feat: add option to attach a permissions boundary

It is now possible to attach a permissions boundary to
the cloudbench role.

Author: quentin-laplanche

modules/services/cloud-bench/main.tf

@@ -69,9 +69,10 @@ data "aws_iam_policy_document" "trust_relationship" {
 resource "aws_iam_role" "cloudbench_role" {
   count = var.is_organizational && !var.provision_caller_account ? 0 : 1
 
-  name               = var.name
-  assume_role_policy = data.aws_iam_policy_document.trust_relationship.json
-  tags               = var.tags
+  name                 = var.name
+  assume_role_policy   = data.aws_iam_policy_document.trust_relationship.json
+  tags                 = var.tags
+  permissions_boundary = var.permissions_boundary_arn
 }
 
 

modules/services/cloud-bench/variables.tf

@@ -34,3 +34,9 @@ variable "tags" {
     "product" = "sysdig-secure-for-cloud"
   }
 }
+
+variable "permissions_boundary_arn" {
+  type        = string
+  description = "ARN of a permissions boundary policy to attach to the cloudbench role"
+  default     = null
+}