Merge pull request #59 from TeliaSoneraNorge/multi-account-support-fo…

…r-roles Updated roles to support multiple thrusted accounts
TeliaSoneraNorge · May 28, 2018 · 5f0f8d2 · 5f0f8d2
2 parents 3916ef5 + e8eb76c
commit 5f0f8d2
Show file tree

Hide file tree

Showing 3 changed files with 32 additions and 17 deletions.
diff --git a/iam/admin/role.tf b/iam/admin/role.tf
@@ -5,8 +5,9 @@ variable "prefix" {
   description = "Prefix added to the role name."
 }
 
-variable "trusted_account" {
-  description = "ID of the account which is trusted with access to assume this role."
+variable "trusted_accounts" {
+  type        = "list"
+  description = "List of IDs for the accounts which is trusted with access to assume this role."
 }
 
 variable "mfa_window" {
@@ -25,10 +26,10 @@ variable "users" {
 module "role" {
   source = "../role"
 
-  prefix          = "${var.prefix}-admin"
-  trusted_account = "${var.trusted_account}"
-  mfa_window      = "${var.mfa_window}"
-  users           = "${var.users}"
+  prefix           = "${var.prefix}-admin"
+  trusted_accounts = "${var.trusted_accounts}"
+  mfa_window       = "${var.mfa_window}"
+  users            = "${var.users}"
 }
 
 resource "aws_iam_role_policy_attachment" "admin" {

diff --git a/iam/developer/role.tf b/iam/developer/role.tf
@@ -5,8 +5,9 @@ variable "prefix" {
   description = "Prefix added to the role name."
 }
 
-variable "trusted_account" {
-  description = "ID of the account which is trusted with access to assume this role."
+variable "trusted_accounts" {
+  type        = "list"
+  description = "List of IDs for the accounts which is trusted with access to assume this role."
 }
 
 variable "mfa_window" {
@@ -25,10 +26,10 @@ variable "users" {
 module "role" {
   source = "../role"
 
-  prefix          = "${var.prefix}-developer"
-  trusted_account = "${var.trusted_account}"
-  mfa_window      = "${var.mfa_window}"
-  users           = "${var.users}"
+  prefix           = "${var.prefix}-developer"
+  trusted_accounts = "${var.trusted_accounts}"
+  mfa_window       = "${var.mfa_window}"
+  users            = "${var.users}"
 }
 
 resource "aws_iam_role_policy" "protect_role" {

diff --git a/iam/role/role.tf b/iam/role/role.tf
@@ -5,8 +5,9 @@ variable "prefix" {
   description = "Prefix added to the role name."
 }
 
-variable "trusted_account" {
-  description = "ID of the account which is trusted with access to assume this role."
+variable "trusted_accounts" {
+  type        = "list"
+  description = "List of IDs for the accounts which is trusted with access to assume this role."
 }
 
 variable "mfa_window" {
@@ -24,11 +25,25 @@ variable "role_description" {
   default     = "Terraform created role"
 }
 
+locals {
+  trusted_accounts_size = "${length( var.trusted_accounts )}"
+  users_size            = "${length( var.users )}"
+  arn_list_size         = "${local.accounts_size * local.users_size}"
+}
+
 # ------------------------------------------------------------------------------
 # Resources
 # ------------------------------------------------------------------------------
 data "aws_iam_account_alias" "current" {}
 
+data "null_data_source" "users" {
+  count = "${local.arn_list_size}"
+
+  inputs = {
+    users = "${format("arn:aws:iam::%s:user/%s", var.trusted_accounts[count.index % local.accounts_size], var.users[count.index / local.accounts_size])}"
+  }
+}
+
 resource "aws_iam_role" "main" {
   name                  = "${var.prefix}-role"
   assume_role_policy    = "${data.aws_iam_policy_document.assume.json}"
@@ -44,9 +59,7 @@ data "aws_iam_policy_document" "assume" {
     principals {
       type = "AWS"
 
-      identifiers = [
-        "${formatlist("arn:aws:iam::%s:user/%s", var.trusted_account, var.users)}",
-      ]
+      identifiers = "${data.null_data_source.users.*.outputs.users}"
     }
 
     condition = {