From 2e88a0db7cc442182f2fa0f9ae9ef4fcb604c7ab Mon Sep 17 00:00:00 2001 From: oycyc Date: Wed, 27 Aug 2025 17:24:51 -0400 Subject: [PATCH 1/2] feat: allow additional custom IAM policy to attached EC2 role --- main.tf | 8 ++++++++ variables.tf | 12 ++++++++++++ 2 files changed, 20 insertions(+) diff --git a/main.tf b/main.tf index 4800c73..8cf7cbb 100644 --- a/main.tf +++ b/main.tf @@ -139,6 +139,14 @@ resource "aws_iam_role_policy" "session_logging" { policy = join("", data.aws_iam_policy_document.session_logging.*.json) } +resource "aws_iam_role_policy" "custom" { + count = length(var.custom_policy_document) > 0 ? 1 : 0 + + name = "${module.role_label.id}-${var.custom_policy_name}" + role = aws_iam_role.default.name + policy = var.custom_policy_document +} + resource "aws_iam_instance_profile" "default" { name = module.role_label.id role = aws_iam_role.default.name diff --git a/variables.tf b/variables.tf index 6bee8da..fd95fa6 100644 --- a/variables.tf +++ b/variables.tf @@ -212,3 +212,15 @@ variable "scale_in_protected_instances" { error_message = "scale_in_protected_instances must be one of Refresh, Ignore, or Wait" } } + +variable "custom_policy_document" { + description = "JSON policy document for custom permissions to attach to the SSM Agent role. If not provided, no custom policy will be attached." + type = string + default = "" +} + +variable "custom_policy_name" { + description = "Name for the custom policy. Only used if custom_policy_document is provided." + type = string + default = "custom-policy" +} From f87fa655a3c406a2eb43f2e3bf6af05c1cfa6072 Mon Sep 17 00:00:00 2001 From: oycyc Date: Wed, 27 Aug 2025 17:41:33 -0400 Subject: [PATCH 2/2] trunk terraform docs hooks --- .trunk/.gitignore | 2 +- .trunk/trunk.yaml | 16 ++++++++-------- README.md | 3 +++ 3 files changed, 12 insertions(+), 9 deletions(-) diff --git a/.trunk/.gitignore b/.trunk/.gitignore index 072b680..15966d0 100644 --- a/.trunk/.gitignore +++ b/.trunk/.gitignore @@ -6,4 +6,4 @@ plugins user_trunk.yaml user.yaml -tmp \ No newline at end of file +tmp diff --git a/.trunk/trunk.yaml b/.trunk/trunk.yaml index 331ad56..f47485c 100644 --- a/.trunk/trunk.yaml +++ b/.trunk/trunk.yaml @@ -2,12 +2,12 @@ # To learn more about the format of this file, see https://docs.trunk.io/reference/trunk-yaml version: 0.1 cli: - version: 1.24.0 + version: 1.25.0 # Trunk provides extensibility via plugins. (https://docs.trunk.io/plugins) plugins: sources: - id: trunk - ref: v1.7.1 + ref: v1.7.2 uri: https://github.com/trunk-io/plugins # Many linters and tools depend on runtimes - configure them here. (https://docs.trunk.io/runtimes) runtimes: @@ -20,16 +20,16 @@ lint: # Incompatible with some Terraform features: https://github.com/tenable/terrascan/issues/1331 - terrascan enabled: - - renovate@41.46.8 - - tofu@1.10.4 + - renovate@41.87.0 + - tofu@1.10.5 - actionlint@1.7.7 - - checkov@3.2.447 + - checkov@3.2.467 - git-diff-check - markdownlint@0.45.0 - prettier@3.6.2 - - tflint@0.58.0 - - trivy@0.63.0 - - trufflehog@3.89.2 + - tflint@0.58.1 + - trivy@0.65.0 + - trufflehog@3.90.5 - yamllint@1.37.1 ignore: - linters: [tofu] diff --git a/README.md b/README.md index 1c1b44b..a8c2cc0 100644 --- a/README.md +++ b/README.md @@ -111,6 +111,7 @@ Use [the awesome `gossm` project](https://github.com/gjbae1212/gossm). | [aws_cloudwatch_log_group.session_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource | | [aws_iam_instance_profile.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_instance_profile) | resource | | [aws_iam_role.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | +| [aws_iam_role_policy.custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource | | [aws_iam_role_policy.session_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource | | [aws_iam_role_policy_attachment.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | | [aws_launch_template.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template) | resource | @@ -141,6 +142,8 @@ Use [the awesome `gossm` project](https://github.com/gjbae1212/gossm). | [cloudwatch\_retention\_in\_days](#input\_cloudwatch\_retention\_in\_days) | The number of days to retain session logs in CloudWatch. This is only relevant if the session\_logging\_enabled variable is `true`. | `number` | `365` | no | | [context](#input\_context) | Single object for setting entire context at once.
See description of individual variables for details.
Leave string and numeric variables as `null` to use default value.
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | 
{
  "additional_tag_map": {},
  "attributes": [],
  "delimiter": null,
  "descriptor_formats": {},
  "enabled": true,
  "environment": null,
  "id_length_limit": null,
  "label_key_case": null,
  "label_order": [],
  "label_value_case": null,
  "labels_as_tags": [
    "unset"
  ],
  "name": null,
  "namespace": null,
  "regex_replace_chars": null,
  "stage": null,
  "tags": {},
  "tenant": null
}
| no | | [create\_run\_shell\_document](#input\_create\_run\_shell\_document) | Whether or not to create the SSM-SessionManagerRunShell SSM Document. | `bool` | `true` | no | +| [custom\_policy\_document](#input\_custom\_policy\_document) | JSON policy document for custom permissions to attach to the SSM Agent role. If not provided, no custom policy will be attached. | `string` | `""` | no | +| [custom\_policy\_name](#input\_custom\_policy\_name) | Name for the custom policy. Only used if custom\_policy\_document is provided. | `string` | `"custom-policy"` | no | | [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.
Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no | | [descriptor\_formats](#input\_descriptor\_formats) | Describe additional descriptors to be output in the `descriptors` output map.
Map of maps. Keys are names of descriptors. Values are maps of the form
`{
format = string
labels = list(string)
}`
(Type is `any` so the map values can later be enhanced to provide additional options.)
`format` is a Terraform format string to be passed to the `format()` function.
`labels` is a list of labels, in order, to pass to `format()` function.
Label values will be normalized before being passed to `format()` so they will be
identical to how they appear in `id`.
Default is `{}` (`descriptors` output will be empty). | `any` | `{}` | no | | [desired\_capacity](#input\_desired\_capacity) | Desired number of instances in the Auto Scaling Group | `number` | `1` | no |