From 12be9848e29c6634af8bf358d07892ae3c4fa3ee Mon Sep 17 00:00:00 2001 From: yukin01 <38382781+yukin01@users.noreply.github.com> Date: Fri, 27 Nov 2020 05:20:52 +0900 Subject: [PATCH 1/2] fix: automatically determine the number of role policy arns --- examples/iam-assumable-role-with-oidc/main.tf | 1 - modules/iam-assumable-role-with-oidc/README.md | 2 +- modules/iam-assumable-role-with-oidc/main.tf | 3 ++- modules/iam-assumable-role-with-oidc/variables.tf | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/examples/iam-assumable-role-with-oidc/main.tf b/examples/iam-assumable-role-with-oidc/main.tf index d720094e..a3d13afa 100644 --- a/examples/iam-assumable-role-with-oidc/main.tf +++ b/examples/iam-assumable-role-with-oidc/main.tf @@ -22,7 +22,6 @@ module "iam_assumable_role_admin" { role_policy_arns = [ "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", ] - number_of_role_policy_arns = 1 oidc_fully_qualified_subjects = ["system:serviceaccount:default:sa1", "system:serviceaccount:default:sa2"] } diff --git a/modules/iam-assumable-role-with-oidc/README.md b/modules/iam-assumable-role-with-oidc/README.md index 41f1e92e..45bc497d 100644 --- a/modules/iam-assumable-role-with-oidc/README.md +++ b/modules/iam-assumable-role-with-oidc/README.md @@ -28,7 +28,7 @@ This module supports IAM Roles for kubernetes service accounts as described in t | create\_role | Whether to create a role | `bool` | `false` | no | | force\_detach\_policies | Whether policies should be detached from this role when destroying | `bool` | `false` | no | | max\_session\_duration | Maximum CLI/API session duration in seconds between 3600 and 43200 | `number` | `3600` | no | -| number\_of\_role\_policy\_arns | Number of IAM policies to attach to IAM role | `number` | `0` | no | +| number\_of\_role\_policy\_arns | Number of IAM policies to attach to IAM role | `number` | `null` | no | | oidc\_fully\_qualified\_subjects | The fully qualified OIDC subjects to be added to the role policy | `set(string)` | `[]` | no | | oidc\_subjects\_with\_wildcards | The OIDC subject using wildcards to be added to the role policy | `set(string)` | `[]` | no | | provider\_url | URL of the OIDC Provider. Use provider\_urls to specify several URLs. | `string` | `""` | no | diff --git a/modules/iam-assumable-role-with-oidc/main.tf b/modules/iam-assumable-role-with-oidc/main.tf index e4db29d3..db1ab9f4 100644 --- a/modules/iam-assumable-role-with-oidc/main.tf +++ b/modules/iam-assumable-role-with-oidc/main.tf @@ -9,6 +9,7 @@ locals { for url in local.urls : "arn:${data.aws_partition.current.partition}:iam::${local.aws_account_id}:oidc-provider/${url}" ] + number_of_role_policy_arns = var.number_of_role_policy_arns == null ? length(var.role_policy_arns) : var.number_of_role_policy_arns } data "aws_caller_identity" "current" {} @@ -68,7 +69,7 @@ resource "aws_iam_role" "this" { } resource "aws_iam_role_policy_attachment" "custom" { - count = var.create_role ? var.number_of_role_policy_arns : 0 + count = var.create_role ? local.number_of_role_policy_arns : 0 role = join("", aws_iam_role.this.*.name) policy_arn = var.role_policy_arns[count.index] diff --git a/modules/iam-assumable-role-with-oidc/variables.tf b/modules/iam-assumable-role-with-oidc/variables.tf index 42c348c7..48578ed7 100644 --- a/modules/iam-assumable-role-with-oidc/variables.tf +++ b/modules/iam-assumable-role-with-oidc/variables.tf @@ -73,7 +73,7 @@ variable "role_policy_arns" { variable "number_of_role_policy_arns" { description = "Number of IAM policies to attach to IAM role" type = number - default = 0 + default = null } From 25ce94c91c97aae5b031337e38edbff432e28023 Mon Sep 17 00:00:00 2001 From: Anton Babenko Date: Fri, 4 Dec 2020 12:33:09 +0100 Subject: [PATCH 2/2] Simplify conditional check --- .gitignore | 1 + modules/iam-assumable-role-with-oidc/main.tf | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 4fa2920d..4e381262 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ terraform.tfstate *.tfstate* terraform.tfvars +.terraform.lock.hcl diff --git a/modules/iam-assumable-role-with-oidc/main.tf b/modules/iam-assumable-role-with-oidc/main.tf index db1ab9f4..cbbad024 100644 --- a/modules/iam-assumable-role-with-oidc/main.tf +++ b/modules/iam-assumable-role-with-oidc/main.tf @@ -9,7 +9,7 @@ locals { for url in local.urls : "arn:${data.aws_partition.current.partition}:iam::${local.aws_account_id}:oidc-provider/${url}" ] - number_of_role_policy_arns = var.number_of_role_policy_arns == null ? length(var.role_policy_arns) : var.number_of_role_policy_arns + number_of_role_policy_arns = coalesce(var.number_of_role_policy_arns, length(var.role_policy_arns)) } data "aws_caller_identity" "current" {}