Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updating provider version #5

Open
wants to merge 11 commits into
base: master
Choose a base branch
from
Prev Previous commit
Next Next commit
modified aggregate aws iam policy
  • Loading branch information
SKIMRAN0509 committed Mar 6, 2024
commit d4b38ab1078a06ee61684150c74f1382f70e2d19
36 changes: 21 additions & 15 deletions main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -70,8 +70,8 @@ data "aws_kms_key" "lambda" {

module "default_label" {
enabled = var.enabled

source = "git::https://github.com/cloudposse/terraform-null-label.git?ref=tags/0.22.1"
source = "cloudposse/label/null"
version = "0.25.0"
attributes = compact(concat(var.attributes, ["db", "provisioner"]))
delimiter = var.delimiter
name = var.name
Expand Down Expand Up @@ -324,21 +324,24 @@ data "aws_iam_policy_document" "user_password_kms_permissions" {
}
}

module "aggregated_policy" {
source = "git::https://github.com/cloudposse/terraform-aws-iam-policy-document-aggregator.git?ref=tags/0.7.0"
########################################################
locals {

source_documents = compact([
join("", data.aws_iam_policy_document.default_permissions.*.json),
join("", data.aws_iam_policy_document.lambda_kms_permissions.*.json),
join("", data.aws_iam_policy_document.master_password_ssm_permissions.*.json),
join("", data.aws_iam_policy_document.master_password_kms_permissions.*.json),
join("", data.aws_iam_policy_document.master_password_secretsmanager_permissions.*.json),
join("", data.aws_iam_policy_document.user_password_ssm_permissions.*.json),
join("", data.aws_iam_policy_document.user_password_kms_permissions.*.json),
join("", data.aws_iam_policy_document.user_password_secretsmanager_permissions.*.json),
])
policy_statement = concat(
jsondecode(data.aws_iam_policy_document.default_permissions[0].json).Statement,
jsondecode(data.aws_iam_policy_document.master_password_ssm_permissions[0].json).Statement,
jsondecode(data.aws_iam_policy_document.master_password_kms_permissions[0].json).Statement,
jsondecode(data.aws_iam_policy_document.master_password_secretsmanager_permissions[0].json).Statement
# jsondecode(data.aws_iam_policy_document.assume[0].json).Statement
# jsondecode(data.aws_iam_policy_document.lambda_kms_permissions[0].json).Statement
# jsondecode(data.aws_iam_policy_document.user_password_ssm_permissions[0].json).Statement,
# jsondecode(data.aws_iam_policy_document.user_password_secretsmanager_permissions[0].json).Statement,
# jsondecode(data.aws_iam_policy_document.user_password_kms_permissions[0].json).Statement
)
}

data "aws_iam_policy_document" "empty" {}

resource "aws_iam_role" "lambda" {
count = var.enabled ? 1 : 0

Expand All @@ -355,7 +358,10 @@ resource "aws_iam_policy" "default" {
path = "/"
description = "IAM policy to control access of Lambda function to AWS resources"

policy = module.aggregated_policy.result_document
policy = jsonencode({
Version = "2012-10-17",
Statement = local.policy_statement
})
}

resource "aws_iam_role_policy_attachment" "default_permissions" {
Expand Down
8 changes: 8 additions & 0 deletions outputs.tf
Original file line number Diff line number Diff line change
Expand Up @@ -38,3 +38,11 @@ output "lambda_function_name" {
value = join("", aws_lambda_function.default.*.function_name)
}

output "result_document" {
# value = data.aws_iam_policy_document.default[*].json
# description = "Aggregated IAM policy"
value = jsonencode({
Version = "2012-10-17",
Statement = local.policy_statement
})
}
6 changes: 6 additions & 0 deletions variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -155,3 +155,9 @@ variable "grant_all_privileges" {
default = "true"
description = "Defines whether the user created by lambda function should be given all privileges"
}

variable "source_documents" {
type = list(string)
description = "List of JSON IAM policy documents.<br/><br/><b>Limits:</b><br/>* List size max 10<br/> * Statement can be overriden by the statement with the same sid from the latest policy."
default = []
}
10 changes: 5 additions & 5 deletions versions.tf
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
terraform {
required_version = ">= 0.12.0"
required_version = "~> 1.6.0, < 1.7.0"

required_providers {
aws = ">= 2.31"
archive = ">= 1.3"
local = ">= 1.2"
aws = "~> 5.26.0"
archive = "~> 1.3"
local = "~> 1.2"
}
}
}