feat: Allows multiple STS External IDs to be provided to an assumable role

[mike-carey]

Description

Allows more than one STS External ID to be provided to an assumable role.

Motivation and Context

We need to pass multiple External IDs allowing one role for multiple external ids.

Breaking Changes

No

How Has This Been Tested?

• I have tested and validated these changes using one or more of the provided examples/* projects

I have added the role_sts_external_ids field to the iam-assumable-role example.

Using a string

  # module.iam_assumable_role_custom.aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Condition = {
                          + StringEquals = {
                              + sts:ExternalId = [
                                  + "some-id-goes-here",
                                ]
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS     = "arn:aws:iam::307990089504:root"
                          + Service = "codedeploy.amazonaws.com"
                        }
                      + Sid       = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "custom"
      + path                  = "/"
      + unique_id             = (known after apply)

      + inline_policy {
          + name   = (known after apply)
          + policy = (known after apply)
        }
    }

Using a list(string)

  # module.iam_assumable_role_sts.aws_iam_role.this[0] will be created
  + resource "aws_iam_role" "this" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Condition = {
                          + StringEquals = {
                              + sts:ExternalId = [
                                  + "some-id-goes-here",
                                  + "another-id-goes-here",
                                ]
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS     = "arn:aws:iam::307990089504:root"
                          + Service = "codedeploy.amazonaws.com"
                        }
                      + Sid       = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "custom_sts"
      + path                  = "/"
      + unique_id             = (known after apply)

      + inline_policy {
          + name   = (known after apply)
          + policy = (known after apply)
        }
    }

[antonbabenko]

Thanks, @mike-carey !

v3.13.0 has been just released.

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.