You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Creates an OpenID connect provider. Useful for trusting external identity providers such as GitHub, Bitbucket, etc.
69
69
70
-
⚠️ An IAM provider is 1 per account per given URL. This module would be provisioned once per AWS account, and then one or more roles can be created with this provider as the trusted identity.
70
+
> [!TIP]
71
+
> An IAM provider is 1 per account per given URL. This module would be provisioned once per AWS account, and then one or more roles can be created with this provider as the trusted identity.
-`permission_statements` which allows for any number of custom statements to be added to the role's trust policy. This covers the majority of the variables that were removed
167
+
-`permissions` which allows for any number of custom statements to be added to the role's trust policy. This covers the majority of the variables that were removed
167
168
-`path`/`policy_path`
168
169
-`create_policy`
169
170
-`enable_mfa_enforcment`
170
171
-`iam-oidc-provider`
171
172
- None
172
173
-`iam-read-only-policy`
173
174
-`create`
175
+
-`source_policy_documents`
176
+
-`override_policy_documents`
174
177
-`iam-role`
175
-
-`assume_role_policy_statements` which allows for any number of custom statements to be added to the role's trust policy. This covers the majority of the variables that were removed
178
+
-`trust_policy_permissions` which allows for any number of custom statements to be added to the role's trust policy. This covers the majority of the variables that were removed
| <aname="input_enable_self_management_permissions"></a> [enable\_self\_management\_permissions](#input\_enable\_self\_management\_permissions)| Determines whether permissions are added to the policy which allow the groups IAM users to manage their credentials and MFA |`bool`|`true`| no |
77
77
| <aname="input_name"></a> [name](#input\_name)| The group's name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: `=,.@-_.`|`string`|`""`| no |
78
78
| <aname="input_path"></a> [path](#input\_path)| Path in which to create the group |`string`|`null`| no |
79
-
| <aname="input_permission_statements"></a> [permission\_statements](#input\_permission\_statements)| A map of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for custom permission usage| <pre>map(object({<br/> sid = optional(string)<br/> actions = optional(list(string))<br/> not_actions = optional(list(string))<br/> effect = optional(string, "Allow")<br/> resources = optional(list(string))<br/> not_resources = optional(list(string))<br/> principals = optional(list(object({<br/> type = string<br/> identifiers = list(string)<br/> })))<br/> not_principals = optional(list(object({<br/> type = string<br/> identifiers = list(string)<br/> })))<br/> condition = optional(list(object({<br/> test = string<br/> variable = string<br/> values = list(string)<br/> })))<br/> }))</pre> |`null`| no |
79
+
| <aname="input_permissions"></a> [permissions](#input\_permissions)| A map of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for custom permissions| <pre>map(object({<br/> sid = optional(string)<br/> actions = optional(list(string))<br/> not_actions = optional(list(string))<br/> effect = optional(string, "Allow")<br/> resources = optional(list(string))<br/> not_resources = optional(list(string))<br/> principals = optional(list(object({<br/> type = string<br/> identifiers = list(string)<br/> })))<br/> not_principals = optional(list(object({<br/> type = string<br/> identifiers = list(string)<br/> })))<br/> condition = optional(list(object({<br/> test = string<br/> variable = string<br/> values = list(string)<br/> })))<br/> }))</pre> |`null`| no |
80
80
| <aname="input_policies"></a> [policies](#input\_policies)| Policies to attach to the IAM role in `{'static_name' = 'policy_arn'}` format |`map(string)`|`{}`| no |
81
81
| <aname="input_policy_description"></a> [policy\_description](#input\_policy\_description)| Description of the IAM policy |`string`|`null`| no |
82
82
| <aname="input_policy_name"></a> [policy\_name](#input\_policy\_name)| Name to use on IAM policy created |`string`|`null`| no |
description="A map of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for custom permission usage"
57
+
variable"permissions" {
58
+
description="A map of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for custom permissions"
| <aname="input_additional_policy_json"></a> [additional\_policy\_json](#input\_additional\_policy\_json)| JSON policy document if you want to add custom actions |`string`|`""`| no |
56
55
| <aname="input_allow_cloudwatch_logs_query"></a> [allow\_cloudwatch\_logs\_query](#input\_allow\_cloudwatch\_logs\_query)| Allows StartQuery/StopQuery/FilterLogEvents CloudWatch actions |`bool`|`true`| no |
57
56
| <aname="input_allow_predefined_sts_actions"></a> [allow\_predefined\_sts\_actions](#input\_allow\_predefined\_sts\_actions)| Allows GetCallerIdentity/GetSessionToken/GetAccessKeyInfo sts actions |`bool`|`true`| no |
58
57
| <aname="input_allow_web_console_services"></a> [allow\_web\_console\_services](#input\_allow\_web\_console\_services)| Allows List/Get/Describe/View actions for services used when browsing AWS console (e.g. resource-groups, tag, health services) |`bool`|`true`| no |
59
58
| <aname="input_allowed_services"></a> [allowed\_services](#input\_allowed\_services)| List of services to allow Get/List/Describe/View options. Service name should be the same as corresponding service IAM prefix. See what it is for each service here https://docs.aws.amazon.com/service-authorization/latest/reference/reference_policies_actions-resources-contextkeys.html|`list(string)`|`[]`| no |
60
59
| <aname="input_create"></a> [create](#input\_create)| Controls if resources should be created (affects all resources) |`bool`|`true`| no |
61
60
| <aname="input_create_policy"></a> [create\_policy](#input\_create\_policy)| Controls if IAM policy should be created. Set to `false` to generate the policy JSON without creating the policy itself |`bool`|`true`| no |
62
-
| <aname="input_description"></a> [description](#input\_description)| The description of the policy |`string`|`"IAM Policy"`| no |
61
+
| <aname="input_description"></a> [description](#input\_description)| The description of the policy |`string`|`null`| no |
63
62
| <aname="input_name"></a> [name](#input\_name)| Name to use on IAM policy created |`string`|`null`| no |
64
-
| <aname="input_path"></a> [path](#input\_path)| Path of IAM policy |`string`|`"/"`| no |
63
+
| <aname="input_override_inline_policy_documents"></a> [override\_inline\_policy\_documents](#input\_override\_inline\_policy\_documents)| List of IAM policy documents that are merged together into the exported document. In merging, statements with non-blank `sid`s will override statements with the same `sid`|`list(string)`|`[]`| no |
64
+
| <aname="input_path"></a> [path](#input\_path)| Path of IAM policy |`string`|`null`| no |
65
+
| <aname="input_source_inline_policy_documents"></a> [source\_inline\_policy\_documents](#input\_source\_inline\_policy\_documents)| List of IAM policy documents that are merged together into the exported document. Statements must have unique `sid`s |`list(string)`|`[]`| no |
65
66
| <aname="input_tags"></a> [tags](#input\_tags)| A map of tags to add to all resources |`map(string)`|`{}`| no |
66
67
| <aname="input_use_name_prefix"></a> [use\_name\_prefix](#input\_use\_name\_prefix)| Determines whether the IAM policy name (`name`) is used as a prefix |`bool`|`true`| no |
67
68
| <aname="input_web_console_services"></a> [web\_console\_services](#input\_web\_console\_services)| List of web console services to allow |`list(string)`| <pre>[<br/> "resource-groups",<br/> "tag",<br/> "health",<br/> "ce"<br/>]</pre> | no |
0 commit comments