -85,7 +85,7 @@ resource "aws_lambda_permission" "scale_down" {
 }
 
 resource "aws_iam_role" "scale_down" {
-  name                 = substr("${var.prefix}-action-scale-down-lambda-role", 0, 63)
+  name                 = "${substr("${var.prefix}-action-scale-down-lambda-role", 0, 54)}-${substr(md5("${var.prefix}-action-scale-down-lambda-role"), 0, 8)}"
   assume_role_policy   = data.aws_iam_policy_document.lambda_assume_role_policy.json
   path                 = local.role_path
   permissions_boundary = var.role_permissions_boundary

modules/runners/scale-up.tf

@@ -101,7 +101,7 @@ resource "aws_lambda_permission" "scale_runners_lambda" {
 }
 
 resource "aws_iam_role" "scale_up" {
-  name                 = substr("${var.prefix}-action-scale-up-lambda-role", 0, 63)
+  name                 = "${substr("${var.prefix}-action-scale-up-lambda-role", 0, 54)}-${substr(md5("${var.prefix}-action-scale-up-lambda-role"), 0, 8)}"
   assume_role_policy   = data.aws_iam_policy_document.lambda_assume_role_policy.json
   path                 = local.role_path
   permissions_boundary = var.role_permissions_boundary

modules/runners/ssm-housekeeper.tf

@@ -83,7 +83,7 @@ resource "aws_lambda_permission" "ssm_housekeeper" {
 }
 
 resource "aws_iam_role" "ssm_housekeeper" {
-  name                 = substr("${var.prefix}-ssm-hk-lambda", 0, 63)
+  name                 = "${substr("${var.prefix}-ssm-hk-lambda", 0, 54)}-${substr(md5("${var.prefix}-ssm-hk-lambda"), 0, 8)}"
   description          = "Lambda role for SSM Housekeeper (${var.prefix})"
   assume_role_policy   = data.aws_iam_policy_document.lambda_assume_role_policy.json
   path                 = local.role_path

modules/setup-iam-permissions/main.tf

@@ -1,7 +1,7 @@
 data "aws_caller_identity" "current" {}
 
 resource "aws_iam_role" "deploy" {
-  name = substr("${var.prefix}-terraform", 0, 63)
+  name = "${substr("${var.prefix}-terraform", 0, 54)}-${substr(md5("${var.prefix}-terraform"), 0, 8)}"
 
   permissions_boundary = aws_iam_policy.deploy_boundary.arn
   assume_role_policy = templatefile("${path.module}/policies/assume-role-for-account.json", {

modules/webhook/direct/webhook.tf

@@ -90,7 +90,7 @@ data "aws_iam_policy_document" "lambda_assume_role_policy" {
 }
 
 resource "aws_iam_role" "webhook_lambda" {
-  name                 = substr("${var.config.prefix}-direct-webhook-lambda-role", 0, 63)
+  name                 = "${substr("${var.config.prefix}-direct-webhook-lambda-role", 0, 54)}-${substr(md5("${var.config.prefix}-direct-webhook-lambda-role"), 0, 8)}"
   assume_role_policy   = data.aws_iam_policy_document.lambda_assume_role_policy.json
   path                 = var.config.role_path
   permissions_boundary = var.config.role_permissions_boundary

modules/webhook/eventbridge/dispatcher.tf

@@ -85,7 +85,7 @@ resource "aws_lambda_permission" "allow_cloudwatch_to_call_lambda" {
 }
 
 resource "aws_iam_role" "dispatcher_lambda" {
-  name                 = substr("${var.config.prefix}-dispatcher-lambda-role", 0, 63)
+  name                 = "${substr("${var.config.prefix}-dispatcher-lambda-role", 0, 54)}-${substr(md5("${var.config.prefix}-dispatcher-lambda-role"), 0, 8)}"
   assume_role_policy   = data.aws_iam_policy_document.lambda_assume_role_policy.json
   path                 = var.config.role_path
   permissions_boundary = var.config.role_permissions_boundary