terraform-aws-iam-external-role

AWS IAM External Role

Terraform module for describing an IAM role responsible for delegating cross-account access.

These types of resources are supported:

Usage

module "example" {
  source = "git::https://gitlab.com/infraprints/modules/aws/iam-external-role"

  name        = "infraprints-iam-external-role"
  external_id = "TXAiS9rfgQghzWW2"
  role_arn    = ["${aws_iam_role.default.arn}"]
  count       = "1"
}

resource "aws_iam_role" "default" {
  name = "infraprints-ec2-role"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Effect": "Allow",
    }
  ]
}
EOF
}

Examples

Notes

  • The count property is required as a constant as a workaround to a Terraform issue.

Inputs

NameDescriptionTypeDefaultRequired
countThe number of principal entities.stringn/ayes
descriptionThe description of the role.string""no
external_idExternal Identifier set on the role.string""no
force_detach_policiesSpecifies to force detaching any policies the role has before destroying it. Defaults to false.string"true"no
max_session_durationThe maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours.string"3600"no
nameThe name of the role.stringn/ayes
pathThe path to the role. See IAM Identifiers for more information.string"/external/"no
permissions_boundaryThe ARN of the policy that is used to set the permissions boundary for the role.string""no
role_arnThe list of principal entities that is allowed to assume the role.listn/ayes
tagsKey-value mapping of tags for the IAM role.map<map>no

Outputs

NameDescription
arnThe Amazon Resource Name (ARN) specifying the role.
create_dateThe Amazon Resource Name (ARN) specifying the role.
unique_idThe Amazon Resource Name (ARN) specifying the role.