fix: Change variable name from _ids to _arns

Author: bryantbiggs

modules/iam-role-for-service-accounts/README.md

@@ -188,7 +188,7 @@ No modules.
 | <a name="input_create"></a> [create](#input\_create) | Controls if resources should be created (affects all resources) | `bool` | `true` | no |
 | <a name="input_create_policy"></a> [create\_policy](#input\_create\_policy) | Whether to create an IAM policy that is attached to the IAM role created | `bool` | `true` | no |
 | <a name="input_description"></a> [description](#input\_description) | Description of the role | `string` | `null` | no |
-| <a name="input_ebs_csi_kms_cmk_ids"></a> [ebs\_csi\_kms\_cmk\_ids](#input\_ebs\_csi\_kms\_cmk\_ids) | KMS CMK IDs to allow EBS CSI to manage encrypted volumes | `list(string)` | `[]` | no |
+| <a name="input_ebs_csi_kms_cmk_arns"></a> [ebs\_csi\_kms\_cmk\_arns](#input\_ebs\_csi\_kms\_cmk\_arns) | KMS CMK ARNs to allow EBS CSI to manage encrypted volumes | `list(string)` | `[]` | no |
 | <a name="input_enable_irsa_v2"></a> [enable\_irsa\_v2](#input\_enable\_irsa\_v2) | Determines whether to add the new IRSAv2 IAM assume role trust policy | `bool` | `false` | no |
 | <a name="input_external_dns_hosted_zone_arns"></a> [external\_dns\_hosted\_zone\_arns](#input\_external\_dns\_hosted\_zone\_arns) | Route53 hosted zone ARNs to allow External DNS to manage records | `list(string)` | `[]` | no |
 | <a name="input_external_secrets_kms_key_arns"></a> [external\_secrets\_kms\_key\_arns](#input\_external\_secrets\_kms\_key\_arns) | List of KMS Key ARNs that are used by Secrets Manager that contain secrets to mount using External Secrets | `list(string)` | `[]` | no |

modules/iam-role-for-service-accounts/policies.tf

@@ -299,7 +299,7 @@ data "aws_iam_policy_document" "ebs_csi" {
   }
 
   dynamic "statement" {
-    for_each = length(var.ebs_csi_kms_cmk_ids) > 0 ? [1] : []
+    for_each = length(var.ebs_csi_kms_cmk_arns) > 0 ? [1] : []
 
     content {
       actions = [
@@ -308,7 +308,7 @@ data "aws_iam_policy_document" "ebs_csi" {
         "kms:RevokeGrant",
       ]
 
-      resources = var.ebs_csi_kms_cmk_ids
+      resources = var.ebs_csi_kms_cmk_arns
 
       condition {
         test     = "Bool"
@@ -319,7 +319,7 @@ data "aws_iam_policy_document" "ebs_csi" {
   }
 
   dynamic "statement" {
-    for_each = length(var.ebs_csi_kms_cmk_ids) > 0 ? [1] : []
+    for_each = length(var.ebs_csi_kms_cmk_arns) > 0 ? [1] : []
 
     content {
       actions = [
@@ -330,7 +330,7 @@ data "aws_iam_policy_document" "ebs_csi" {
         "kms:DescribeKey",
       ]
 
-      resources = var.ebs_csi_kms_cmk_ids
+      resources = var.ebs_csi_kms_cmk_arns
     }
   }
 }

modules/iam-role-for-service-accounts/variables.tf

@@ -184,8 +184,8 @@ variable "attach_ebs_csi_policy" {
   default     = false
 }
 
-variable "ebs_csi_kms_cmk_ids" {
-  description = "KMS CMK IDs to allow EBS CSI to manage encrypted volumes"
+variable "ebs_csi_kms_cmk_arns" {
+  description = "KMS CMK ARNs to allow EBS CSI to manage encrypted volumes"
   type        = list(string)
   default     = []
 }

wrappers/iam-role-for-service-accounts/main.tf

@@ -27,7 +27,7 @@ module "wrapper" {
   create                                                          = try(each.value.create, var.defaults.create, true)
   create_policy                                                   = try(each.value.create_policy, var.defaults.create_policy, true)
   description                                                     = try(each.value.description, var.defaults.description, null)
-  ebs_csi_kms_cmk_ids                                             = try(each.value.ebs_csi_kms_cmk_ids, var.defaults.ebs_csi_kms_cmk_ids, [])
+  ebs_csi_kms_cmk_arns                                            = try(each.value.ebs_csi_kms_cmk_arns, var.defaults.ebs_csi_kms_cmk_arns, [])
   enable_irsa_v2                                                  = try(each.value.enable_irsa_v2, var.defaults.enable_irsa_v2, false)
   external_dns_hosted_zone_arns                                   = try(each.value.external_dns_hosted_zone_arns, var.defaults.external_dns_hosted_zone_arns, [])
   external_secrets_kms_key_arns                                   = try(each.value.external_secrets_kms_key_arns, var.defaults.external_secrets_kms_key_arns, [])