diff --git a/README.md b/README.md
index 3be7d0e..7a650e4 100644
--- a/README.md
+++ b/README.md
@@ -61,21 +61,21 @@ module "oidc_repo_s3" {
Check out the [example](examples/default/README.md) for a full example of using the module.
-
+
## Requirements
-| Name | Version |
-|------|---------|
-| [terraform](#requirement\_terraform) | >= 1 |
-| [aws](#requirement\_aws) | >= 3 |
+| Name | Version |
+| ------------------------------------------------------------------------ | ------- |
+| [terraform](#requirement_terraform) | >= 1 |
+| [aws](#requirement_aws) | >= 3 |
## Providers
-| Name | Version |
-|------|---------|
-| [aws](#provider\_aws) | >= 3 |
-| [random](#provider\_random) | n/a |
+| Name | Version |
+| --------------------------------------------------------- | ------- |
+| [aws](#provider_aws) | >= 3 |
+| [random](#provider_random) | n/a |
## Modules
@@ -83,33 +83,36 @@ No modules.
## Resources
-| Name | Type |
-|------|------|
-| [aws_iam_role.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
-| [aws_iam_role_policy_attachment.custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
-| [random_string.random](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
+| Name | Type |
+| --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |
+| [aws_iam_role.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
+| [aws_iam_role_policy_attachment.custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
+| [random_string.random](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
| [aws_iam_policy_document.github_actions_assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
## Inputs
-| Name | Description | Type | Default | Required |
-|------|-------------|------|---------|:--------:|
-| [conditions](#input\_conditions) | (Optional) Additonal conditions for checking the OIDC claim. | list(object({
test = string
variable = string
values = list(string)
})) | `[]` | no |
-| [default\_conditions](#input\_default\_conditions) | (Optional) Default condtions to apply, at least one of the following is madatory: 'allow\_main', 'allow\_environment', 'deny\_pull\_request' and 'allow\_all'. | `list(string)` | [
"allow_main",
"deny_pull_request"
]
| no |
-| [github\_environments](#input\_github\_environments) | (Optional) Allow GitHub action to deploy to all (default) or to one of the environments in the list. | `list(string)` | [
"*"
]
| no |
-| [openid\_connect\_provider\_arn](#input\_openid\_connect\_provider\_arn) | Set the openid connect provider ARN when the provider is not managed by the module. | `string` | n/a | yes |
-| [repo](#input\_repo) | (Optional) GitHub repository to grant access to assume a role via OIDC. When the repo is set, a role will be created. | `string` | `null` | no |
-| [role\_name](#input\_role\_name) | (Optional) role name of the created role, if not provided the `namespace` will be used. | `string` | `null` | no |
-| [role\_path](#input\_role\_path) | (Optional) Path for the created role, requires `repo` is set. | `string` | `"/github-actions/"` | no |
-| [role\_permissions\_boundary](#input\_role\_permissions\_boundary) | (Optional) Boundary for the created role, requires `repo` is set. | `string` | `null` | no |
-| [role\_policy\_arns](#input\_role\_policy\_arns) | List of ARNs of IAM policies to attach to IAM role | `list(string)` | `[]` | no |
+| Name | Description | Type | Default | Required |
+| ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- | ----------------------------------------------------------- | :------: |
+| [account_ids](#input_account_ids) | Root users of these Accounts (id) would be given the permissions to assume the role created by this module. | `list(string)` | `[]` | no |
+| [conditions](#input_conditions) | (Optional) Additonal conditions for checking the OIDC claim. | list(object({
test = string
variable = string
values = list(string)
})) | `[]` | no |
+| [default_conditions](#input_default_conditions) | (Optional) Default condtions to apply, at least one of the following is madatory: 'allow_main', 'allow_environment', 'deny_pull_request' and 'allow_all'. | `list(string)` | [
"allow_main",
"deny_pull_request"
]
| no |
+| [github_environments](#input_github_environments) | (Optional) Allow GitHub action to deploy to all (default) or to one of the environments in the list. | `list(string)` | [
"*"
]
| no |
+| [openid_connect_provider_arn](#input_openid_connect_provider_arn) | Set the openid connect provider ARN when the provider is not managed by the module. | `string` | n/a | yes |
+| [repo](#input_repo) | (Optional) GitHub repository to grant access to assume a role via OIDC. When the repo is set, a role will be created. | `string` | `null` | no |
+| [role_max_session_duration](#input_role_max_session_duration) | Maximum session duration (in seconds) that you want to set for the specified role. | `number` | `null` | no |
+| [role_name](#input_role_name) | (Optional) role name of the created role, if not provided the `namespace` will be used. | `string` | `null` | no |
+| [role_path](#input_role_path) | (Optional) Path for the created role, requires `repo` is set. | `string` | `"/github-actions/"` | no |
+| [role_permissions_boundary](#input_role_permissions_boundary) | (Optional) Boundary for the created role, requires `repo` is set. | `string` | `null` | no |
+| [role_policy_arns](#input_role_policy_arns) | List of ARNs of IAM policies to attach to IAM role | `list(string)` | `[]` | no |
## Outputs
-| Name | Description |
-|------|-------------|
-| [conditions](#output\_conditions) | The assume conditions added to the role. |
-| [role](#output\_role) | The crated role that can be assumed for the configured repository. |
+| Name | Description |
+| ----------------------------------------------------------------- | ------------------------------------------------------------------ |
+| [conditions](#output_conditions) | The assume conditions added to the role. |
+| [role](#output_role) | The crated role that can be assumed for the configured repository. |
+
## Contribution
diff --git a/main.tf b/main.tf
index 732e023..1e2c13a 100644
--- a/main.tf
+++ b/main.tf
@@ -93,6 +93,7 @@ resource "aws_iam_role" "main" {
path = var.role_path
permissions_boundary = var.role_permissions_boundary
assume_role_policy = data.aws_iam_policy_document.github_actions_assume_role_policy[0].json
+ max_session_duration = var.role_max_session_duration
}
resource "aws_iam_role_policy_attachment" "custom" {
diff --git a/variables.tf b/variables.tf
index 10d9ff4..5584bf5 100644
--- a/variables.tf
+++ b/variables.tf
@@ -71,8 +71,14 @@ variable "role_policy_arns" {
default = []
}
+variable "role_max_session_duration" {
+ description = "Maximum session duration (in seconds) that you want to set for the specified role."
+ type = number
+ default = null
+}
+
variable "account_ids" {
description = "Root users of these Accounts (id) would be given the permissions to assume the role created by this module."
type = list(string)
default = []
-}
\ No newline at end of file
+}