Skip to content

Commit a43eb37

Browse files
bryantbiggsbryantbiggs
committed
feat: Add inline policy support to IRSA sub-module
1 parent bb2a465 commit a43eb37

File tree

4 files changed

+96
-0
lines changed

4 files changed

+96
-0
lines changed

‎modules/iam-role-for-service-accounts/README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,7 @@ No modules.
143143
|------|------|
144144
| [aws_iam_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
145145
| [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
146+
| [aws_iam_role_policy.inline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
146147
| [aws_iam_role_policy_attachment.additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
147148
| [aws_iam_role_policy_attachment.amazon_cloudwatch_observability](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
148149
| [aws_iam_role_policy_attachment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
@@ -157,6 +158,7 @@ No modules.
157158
| [aws_iam_policy_document.external_secrets](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
158159
| [aws_iam_policy_document.fsx_lustre_csi](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
159160
| [aws_iam_policy_document.fsx_openzfs_csi](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
161+
| [aws_iam_policy_document.inline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
160162
| [aws_iam_policy_document.load_balancer_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
161163
| [aws_iam_policy_document.load_balancer_controller_targetgroup_only](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
162164
| [aws_iam_policy_document.mountpoint_s3_csi](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
@@ -202,6 +204,7 @@ No modules.
202204
| <a name="input_external_secrets_ssm_parameter_arns"></a> [external\_secrets\_ssm\_parameter\_arns](#input\_external\_secrets\_ssm\_parameter\_arns) | List of Systems Manager Parameter ARNs that contain secrets to mount using External Secrets | `list(string)` | `[]` | no |
203205
| <a name="input_fsx_lustre_csi_service_role_arns"></a> [fsx\_lustre\_csi\_service\_role\_arns](#input\_fsx\_lustre\_csi\_service\_role\_arns) | Service role ARNs to allow FSx for Lustre CSI create and manage FSX for Lustre service linked roles | `list(string)` | <pre>[<br/> "arn:aws:iam::*:role/aws-service-role/s3.data-source.lustre.fsx.amazonaws.com/*"<br/>]</pre> | no |
204206
| <a name="input_fsx_openzfs_csi_service_role_arns"></a> [fsx\_openzfs\_csi\_service\_role\_arns](#input\_fsx\_openzfs\_csi\_service\_role\_arns) | Service role ARNs to allow FSx for OpenZFS CSI create and manage FSX for openzfs service linked roles | `list(string)` | <pre>[<br/> "arn:aws:iam::*:role/aws-service-role/fsx.amazonaws.com/*"<br/>]</pre> | no |
207+
| <a name="input_inline_policy_statements"></a> [inline\_policy\_statements](#input\_inline\_policy\_statements) | A map of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for inline policy permissions | <pre>map(object({<br/> sid = optional(string)<br/> actions = optional(list(string))<br/> not_actions = optional(list(string))<br/> effect = optional(string, "Allow")<br/> resources = optional(list(string))<br/> not_resources = optional(list(string))<br/> principals = optional(list(object({<br/> type = string<br/> identifiers = list(string)<br/> })))<br/> not_principals = optional(list(object({<br/> type = string<br/> identifiers = list(string)<br/> })))<br/> condition = optional(list(object({<br/> test = string<br/> variable = string<br/> values = list(string)<br/> })))<br/> }))</pre> | `null` | no |
205208
| <a name="input_load_balancer_controller_targetgroup_arns"></a> [load\_balancer\_controller\_targetgroup\_arns](#input\_load\_balancer\_controller\_targetgroup\_arns) | List of Target groups ARNs using Load Balancer Controller | `list(string)` | `[]` | no |
206209
| <a name="input_max_session_duration"></a> [max\_session\_duration](#input\_max\_session\_duration) | Maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours | `number` | `null` | no |
207210
| <a name="input_mountpoint_s3_csi_bucket_arns"></a> [mountpoint\_s3\_csi\_bucket\_arns](#input\_mountpoint\_s3\_csi\_bucket\_arns) | S3 bucket ARNs to allow Mountpoint S3 CSI to list buckets | `list(string)` | `[]` | no |

‎modules/iam-role-for-service-accounts/main.tf

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -163,3 +163,65 @@ resource "aws_iam_role_policy_attachment" "this" {
163163
role = aws_iam_role.this[0].name
164164
policy_arn = aws_iam_policy.this[0].arn
165165
}
166+
167+
################################################################################
168+
# IAM Role Inline policy
169+
################################################################################
170+
171+
locals {
172+
create_iam_role_inline_policy = var.create && length(var.inline_policy_statements) > 0
173+
}
174+
175+
data "aws_iam_policy_document" "inline" {
176+
count = local.create_iam_role_inline_policy ? 1 : 0
177+
178+
dynamic "statement" {
179+
for_each = var.inline_policy_statements != null ? var.inline_policy_statements : {}
180+
181+
content {
182+
sid = try(coalesce(statement.value.sid, statement.key))
183+
actions = statement.value.actions
184+
not_actions = statement.value.not_actions
185+
effect = statement.value.effect
186+
resources = statement.value.resources
187+
not_resources = statement.value.not_resources
188+
189+
dynamic "principals" {
190+
for_each = statement.value.principals != null ? statement.value.principals : []
191+
192+
content {
193+
type = principals.value.type
194+
identifiers = principals.value.identifiers
195+
}
196+
}
197+
198+
dynamic "not_principals" {
199+
for_each = statement.value.not_principals != null ? statement.value.not_principals : []
200+
201+
content {
202+
type = not_principals.value.type
203+
identifiers = not_principals.value.identifiers
204+
}
205+
}
206+
207+
dynamic "condition" {
208+
for_each = statement.value.condition != null ? statement.value.condition : []
209+
210+
content {
211+
test = condition.value.test
212+
values = condition.value.values
213+
variable = condition.value.variable
214+
}
215+
}
216+
}
217+
}
218+
}
219+
220+
resource "aws_iam_role_policy" "inline" {
221+
count = local.create_iam_role_inline_policy ? 1 : 0
222+
223+
role = aws_iam_role.this[0].name
224+
name = var.use_name_prefix ? null : var.name
225+
name_prefix = var.use_name_prefix ? "${var.name}-" : null
226+
policy = data.aws_iam_policy_document.inline[0].json
227+
}

‎modules/iam-role-for-service-accounts/variables.tf

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -377,3 +377,33 @@ variable "attach_cloudwatch_observability_policy" {
377377
type = bool
378378
default = false
379379
}
380+
381+
################################################################################
382+
# IAM Role Inline policy
383+
################################################################################
384+
385+
variable "inline_policy_statements" {
386+
description = "A map of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for inline policy permissions"
387+
type = map(object({
388+
sid = optional(string)
389+
actions = optional(list(string))
390+
not_actions = optional(list(string))
391+
effect = optional(string, "Allow")
392+
resources = optional(list(string))
393+
not_resources = optional(list(string))
394+
principals = optional(list(object({
395+
type = string
396+
identifiers = list(string)
397+
})))
398+
not_principals = optional(list(object({
399+
type = string
400+
identifiers = list(string)
401+
})))
402+
condition = optional(list(object({
403+
test = string
404+
variable = string
405+
values = list(string)
406+
})))
407+
}))
408+
default = null
409+
}

‎wrappers/iam-role-for-service-accounts/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ module "wrapper" {
3535
external_secrets_ssm_parameter_arns = try(each.value.external_secrets_ssm_parameter_arns, var.defaults.external_secrets_ssm_parameter_arns, [])
3636
fsx_lustre_csi_service_role_arns = try(each.value.fsx_lustre_csi_service_role_arns, var.defaults.fsx_lustre_csi_service_role_arns, ["arn:aws:iam::*:role/aws-service-role/s3.data-source.lustre.fsx.amazonaws.com/*"])
3737
fsx_openzfs_csi_service_role_arns = try(each.value.fsx_openzfs_csi_service_role_arns, var.defaults.fsx_openzfs_csi_service_role_arns, ["arn:aws:iam::*:role/aws-service-role/fsx.amazonaws.com/*"])
38+
inline_policy_statements = try(each.value.inline_policy_statements, var.defaults.inline_policy_statements, null)
3839
load_balancer_controller_targetgroup_arns = try(each.value.load_balancer_controller_targetgroup_arns, var.defaults.load_balancer_controller_targetgroup_arns, [])
3940
max_session_duration = try(each.value.max_session_duration, var.defaults.max_session_duration, null)
4041
mountpoint_s3_csi_bucket_arns = try(each.value.mountpoint_s3_csi_bucket_arns, var.defaults.mountpoint_s3_csi_bucket_arns, [])

0 commit comments

Comments
 (0)