feat: add support for custom principal iam arns (#49)

philips-labs · Oct 28, 2022 · ee6f6ef · ee6f6ef
1 parent e07657e
commit ee6f6ef
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 6 deletions.
diff --git a/README.md b/README.md
@@ -95,6 +95,7 @@ No modules.
 | Name                                                                                                               | Description                                                                                                                                               | Type                                                                                               | Default                                                     | Required |
 | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- | ----------------------------------------------------------- | :------: |
 | <a name="input_account_ids"></a> [account_ids](#input_account_ids)                                                 | Root users of these Accounts (id) would be given the permissions to assume the role created by this module.                                               | `list(string)`                                                                                     | `[]`                                                        |    no    |
+| <a name="input_custom_principal_arns"></a> [custom_principal_arns](#input_custom_principal_arns)                   | List of IAM principals ARNs able to assume the role created by this module.                                                                               | `list(string)`                                                                                     | `[]`                                                        |    no    |
 | <a name="input_conditions"></a> [conditions](#input_conditions)                                                    | (Optional) Additonal conditions for checking the OIDC claim.                                                                                              | <pre>list(object({<br> test = string<br> variable = string<br> values = list(string)<br> }))</pre> | `[]`                                                        |    no    |
 | <a name="input_default_conditions"></a> [default_conditions](#input_default_conditions)                            | (Optional) Default condtions to apply, at least one of the following is madatory: 'allow_main', 'allow_environment', 'deny_pull_request' and 'allow_all'. | `list(string)`                                                                                     | <pre>[<br> "allow_main",<br> "deny_pull_request"<br>]</pre> |    no    |
 | <a name="input_github_environments"></a> [github_environments](#input_github_environments)                         | (Optional) Allow GitHub action to deploy to all (default) or to one of the environments in the list.                                                      | `list(string)`                                                                                     | <pre>[<br> "*"<br>]</pre>                                   |    no    |

diff --git a/main.tf b/main.tf
@@ -44,28 +44,31 @@ locals {
       "values" : flatten([for index, sp in v[*].values : v[index].values if v[index].variable == v[0].variable]) # loop again to build the values inner map
     }
   ]
+
+  root_principal_arns   = [for acc in var.account_ids : "arn:aws:iam::${acc}:root"]
+  merged_principal_arns = concat(local.root_principal_arns, var.custom_principal_arns)
 }
 
 data "aws_iam_policy_document" "github_actions_assume_role_policy" {
   count = var.repo != null ? 1 : 0
+
   dynamic "statement" {
-    for_each = toset(var.account_ids)
+    for_each = length(local.merged_principal_arns) > 0 ? [1] : []
     content {
       actions = ["sts:AssumeRole"]
 
       principals {
         type        = "AWS"
-        identifiers = ["arn:aws:iam::${statement.value}:root"]
+        identifiers = local.merged_principal_arns
       }
     }
   }
+
   statement {
     actions = ["sts:AssumeRoleWithWebIdentity"]
     principals {
-      type = "Federated"
-      identifiers = [
-        var.openid_connect_provider_arn
-      ]
+      type        = "Federated"
+      identifiers = [var.openid_connect_provider_arn]
     }
 
     condition {

diff --git a/variables.tf b/variables.tf
@@ -82,3 +82,9 @@ variable "account_ids" {
   type        = list(string)
   default     = []
 }
+
+variable "custom_principal_arns" {
+  description = "List of IAM principals ARNs able to assume the role created by this module."
+  type        = list(string)
+  default     = []
+}