Add Trusted Services to iam-assumable-role

modules/iam-assumable-role/README.md

@@ -25,6 +25,7 @@ Trusted resources can be any [IAM ARNs](https://docs.aws.amazon.com/IAM/latest/U
 | role\_requires\_mfa | Whether role requires MFA | string | `"true"` | no |
 | tags | A map of tags to add to all resources. | map | `{}` | no |
 | trusted\_role\_arns | ARNs of AWS entities who can assume these roles | list | `[]` | no |
+| trusted\_role\_services | AWS Services that can assume these roles | list | `[]` | no |
 
 ## Outputs
 

modules/iam-assumable-role/main.tf

@@ -8,6 +8,11 @@ data "aws_iam_policy_document" "assume_role" {
       type        = "AWS"
       identifiers = var.trusted_role_arns
     }
+
+    principals {
+      type        = "Service"
+      identifiers = var.trusted_role_services
+    }
   }
 }
 

modules/iam-assumable-role/variables.tf

@@ -4,6 +4,12 @@ variable "trusted_role_arns" {
   default     = []
 }
 
+variable "trusted_role_services" {
+  description = "AWS Services that can assume these roles"
+  type        = list(string)
+  default     = []
+}
+
 variable "mfa_age" {
   description = "Max age of valid MFA (in seconds) for roles which require MFA"
   type        = number