feat(iam): Add permissions_boundary variable (#26)

Co-authored-by: Bjorn Olsen <[email protected]>

Author: baolsen

README.md

@@ -85,6 +85,7 @@ Check [examples](./examples) for non-python examples.
 | <a name="input_lambda_kms_key_arn"></a> [lambda\_kms\_key\_arn](#input\_lambda\_kms\_key\_arn) | The ARN of the KMS Key to use when encrypting environment variables. Ignored unless `environment` is specified. | `string` | no |
 | <a name="input_layers"></a> [layers](#input\_layers) | List of Lambda Layer Version ARNs (maximum of 5) to attach to your Lambda Function. | `list(string)` | no |
 | <a name="input_memory_size"></a> [memory\_size](#input\_memory\_size) | Amount of memory in MB your Lambda Function can use at runtime. | `number` | no |
+| <a name="input_permissions_boundary"></a> [permissions\_boundary](#input\_permissions\_boundary) | ARN of the policy that is used to set the permissions boundary for the role. | `string` | no |
 | <a name="input_policy_arns"></a> [policy\_arns](#input\_policy\_arns) | A list of IAM policy ARNs attached to the lambda function. | `list(string)` | no |
 | <a name="input_publish"></a> [publish](#input\_publish) | Whether to publish creation/change as new Lambda Function Version. | `bool` | no |
 | <a name="input_reserved_concurrent_executions"></a> [reserved\_concurrent\_executions](#input\_reserved\_concurrent\_executions) | The amount of reserved concurrent executions for this lambda function. A value of 0 disables lambda from being triggered and -1 removes any concurrency limitations. | `number` | no |

main.tf

@@ -25,6 +25,8 @@ resource "aws_iam_role" "this" {
   name_prefix        = var.iam_role_name_prefix
   assume_role_policy = data.aws_iam_policy_document.assume.json
 
+  permissions_boundary = var.permissions_boundary
+
   tags = var.tags
 }
 

variables.tf

@@ -61,6 +61,12 @@ variable "policy_arns" {
   default     = []
 }
 
+variable "permissions_boundary" {
+  description = "ARN of the policy that is used to set the permissions boundary for the role."
+  type        = string
+  default     = null
+}
+
 #---------------------------------------------------------------------------------------------------
 # CloudWatch Log Group arguments
 #---------------------------------------------------------------------------------------------------