Merge pull request #84 from worldcoin/copilot/sub-pr-83

Attach explicit-deny ELB policy to all matching LBC IAM roles

Author: danielllek

main.tf

@@ -71,7 +71,7 @@ data "aws_iam_roles" "aws_load_balancer_controller" {
 
 locals {
   aws_load_balancer_controller_role_exists = var.enable_aws_load_balancer_controller_explicit_deny ? length(data.aws_iam_roles.aws_load_balancer_controller.names) > 0 : false
-  aws_load_balancer_controller_role_name   = local.aws_load_balancer_controller_role_exists ? sort(tolist(data.aws_iam_roles.aws_load_balancer_controller.names))[0] : null
+  aws_load_balancer_controller_role_names  = local.aws_load_balancer_controller_role_exists ? toset(data.aws_iam_roles.aws_load_balancer_controller.names) : toset([])
 }
 
 data "aws_iam_policy_document" "aws_load_balancer_controller_explicit_deny" {
@@ -90,8 +90,8 @@ resource "aws_iam_policy" "aws_load_balancer_controller_explicit_deny" {
 }
 
 resource "aws_iam_role_policy_attachment" "aws_load_balancer_controller_explicit_deny" {
-  count      = local.aws_load_balancer_controller_role_exists ? 1 : 0
-  role       = local.aws_load_balancer_controller_role_name
+  for_each   = local.aws_load_balancer_controller_role_names
+  role       = each.value
   policy_arn = aws_iam_policy.aws_load_balancer_controller_explicit_deny[0].arn
 }