fix: Allow dbx storage credentials roles to be self-assuming (#620)

chanzuckerberg · Aug 19, 2024 · 47970b3 · 47970b3
1 parent 47bf936
commit 47970b3
Showing 1 changed file with 26 additions and 0 deletions.
diff --git a/databricks-catalog-external-location/main.tf b/databricks-catalog-external-location/main.tf
@@ -71,6 +71,21 @@ data "aws_iam_policy_document" "databricks_external_location_assume_role" {
       values = [var.databricks_external_id]
     }
   }
+
+  statement {
+    principals {
+      type        = "AWS"
+      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
+    }
+
+    actions = ["sts:AssumeRole"]
+    condition {
+      test     = "ArnEquals"
+      variable = "aws:PrincipalArn"
+
+      values = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:role${local.path}${local.iam_role_name}"]
+    }
+  }
 }
 
 resource "aws_iam_role" "databricks_external_location_iam_role" {
@@ -98,6 +113,17 @@ data "aws_iam_policy_document" "databricks_external_location_bucket_access" {
       module.catalog_bucket.arn,
     ]
   }
+
+  statement {
+    sid    = "databricksAssumeRole"
+    effect = "Allow"
+    actions = [
+      "sts:AssumeRole"
+    ]
+    resources = [
+      "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role${local.path}${local.iam_role_name}"
+    ]
+  }
 }
 
 ### Policies to access bucket