Skip to content

Commit e3eefb9

Browse files
bryantbiggsbryantbiggs
committed
feat: Bump min supported versions of Terraform and AWS provider
1 parent bccf109 commit e3eefb9

File tree

45 files changed

+332
-104
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+332
-104
lines changed

‎UPGRADE-6.0.md

Lines changed: 233 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,233 @@
1+
# Upgrade from v5.x to v6.x
2+
3+
If you have any questions regarding this upgrade process, please consult the [`examples`](https://github.com/terraform-aws-modules/terraform-aws-iam/tree/master/examples/) directory:
4+
5+
If you find a bug, please open an issue with supporting configuration to reproduce.
6+
7+
## List of backwards incompatible changes
8+
9+
- `iam-assumable-role` has been renamed to `iam-role`
10+
- `iam-assumable-role-with-oidc` has been renamed to `iam-role-oidc`
11+
- `iam-assumable-role-with-saml` has been renamed to `iam-role-saml`
12+
- `iam-assumable-roles` has been removed; `iam-role` should be used instead. See the [`iam-role` example](https://github.com/terraform-aws-modules/terraform-aws-iam/tree/master/examples/iam-role) that shows an example replacement implementation.
13+
- `iam-assumable-roles-with-saml` has been removed; `iam-role-saml` should be used instead. See the [`iam-role-saml` example](https://github.com/terraform-aws-modules/terraform-aws-iam/tree/master/examples/iam-role-saml) that shows an example replacement implementation.
14+
- `iam-github-oidc-provider` has been renamed to `iam-oidc-provider`
15+
- `iam-github-oidc-role` has been removed; `iam-role-oidc` should be used instead. See the [`iam-oidc-provider` example](https://github.com/terraform-aws-modules/terraform-aws-iam/tree/master/examples/iam-oidc-provider)
16+
- `iam-group-with-assumable-roles-policy` has been removed; the renamed `iam-group` (was `iam-group-with-policies`) should be used instead
17+
- `iam-eks-role` has been removed; `iam-role-for-service-accounts-eks` should be used instead
18+
- `iam-policy` has been removed; the `aws_iam_policy` resource should be used directly instead
19+
20+
## Additional changes
21+
22+
### Modified
23+
24+
- `iam-role`
25+
- The use of individual variables to control/manipulate the assume role trust policy have been replaced by a generic `assume_role_policy_statements` variable. This allows for any number of custom statements to be added to the role's trust policy.
26+
- `custom_role_policy_arns` has been renamed to `policies` and now accepts a map of `name`: `policy-arn` pairs; this allows for both existing policies and policies that will get created at the same time as the role. This also replaces the admin, readonly, and poweruser policy ARN variables and their associated `attach_*_policy` variables.
27+
- Default create conditional is now `true` instead of `false`
28+
- `force_detach_policies` has been removed; this is now always `true`
29+
- `iam-role-oidc`
30+
- `custom_role_policy_arns` has been renamed to `policies` and now accepts a map of `name`: `policy-arn` pairs; this allows for both existing policies and policies that will get created at the same time as the role.
31+
- Default create conditional is now `true` instead of `false`
32+
- `force_detach_policies` has been removed; this is now always `true`
33+
- `iam-role-saml`
34+
- `custom_role_policy_arns` has been renamed to `policies` and now accepts a map of `name`: `policy-arn` pairs; this allows for both existing policies and policies that will get created at the same time as the role.
35+
- Default create conditional is now `true` instead of `false`
36+
- `force_detach_policies` has been removed; this is now always `true`
37+
- `iam-group`
38+
- Policy management has been updated to support extending the policy created by the sub-module, as well as adding additional policies that will be attached to the group
39+
- The role assumption permissions has been removed from the policy; users can extend the policy to add this if needed via `permission_statements`
40+
- Default create conditional is now `true` instead of `false`
41+
42+
### Variable and output changes
43+
44+
1. Removed variables:
45+
46+
- `iam-role`
47+
- `trusted_role_actions`
48+
- `trusted_role_arns`
49+
- `trusted_role_services`
50+
- `mfa_age`
51+
- `role_requires_mfa`
52+
- `custom_role_trust_policy`
53+
- `number_of_custom_role_policy_arns`
54+
- `admin_role_policy_arn` & `attach_admin_policy`
55+
- `poweruser_role_policy_arn` & `attach_poweruser_policy`
56+
- `readonly_role_policy_arn` & `attach_readonly_policy`
57+
- `force_detach_policies`
58+
- `role_sts_externalid`
59+
- `iam-role-oidc`
60+
- `force_detach_policies`
61+
- `number_of_custom_role_policy_arns`
62+
- `iam-role-saml`
63+
- `force_detach_policies`
64+
- `number_of_custom_role_policy_arns`
65+
- `iam-group`
66+
- `custom_group_policies`
67+
- `assumable_roles`
68+
69+
2. Renamed variables:
70+
71+
- `iam-role`
72+
- `create_role` -> `create`
73+
- `role_name` -> `name`
74+
- `role_name_prefix` -> `name_prefix`
75+
- `role_description` -> `description`
76+
- `role_path` -> `path`
77+
- `role_permissions_boundary_arn` -> `permissions_boundary_arn`
78+
- `custom_role_policy_arns` -> `policies`
79+
- `iam-role-oidc`
80+
- `create_role` -> `create`
81+
- `role_name` -> `name`
82+
- `role_name_prefix` -> `name_prefix`
83+
- `role_description` -> `description`
84+
- `role_path` -> `path`
85+
- `role_permissions_boundary_arn` -> `permissions_boundary_arn`
86+
- `custom_role_policy_arns` -> `policies`
87+
- `iam-role-saml`
88+
- `create_role` -> `create`
89+
- `role_name` -> `name`
90+
- `role_name_prefix` -> `name_prefix`
91+
- `role_description` -> `description`
92+
- `role_path` -> `path`
93+
- `role_permissions_boundary_arn` -> `permissions_boundary_arn`
94+
- `custom_role_policy_arns` -> `policies`
95+
- `aws_saml_endpoint` -> `saml_endpoints`
96+
- `trusted_role_actions` -> `saml_trust_actions`
97+
- `iam-group`
98+
- `create_group` -> `create`
99+
- `group_users` -> `group`
100+
- `custom_group_policy_arns` -> `policies`
101+
- `attach_iam_self_management_policy` -> `create_policy`
102+
- `iam_self_management_policy_name_prefix` -> `policy_name_prefix`
103+
- `aws_account_id` -> `users_account_id`
104+
105+
3. Added variables:
106+
107+
- `iam-role`
108+
- `assume_role_policy_statements` which allows for any number of custom statements to be added to the role's trust policy. This covers the majority of the variables that were removed
109+
- `iam-role-oidc`
110+
- `assume_role_policy_statements` which allows for any number of custom statements to be added to the role's trust policy. This covers the majority of the variables that were removed
111+
- `iam-role-saml`
112+
- `assume_role_policy_statements` which allows for any number of custom statements to be added to the role's trust policy. This covers the majority of the variables that were removed
113+
- `iam-group`
114+
- `permission_statements` which allows for any number of custom statements to be added to the role's trust policy. This covers the majority of the variables that were removed
115+
- `path`/`policy_path`
116+
- `create_policy`
117+
- `enable_mfa_enforcment`
118+
119+
4. Removed outputs:
120+
121+
- `iam-role`
122+
- `iam_role_path`
123+
- `role_requires_mfa`
124+
- `iam_instance_profile_path`
125+
- `role_sts_externalid`
126+
- `iam-role-oidc`
127+
- `iam_role_path`
128+
- `provider_url` (use `oidc_provider_urls` instead)
129+
- `iam-role-saml`
130+
- `iam_role_path`
131+
- `provider_id` (use `saml_provider_ids` instead)
132+
- `iam-group`
133+
- `assumable_roles`
134+
- `aws_account_id`
135+
136+
5. Renamed outputs:
137+
138+
- `iam-role`
139+
- `iam_role_arn` -> `arn`
140+
- `iam_role_name` -> `name`
141+
- `iam_role_unique_id` -> `unique_id`
142+
- `iam_instance_profile_arn` -> `instance_profile_arn`
143+
- `iam_instance_profile_id` -> `instance_profile_id`
144+
- `iam_instance_profile_name` -> `instance_profile_name`
145+
- `iam_instance_profile_unique_id` -> `instance_profile_unique_id`
146+
- `iam-role-oidc`
147+
- `iam_role_arn` -> `arn`
148+
- `iam_role_name` -> `name`
149+
- `iam_role_unique_id` -> `unique_id`
150+
- `aws_account_id` -> `oidc_account_id`
151+
- `provider_urls` -> `oidc_provider_urls`
152+
- `iam-role-oidc`
153+
- `iam_role_arn` -> `arn`
154+
- `iam_role_name` -> `name`
155+
- `iam_role_unique_id` -> `unique_id`
156+
- `aws_account_id` -> `oidc_account_id`
157+
- `provider_ids` -> `saml_provider_ids`
158+
- `iam-group`
159+
- `group_id` -> `id`
160+
- `group_name` -> `name`
161+
- `group_arn` -> `arn`
162+
- `group_users` -> `users`
163+
164+
6. Added outputs:
165+
166+
- `iam-group`
167+
- `unique_id`
168+
- `policy_id`
169+
170+
### Diff of before <> after
171+
172+
#### `iam-role`
173+
174+
```diff
175+
module "iam_role" {
176+
- source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role"
177+
+ source = "terraform-aws-modules/iam/aws//modules/iam-role"
178+
- version = "~> 5.0"
179+
+ version = "~> 6.0"
180+
181+
- create_role = true
182+
+ create = true # is now `true` by default
183+
184+
- role_requires_mfa = true
185+
- trusted_role_arns = [
186+
- "arn:aws:iam::307990089504:root",
187+
- "arn:aws:iam::835367859851:user/anton",
188+
- ]
189+
- trusted_role_services = [
190+
- "codedeploy.amazonaws.com"
191+
- ]
192+
- role_sts_externalid = ["some-id-goes-here"]
193+
+ assume_role_policy_statements = [
194+
+ {
195+
+ sid = "TrustRoleAndServiceToAssume"
196+
+ principals = [
197+
+ {
198+
+ type = "AWS"
199+
+ identifiers = [
200+
+ "arn:aws:iam::307990089504:root",
201+
+ "arn:aws:iam::835367859851:user/anton",
202+
+ ]
203+
+ },
204+
+ {
205+
+ type = "Service"
206+
+ identifiers = ["codedeploy.amazonaws.com"]
207+
+ }
208+
+ ]
209+
+ conditions = [{
210+
+ test = "StringEquals"
211+
+ variable = "sts:ExternalId"
212+
+ values = ["some-secret-id"]
213+
+ }]
214+
+ }
215+
+ ]
216+
217+
- attach_admin_policy = true
218+
- custom_role_policy_arns = [
219+
- "arn:aws:iam::aws:policy/AmazonCognitoReadOnly",
220+
- "arn:aws:iam::aws:policy/AlexaForBusinessFullAccess",
221+
- module.iam_policy.arn
222+
- ]
223+
+ policies = {
224+
+ AdministratorAccess = "arn:aws:iam::aws:policy/AdministratorAccess"
225+
+ AmazonCognitoReadOnly = "arn:aws:iam::aws:policy/AmazonCognitoReadOnly"
226+
+ AlexaForBusinessFullAccess = "arn:aws:iam::aws:policy/AlexaForBusinessFullAccess"
227+
+ custom = module.iam_policy.arn
228+
+ }
229+
}
230+
231+
### State Changes
232+
233+
None

‎examples/iam-account/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@ Run `terraform destroy` when you don't need these resources.
1919

2020
| Name | Version |
2121
|------|---------|
22-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
23-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.0 |
22+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.7 |
23+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.0 |
2424

2525
## Providers
2626

‎examples/iam-account/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
terraform {
2-
required_version = ">= 1.0"
2+
required_version = ">= 1.5.7"
33

44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 4.0"
7+
version = ">= 6.0"
88
}
99
}
1010
}

‎examples/iam-group/README.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,14 +19,14 @@ Run `terraform destroy` when you don't need these resources.
1919

2020
| Name | Version |
2121
|------|---------|
22-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
23-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.0 |
22+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.7 |
23+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.0 |
2424

2525
## Providers
2626

2727
| Name | Version |
2828
|------|---------|
29-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.0 |
29+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.0 |
3030

3131
## Modules
3232

‎examples/iam-group/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
terraform {
2-
required_version = ">= 1.0"
2+
required_version = ">= 1.5.7"
33

44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 4.0"
7+
version = ">= 6.0"
88
}
99
}
1010
}

‎examples/iam-oidc-provider/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,8 @@ Run `terraform destroy` when you don't need these resources.
2222

2323
| Name | Version |
2424
|------|---------|
25-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
26-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.0 |
25+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.7 |
26+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.0 |
2727

2828
## Providers
2929

‎examples/iam-oidc-provider/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
terraform {
2-
required_version = ">= 1.0"
2+
required_version = ">= 1.5.7"
33

44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 4.0"
7+
version = ">= 6.0"
88
}
99
}
1010
}

‎examples/iam-read-only-policy/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@ Run `terraform destroy` when you don't need these resources.
1919

2020
| Name | Version |
2121
|------|---------|
22-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
23-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.0 |
22+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.7 |
23+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.0 |
2424

2525
## Providers
2626

‎examples/iam-read-only-policy/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
terraform {
2-
required_version = ">= 1.0"
2+
required_version = ">= 1.5.7"
33

44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 4.0"
7+
version = ">= 6.0"
88
}
99
}
1010
}

‎examples/iam-role-for-service-accounts/README.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,14 +19,14 @@ Run `terraform destroy` when you don't need these resources.
1919

2020
| Name | Version |
2121
|------|---------|
22-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
23-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.0 |
22+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.7 |
23+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.0 |
2424

2525
## Providers
2626

2727
| Name | Version |
2828
|------|---------|
29-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.0 |
29+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.0 |
3030

3131
## Modules
3232

0 commit comments

Comments
 (0)