Skip to content

Commit 3d29d26

Browse files
bryantbiggsbryantbiggs
authored
feat: Add support for roles created to explicitly assume their own role if desired (#281)
1 parent 7c96f1f commit 3d29d26

File tree

23 files changed

+232
-35
lines changed

23 files changed

+232
-35
lines changed

‎examples/iam-assumable-role/main.tf

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ provider "aws" {
88
module "iam_assumable_role_admin" {
99
source = "../../modules/iam-assumable-role"
1010

11+
# https://aws.amazon.com/blogs/security/announcing-an-update-to-iam-role-trust-policy-behavior/
12+
allow_self_assume_role = true
13+
1114
trusted_role_arns = [
1215
"arn:aws:iam::307990089504:root",
1316
"arn:aws:iam::835367859851:user/anton",
@@ -127,16 +130,6 @@ data "aws_iam_policy_document" "custom_trust_policy" {
127130
identifiers = ["*"]
128131
}
129132
}
130-
131-
statement {
132-
effect = "Deny"
133-
actions = ["sts:AssumeRole"]
134-
135-
principals {
136-
type = "AWS"
137-
identifiers = ["arn:aws:iam::111111111111:root"]
138-
}
139-
}
140133
}
141134

142135
#########################################

‎modules/iam-assumable-role-with-oidc/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ No modules.
3838

3939
| Name | Description | Type | Default | Required |
4040
|------|-------------|------|---------|:--------:|
41+
| <a name="input_allow_self_assume_role"></a> [allow\_self\_assume\_role](#input\_allow\_self\_assume\_role) | Determines whether to allow the role to be [assume itself](https://aws.amazon.com/blogs/security/announcing-an-update-to-iam-role-trust-policy-behavior/) | `bool` | `false` | no |
4142
| <a name="input_aws_account_id"></a> [aws\_account\_id](#input\_aws\_account\_id) | The AWS account ID where the OIDC provider lives, leave empty to use the account for the AWS provider | `string` | `""` | no |
4243
| <a name="input_create_role"></a> [create\_role](#input\_create\_role) | Whether to create a role | `bool` | `false` | no |
4344
| <a name="input_force_detach_policies"></a> [force\_detach\_policies](#input\_force\_detach\_policies) | Whether policies should be detached from this role when destroying | `bool` | `false` | no |

‎modules/iam-assumable-role-with-oidc/main.tf

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,18 +9,32 @@ locals {
99
}
1010

1111
data "aws_caller_identity" "current" {}
12-
1312
data "aws_partition" "current" {}
1413

1514
data "aws_iam_policy_document" "assume_role_with_oidc" {
1615
count = var.create_role ? 1 : 0
1716

1817
dynamic "statement" {
19-
for_each = local.urls
18+
# https://aws.amazon.com/blogs/security/announcing-an-update-to-iam-role-trust-policy-behavior/
19+
for_each = var.allow_self_assume_role ? [1] : []
2020

2121
content {
22-
effect = "Allow"
22+
sid = "ExplicitSelfRoleAssumption"
23+
effect = "Allow"
24+
actions = ["sts:AssumeRole"]
2325

26+
principals {
27+
type = "AWS"
28+
identifiers = ["arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:role${var.role_path}${var.role_name}"]
29+
}
30+
}
31+
}
32+
33+
dynamic "statement" {
34+
for_each = local.urls
35+
36+
content {
37+
effect = "Allow"
2438
actions = ["sts:AssumeRoleWithWebIdentity"]
2539

2640
principals {

‎modules/iam-assumable-role-with-oidc/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,3 +99,9 @@ variable "force_detach_policies" {
9999
type = bool
100100
default = false
101101
}
102+
103+
variable "allow_self_assume_role" {
104+
description = "Determines whether to allow the role to be [assume itself](https://aws.amazon.com/blogs/security/announcing-an-update-to-iam-role-trust-policy-behavior/)"
105+
type = bool
106+
default = false
107+
}

‎modules/iam-assumable-role-with-saml/README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,12 +29,15 @@ No modules.
2929
|------|------|
3030
| [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
3131
| [aws_iam_role_policy_attachment.custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
32+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
3233
| [aws_iam_policy_document.assume_role_with_saml](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
34+
| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
3335

3436
## Inputs
3537

3638
| Name | Description | Type | Default | Required |
3739
|------|-------------|------|---------|:--------:|
40+
| <a name="input_allow_self_assume_role"></a> [allow\_self\_assume\_role](#input\_allow\_self\_assume\_role) | Determines whether to allow the role to be [assume itself](https://aws.amazon.com/blogs/security/announcing-an-update-to-iam-role-trust-policy-behavior/) | `bool` | `false` | no |
3841
| <a name="input_aws_saml_endpoint"></a> [aws\_saml\_endpoint](#input\_aws\_saml\_endpoint) | AWS SAML Endpoint | `string` | `"https://signin.aws.amazon.com/saml"` | no |
3942
| <a name="input_create_role"></a> [create\_role](#input\_create\_role) | Whether to create a role | `bool` | `false` | no |
4043
| <a name="input_force_detach_policies"></a> [force\_detach\_policies](#input\_force\_detach\_policies) | Whether policies should be detached from this role when destroying | `bool` | `false` | no |

‎modules/iam-assumable-role-with-saml/main.tf

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,30 @@
1+
data "aws_caller_identity" "current" {}
2+
data "aws_partition" "current" {}
3+
14
locals {
25
identifiers = compact(distinct(concat(var.provider_ids, [var.provider_id])))
36
number_of_role_policy_arns = coalesce(var.number_of_role_policy_arns, length(var.role_policy_arns))
47
}
58

69
data "aws_iam_policy_document" "assume_role_with_saml" {
7-
statement {
8-
effect = "Allow"
10+
dynamic "statement" {
11+
# https://aws.amazon.com/blogs/security/announcing-an-update-to-iam-role-trust-policy-behavior/
12+
for_each = var.allow_self_assume_role ? [1] : []
913

14+
content {
15+
sid = "ExplicitSelfRoleAssumption"
16+
effect = "Allow"
17+
actions = ["sts:AssumeRole"]
18+
19+
principals {
20+
type = "AWS"
21+
identifiers = ["arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:role${var.role_path}${var.role_name}"]
22+
}
23+
}
24+
}
25+
26+
statement {
27+
effect = "Allow"
1028
actions = ["sts:AssumeRoleWithSAML"]
1129

1230
principals {

‎modules/iam-assumable-role-with-saml/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,3 +81,9 @@ variable "force_detach_policies" {
8181
type = bool
8282
default = false
8383
}
84+
85+
variable "allow_self_assume_role" {
86+
description = "Determines whether to allow the role to be [assume itself](https://aws.amazon.com/blogs/security/announcing-an-update-to-iam-role-trust-policy-behavior/)"
87+
type = bool
88+
default = false
89+
}

‎modules/iam-assumable-role/README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,14 +32,17 @@ No modules.
3232
| [aws_iam_role_policy_attachment.custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
3333
| [aws_iam_role_policy_attachment.poweruser](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
3434
| [aws_iam_role_policy_attachment.readonly](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
35+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
3536
| [aws_iam_policy_document.assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
3637
| [aws_iam_policy_document.assume_role_with_mfa](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
38+
| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
3739

3840
## Inputs
3941

4042
| Name | Description | Type | Default | Required |
4143
|------|-------------|------|---------|:--------:|
4244
| <a name="input_admin_role_policy_arn"></a> [admin\_role\_policy\_arn](#input\_admin\_role\_policy\_arn) | Policy ARN to use for admin role | `string` | `"arn:aws:iam::aws:policy/AdministratorAccess"` | no |
45+
| <a name="input_allow_self_assume_role"></a> [allow\_self\_assume\_role](#input\_allow\_self\_assume\_role) | Determines whether to allow the role to be [assume itself](https://aws.amazon.com/blogs/security/announcing-an-update-to-iam-role-trust-policy-behavior/) | `bool` | `false` | no |
4346
| <a name="input_attach_admin_policy"></a> [attach\_admin\_policy](#input\_attach\_admin\_policy) | Whether to attach an admin policy to a role | `bool` | `false` | no |
4447
| <a name="input_attach_poweruser_policy"></a> [attach\_poweruser\_policy](#input\_attach\_poweruser\_policy) | Whether to attach a poweruser policy to a role | `bool` | `false` | no |
4548
| <a name="input_attach_readonly_policy"></a> [attach\_readonly\_policy](#input\_attach\_readonly\_policy) | Whether to attach a readonly policy to a role | `bool` | `false` | no |

‎modules/iam-assumable-role/main.tf

Lines changed: 37 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,31 @@
1+
data "aws_caller_identity" "current" {}
2+
data "aws_partition" "current" {}
3+
14
locals {
25
role_sts_externalid = flatten([var.role_sts_externalid])
36
}
47

58
data "aws_iam_policy_document" "assume_role" {
69
count = var.custom_role_trust_policy == "" && var.role_requires_mfa ? 0 : 1
710

8-
statement {
9-
effect = "Allow"
11+
dynamic "statement" {
12+
# https://aws.amazon.com/blogs/security/announcing-an-update-to-iam-role-trust-policy-behavior/
13+
for_each = var.allow_self_assume_role ? [1] : []
14+
15+
content {
16+
sid = "ExplicitSelfRoleAssumption"
17+
effect = "Allow"
18+
actions = ["sts:AssumeRole"]
19+
20+
principals {
21+
type = "AWS"
22+
identifiers = ["arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:role${var.role_path}${var.role_name}"]
23+
}
24+
}
25+
}
1026

27+
statement {
28+
effect = "Allow"
1129
actions = var.trusted_role_actions
1230

1331
principals {
@@ -34,9 +52,24 @@ data "aws_iam_policy_document" "assume_role" {
3452
data "aws_iam_policy_document" "assume_role_with_mfa" {
3553
count = var.custom_role_trust_policy == "" && var.role_requires_mfa ? 1 : 0
3654

37-
statement {
38-
effect = "Allow"
55+
dynamic "statement" {
56+
# https://aws.amazon.com/blogs/security/announcing-an-update-to-iam-role-trust-policy-behavior/
57+
for_each = var.allow_self_assume_role ? [1] : []
58+
59+
content {
60+
sid = "ExplicitSelfRoleAssumption"
61+
effect = "Allow"
62+
actions = ["sts:AssumeRole"]
3963

64+
principals {
65+
type = "AWS"
66+
identifiers = ["arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:role${var.role_path}${var.role_name}"]
67+
}
68+
}
69+
}
70+
71+
statement {
72+
effect = "Allow"
4073
actions = var.trusted_role_actions
4174

4275
principals {

‎modules/iam-assumable-role/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,3 +142,9 @@ variable "role_sts_externalid" {
142142
type = any
143143
default = []
144144
}
145+
146+
variable "allow_self_assume_role" {
147+
description = "Determines whether to allow the role to be [assume itself](https://aws.amazon.com/blogs/security/announcing-an-update-to-iam-role-trust-policy-behavior/)"
148+
type = bool
149+
default = false
150+
}

0 commit comments

Comments
 (0)