You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Creates an OpenID connect provider. Useful for trusting external identity providers such as GitHub, Bitbucket, etc.
69
69
70
-
⚠️ An IAM provider is 1 per account per given URL. This module would be provisioned once per AWS account, and then one or more roles can be created with this provider as the trusted identity.
70
+
> [!TIP]
71
+
> An IAM provider is 1 per account per given URL. This module would be provisioned once per AWS account, and then one or more roles can be created with this provider as the trusted identity.
Copy file name to clipboardExpand all lines: docs/UPGRADE-6.0.md
+32-13Lines changed: 32 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,6 +6,8 @@ If you find a bug, please open an issue with supporting configuration to reprodu
6
6
7
7
## List of backwards incompatible changes
8
8
9
+
- Terraform `v1.5.7` is now minimum supported version
10
+
- AWS provider `v6.0.0` is now minimum supported version
9
11
- The ability to allow roles to assume their own roles has been removed. This was previously added as part of helping users mitigate https://aws.amazon.com/blogs/security/announcing-an-update-to-iam-role-trust-policy-behavior/. Going forward, users will need to mitigate this on the application side (i.e. - do not have a role assume itself), or update the trust policy in their implementation to continue using this behavior. It is strongly recommended to mitigate this by not having the role assume itself.
10
12
11
13
-`iam-account`:
@@ -21,7 +23,7 @@ If you find a bug, please open an issue with supporting configuration to reprodu
21
23
-`iam-group-with-assumable-roles-policy` has been merged into `iam-group`
22
24
-`iam-eks-role` has been removed; `iam-role-for-service-accounts` or [`eks-pod-identity`](https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity) should be used instead
23
25
-`iam-policy` has been removed; the `aws_iam_policy` resource should be used directly instead
24
-
-`iam-role-for-service-accounts`:
26
+
-`iam-role-for-service-accounts-eks` has been renamed to `iam-role-for-service-accounts`
25
27
- Individual policy creation and attachment has been consolidated under one policy creation and attachment
26
28
- Default values that enable permissive permissions have been removed; users will need to be explicit about the scope of access (i.e. ARNs) they provide when enabling permissions
27
29
- AppMesh policy support has been removed due to service reaching end of support
@@ -63,15 +65,20 @@ stateDiagram
63
65
64
66
### Modified
65
67
68
+
- Variable definitions now contain detailed `object` types in place of the previously used any type
69
+
66
70
-`iam-group`
67
71
- Policy management has been updated to support extending the policy created by the sub-module, as well as adding additional policies that will be attached to the group
68
-
- The role assumption permissions has been removed from the policy; users can extend the policy to add this if needed via `permission_statements`
72
+
- The role assumption permissions has been removed from the policy; users can extend the policy to add this if needed via `permissions`
69
73
- Default create conditional is now `true` instead of `false`
70
74
-`iam-role`
71
-
- The use of individual variables to control/manipulate the assume role trust policy have been replaced by a generic `assume_role_policy_statements` variable. This allows for any number of custom statements to be added to the role's trust policy.
75
+
- The use of individual variables to control/manipulate the assume role trust policy have been replaced by a generic `trust_policy_permissions` variable. This allows for any number of custom statements to be added to the role's trust policy.
72
76
-`custom_role_policy_arns` has been renamed to `policies` and now accepts a map of `name`: `policy-arn` pairs; this allows for both existing policies and policies that will get created at the same time as the role. This also replaces the admin, readonly, and poweruser policy ARN variables and their associated `attach_*_policy` variables.
73
77
- Default create conditional is now `true` instead of `false`
74
78
-`force_detach_policies` has been removed; this is now always `true`
79
+
- Support for inline policies has been added
80
+
-`iam-role-for-service-accounts`
81
+
- Support for inline policies has been added
75
82
76
83
### Variable and output changes
77
84
@@ -85,7 +92,7 @@ stateDiagram
85
92
-`iam-oidc-provider`
86
93
-`additional_thumbprints` - no longer required by GitHub
87
94
-`iam-read-only-policy`
88
-
-None
95
+
-`additional_policy_json` - use `source_inline_policy_documents` or `override_inline_policy_documents` instead
-`permission_statements` which allows for any number of custom statements to be added to the role's trust policy. This covers the majority of the variables that were removed
174
+
-`permissions` which allows for any number of custom statements to be added to the role's trust policy. This covers the majority of the variables that were removed
167
175
-`path`/`policy_path`
168
176
-`create_policy`
169
177
-`enable_mfa_enforcment`
170
178
-`iam-oidc-provider`
171
179
- None
172
180
-`iam-read-only-policy`
173
181
-`create`
182
+
-`source_policy_documents`
183
+
-`override_policy_documents`
174
184
-`iam-role`
175
-
-`assume_role_policy_statements` which allows for any number of custom statements to be added to the role's trust policy. This covers the majority of the variables that were removed
185
+
-`trust_policy_permissions` which allows for any number of custom statements to be added to the role's trust policy. This covers the majority of the variables that were removed
| <aname="input_enable_self_management_permissions"></a> [enable\_self\_management\_permissions](#input\_enable\_self\_management\_permissions)| Determines whether permissions are added to the policy which allow the groups IAM users to manage their credentials and MFA |`bool`|`true`| no |
77
77
| <aname="input_name"></a> [name](#input\_name)| The group's name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: `=,.@-_.`|`string`|`""`| no |
78
78
| <aname="input_path"></a> [path](#input\_path)| Path in which to create the group |`string`|`null`| no |
79
-
| <aname="input_permission_statements"></a> [permission\_statements](#input\_permission\_statements)| A map of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for custom permission usage| <pre>map(object({<br/> sid = optional(string)<br/> actions = optional(list(string))<br/> not_actions = optional(list(string))<br/> effect = optional(string, "Allow")<br/> resources = optional(list(string))<br/> not_resources = optional(list(string))<br/> principals = optional(list(object({<br/> type = string<br/> identifiers = list(string)<br/> })))<br/> not_principals = optional(list(object({<br/> type = string<br/> identifiers = list(string)<br/> })))<br/> condition = optional(list(object({<br/> test = string<br/> variable = string<br/> values = list(string)<br/> })))<br/> }))</pre> |`null`| no |
79
+
| <aname="input_permissions"></a> [permissions](#input\_permissions)| A map of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for custom permissions| <pre>map(object({<br/> sid = optional(string)<br/> actions = optional(list(string))<br/> not_actions = optional(list(string))<br/> effect = optional(string, "Allow")<br/> resources = optional(list(string))<br/> not_resources = optional(list(string))<br/> principals = optional(list(object({<br/> type = string<br/> identifiers = list(string)<br/> })))<br/> not_principals = optional(list(object({<br/> type = string<br/> identifiers = list(string)<br/> })))<br/> condition = optional(list(object({<br/> test = string<br/> variable = string<br/> values = list(string)<br/> })))<br/> }))</pre> |`null`| no |
80
80
| <aname="input_policies"></a> [policies](#input\_policies)| Policies to attach to the IAM role in `{'static_name' = 'policy_arn'}` format |`map(string)`|`{}`| no |
81
81
| <aname="input_policy_description"></a> [policy\_description](#input\_policy\_description)| Description of the IAM policy |`string`|`null`| no |
82
82
| <aname="input_policy_name"></a> [policy\_name](#input\_policy\_name)| Name to use on IAM policy created |`string`|`null`| no |
description="A map of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for custom permission usage"
57
+
variable"permissions" {
58
+
description="A map of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for custom permissions"
| <aname="input_additional_policy_json"></a> [additional\_policy\_json](#input\_additional\_policy\_json)| JSON policy document if you want to add custom actions |`string`|`""`| no |
56
55
| <aname="input_allow_cloudwatch_logs_query"></a> [allow\_cloudwatch\_logs\_query](#input\_allow\_cloudwatch\_logs\_query)| Allows StartQuery/StopQuery/FilterLogEvents CloudWatch actions |`bool`|`true`| no |
57
56
| <aname="input_allow_predefined_sts_actions"></a> [allow\_predefined\_sts\_actions](#input\_allow\_predefined\_sts\_actions)| Allows GetCallerIdentity/GetSessionToken/GetAccessKeyInfo sts actions |`bool`|`true`| no |
58
57
| <aname="input_allow_web_console_services"></a> [allow\_web\_console\_services](#input\_allow\_web\_console\_services)| Allows List/Get/Describe/View actions for services used when browsing AWS console (e.g. resource-groups, tag, health services) |`bool`|`true`| no |
59
58
| <aname="input_allowed_services"></a> [allowed\_services](#input\_allowed\_services)| List of services to allow Get/List/Describe/View options. Service name should be the same as corresponding service IAM prefix. See what it is for each service here https://docs.aws.amazon.com/service-authorization/latest/reference/reference_policies_actions-resources-contextkeys.html|`list(string)`|`[]`| no |
60
59
| <aname="input_create"></a> [create](#input\_create)| Controls if resources should be created (affects all resources) |`bool`|`true`| no |
61
60
| <aname="input_create_policy"></a> [create\_policy](#input\_create\_policy)| Controls if IAM policy should be created. Set to `false` to generate the policy JSON without creating the policy itself |`bool`|`true`| no |
62
-
| <aname="input_description"></a> [description](#input\_description)| The description of the policy |`string`|`"IAM Policy"`| no |
61
+
| <aname="input_description"></a> [description](#input\_description)| The description of the policy |`string`|`null`| no |
63
62
| <aname="input_name"></a> [name](#input\_name)| Name to use on IAM policy created |`string`|`null`| no |
64
-
| <aname="input_path"></a> [path](#input\_path)| Path of IAM policy |`string`|`"/"`| no |
63
+
| <aname="input_override_inline_policy_documents"></a> [override\_inline\_policy\_documents](#input\_override\_inline\_policy\_documents)| List of IAM policy documents that are merged together into the exported document. In merging, statements with non-blank `sid`s will override statements with the same `sid`|`list(string)`|`[]`| no |
64
+
| <aname="input_path"></a> [path](#input\_path)| Path of IAM policy |`string`|`null`| no |
65
+
| <aname="input_source_inline_policy_documents"></a> [source\_inline\_policy\_documents](#input\_source\_inline\_policy\_documents)| List of IAM policy documents that are merged together into the exported document. Statements must have unique `sid`s |`list(string)`|`[]`| no |
65
66
| <aname="input_tags"></a> [tags](#input\_tags)| A map of tags to add to all resources |`map(string)`|`{}`| no |
66
67
| <aname="input_use_name_prefix"></a> [use\_name\_prefix](#input\_use\_name\_prefix)| Determines whether the IAM policy name (`name`) is used as a prefix |`bool`|`true`| no |
67
68
| <aname="input_web_console_services"></a> [web\_console\_services](#input\_web\_console\_services)| List of web console services to allow |`list(string)`| <pre>[<br/> "resource-groups",<br/> "tag",<br/> "health",<br/> "ce"<br/>]</pre> | no |
0 commit comments