├── .github ├── CODEOWNERS ├── ISSUE_TEMPLATE │ ├── bug_report.yml │ ├── config.yml │ ├── feature_request.yml │ └── question.md ├── PULL_REQUEST_TEMPLATE.md ├── banner.png ├── mergify.yml ├── renovate.json ├── settings.yml └── workflows │ ├── branch.yml │ ├── chatops.yml │ ├── release.yml │ └── scheduled.yml ├── .gitignore ├── .travis.yml ├── LICENSE ├── README.md ├── README.yaml ├── atmos.yaml ├── main.tf ├── output.tf └── variables.tf /.github/CODEOWNERS: -------------------------------------------------------------------------------- 1 | # Use this file to define individuals or teams that are responsible for code in a repository. 2 | # Read more: 3 | # 4 | # Order is important: the last matching pattern has the highest precedence 5 | 6 | # These owners will be the default owners for everything 7 | * @cloudposse/engineering @cloudposse/contributors 8 | 9 | # Cloud Posse must review any changes to Makefiles 10 | **/Makefile @cloudposse/engineering 11 | **/Makefile.* @cloudposse/engineering 12 | 13 | # Cloud Posse must review any changes to GitHub actions 14 | .github/* @cloudposse/engineering 15 | 16 | # Cloud Posse must review any changes to standard context definition, 17 | # but some changes can be rubber-stamped. 18 | **/*.tf @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers 19 | README.yaml @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers 20 | README.md @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers 21 | docs/*.md @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers 22 | 23 | # Cloud Posse Admins must review all changes to CODEOWNERS or the mergify configuration 24 | .github/mergify.yml @cloudposse/admins 25 | .github/CODEOWNERS @cloudposse/admins 26 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/bug_report.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: Bug report 3 | description: Create a report to help us improve 4 | labels: ["bug"] 5 | assignees: [""] 6 | body: 7 | - type: markdown 8 | attributes: 9 | value: | 10 | Found a bug? 11 | 12 | Please checkout our [Slack Community](https://slack.cloudposse.com) 13 | or visit our [Slack Archive](https://archive.sweetops.com/). 14 | 15 | [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com) 16 | 17 | - type: textarea 18 | id: concise-description 19 | attributes: 20 | label: Describe the Bug 21 | description: A clear and concise description of what the bug is. 22 | placeholder: What is the bug about? 23 | validations: 24 | required: true 25 | 26 | - type: textarea 27 | id: expected 28 | attributes: 29 | label: Expected Behavior 30 | description: A clear and concise description of what you expected. 31 | placeholder: What happened? 32 | validations: 33 | required: true 34 | 35 | - type: textarea 36 | id: reproduction-steps 37 | attributes: 38 | label: Steps to Reproduce 39 | description: Steps to reproduce the behavior. 40 | placeholder: How do we reproduce it? 41 | validations: 42 | required: true 43 | 44 | - type: textarea 45 | id: screenshots 46 | attributes: 47 | label: Screenshots 48 | description: If applicable, add screenshots or logs to help explain. 49 | validations: 50 | required: false 51 | 52 | - type: textarea 53 | id: environment 54 | attributes: 55 | label: Environment 56 | description: Anything that will help us triage the bug. 57 | placeholder: | 58 | - OS: [e.g. Linux, OSX, WSL, etc] 59 | - Version [e.g. 10.15] 60 | - Module version 61 | - Terraform version 62 | validations: 63 | required: false 64 | 65 | - type: textarea 66 | id: additional 67 | attributes: 68 | label: Additional Context 69 | description: | 70 | Add any other context about the problem here. 71 | validations: 72 | required: false 73 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/config.yml: -------------------------------------------------------------------------------- 1 | blank_issues_enabled: false 2 | 3 | contact_links: 4 | 5 | - name: Community Slack Team 6 | url: https://cloudposse.com/slack/ 7 | about: |- 8 | Please ask and answer questions here. 9 | 10 | - name: Office Hours 11 | url: https://cloudposse.com/office-hours/ 12 | about: |- 13 | Join us every Wednesday for FREE Office Hours (lunch & learn). 14 | 15 | - name: DevOps Accelerator Program 16 | url: https://cloudposse.com/accelerate/ 17 | about: |- 18 | Own your infrastructure in record time. We build it. You drive it. 19 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/feature_request.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: Feature Request 3 | description: Suggest an idea for this project 4 | labels: ["feature request"] 5 | assignees: [""] 6 | body: 7 | - type: markdown 8 | attributes: 9 | value: | 10 | Have a question? 11 | 12 | Please checkout our [Slack Community](https://slack.cloudposse.com) 13 | or visit our [Slack Archive](https://archive.sweetops.com/). 14 | 15 | [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com) 16 | 17 | - type: textarea 18 | id: concise-description 19 | attributes: 20 | label: Describe the Feature 21 | description: A clear and concise description of what the feature is. 22 | placeholder: What is the feature about? 23 | validations: 24 | required: true 25 | 26 | - type: textarea 27 | id: expected 28 | attributes: 29 | label: Expected Behavior 30 | description: A clear and concise description of what you expected. 31 | placeholder: What happened? 32 | validations: 33 | required: true 34 | 35 | - type: textarea 36 | id: use-case 37 | attributes: 38 | label: Use Case 39 | description: | 40 | Is your feature request related to a problem/challenge you are trying 41 | to solve? 42 | 43 | Please provide some additional context of why this feature or 44 | capability will be valuable. 45 | validations: 46 | required: true 47 | 48 | - type: textarea 49 | id: ideal-solution 50 | attributes: 51 | label: Describe Ideal Solution 52 | description: A clear and concise description of what you want to happen. 53 | validations: 54 | required: true 55 | 56 | - type: textarea 57 | id: alternatives-considered 58 | attributes: 59 | label: Alternatives Considered 60 | description: Explain alternative solutions or features considered. 61 | validations: 62 | required: false 63 | 64 | - type: textarea 65 | id: additional 66 | attributes: 67 | label: Additional Context 68 | description: | 69 | Add any other context about the problem here. 70 | validations: 71 | required: false 72 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/question.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cloudposse/terraform-aws-ssm-iam-role/e1f0caa5c7a82fe4307fcddea45e08b33965e4f5/.github/ISSUE_TEMPLATE/question.md -------------------------------------------------------------------------------- /.github/PULL_REQUEST_TEMPLATE.md: -------------------------------------------------------------------------------- 1 | ## what 2 | 3 | 7 | 8 | ## why 9 | 10 | 15 | 16 | ## references 17 | 18 | 22 | -------------------------------------------------------------------------------- /.github/banner.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cloudposse/terraform-aws-ssm-iam-role/e1f0caa5c7a82fe4307fcddea45e08b33965e4f5/.github/banner.png -------------------------------------------------------------------------------- /.github/mergify.yml: -------------------------------------------------------------------------------- 1 | extends: .github 2 | -------------------------------------------------------------------------------- /.github/renovate.json: -------------------------------------------------------------------------------- 1 | { 2 | "extends": [ 3 | "config:base", 4 | ":preserveSemverRanges" 5 | ], 6 | "baseBranches": ["main", "master", "/^release\\/v\\d{1,2}$/"], 7 | "labels": ["auto-update"], 8 | "dependencyDashboardAutoclose": true, 9 | "enabledManagers": ["terraform"], 10 | "terraform": { 11 | "ignorePaths": ["**/context.tf", "examples/**"] 12 | } 13 | } 14 | -------------------------------------------------------------------------------- /.github/settings.yml: -------------------------------------------------------------------------------- 1 | # Upstream changes from _extends are only recognized when modifications are made to this file in the default branch. 2 | _extends: .github 3 | repository: 4 | name: terraform-aws-ssm-iam-role 5 | description: Terraform module to provision an IAM role with configurable permissions to access SSM Parameter Store 6 | homepage: https://cloudposse.com/accelerate 7 | topics: ssm, parameter-store, iam, role, permissions, chamber, kms, terraform, terraform-module, aws, secrets, kubernetes, kube2iam, kiam 8 | 9 | 10 | 11 | 12 | -------------------------------------------------------------------------------- /.github/workflows/branch.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: Branch 3 | on: 4 | pull_request: 5 | branches: 6 | - main 7 | - release/** 8 | types: [opened, synchronize, reopened, labeled, unlabeled] 9 | push: 10 | branches: 11 | - main 12 | - release/v* 13 | paths-ignore: 14 | - '.github/**' 15 | - 'docs/**' 16 | - 'examples/**' 17 | - 'test/**' 18 | - 'README.md' 19 | 20 | permissions: {} 21 | 22 | jobs: 23 | terraform-module: 24 | uses: cloudposse/.github/.github/workflows/shared-terraform-module.yml@main 25 | secrets: inherit 26 | -------------------------------------------------------------------------------- /.github/workflows/chatops.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: chatops 3 | on: 4 | issue_comment: 5 | types: [created] 6 | 7 | permissions: 8 | pull-requests: write 9 | id-token: write 10 | contents: write 11 | statuses: write 12 | 13 | jobs: 14 | test: 15 | uses: cloudposse/.github/.github/workflows/shared-terraform-chatops.yml@main 16 | if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/terratest') }} 17 | secrets: inherit 18 | -------------------------------------------------------------------------------- /.github/workflows/release.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: release 3 | on: 4 | release: 5 | types: 6 | - published 7 | 8 | permissions: 9 | id-token: write 10 | contents: write 11 | pull-requests: write 12 | 13 | jobs: 14 | terraform-module: 15 | uses: cloudposse/.github/.github/workflows/shared-release-branches.yml@main 16 | secrets: inherit 17 | -------------------------------------------------------------------------------- /.github/workflows/scheduled.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: scheduled 3 | on: 4 | workflow_dispatch: { } # Allows manually trigger this workflow 5 | schedule: 6 | - cron: "0 3 * * *" 7 | 8 | permissions: 9 | pull-requests: write 10 | id-token: write 11 | contents: write 12 | 13 | jobs: 14 | scheduled: 15 | uses: cloudposse/.github/.github/workflows/shared-terraform-scheduled.yml@main 16 | secrets: inherit 17 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | **/.terraform/ 2 | .idea 3 | *.iml 4 | **/terraform.tfstate 5 | **/terraform.tfstate.backup 6 | **/terraform.tfvars 7 | 8 | .build-harness 9 | build-harness -------------------------------------------------------------------------------- /.travis.yml: -------------------------------------------------------------------------------- 1 | addons: 2 | apt: 3 | packages: 4 | - git 5 | - make 6 | - curl 7 | 8 | install: 9 | - make init 10 | 11 | script: 12 | - make terraform/install 13 | - make terraform/get-plugins 14 | - make terraform/get-modules 15 | - make terraform/lint 16 | - make terraform/validate 17 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Apache License 2 | Version 2.0, January 2004 3 | http://www.apache.org/licenses/ 4 | 5 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 6 | 7 | 1. Definitions. 8 | 9 | "License" shall mean the terms and conditions for use, reproduction, 10 | and distribution as defined by Sections 1 through 9 of this document. 11 | 12 | "Licensor" shall mean the copyright owner or entity authorized by 13 | the copyright owner that is granting the License. 14 | 15 | "Legal Entity" shall mean the union of the acting entity and all 16 | other entities that control, are controlled by, or are under common 17 | control with that entity. For the purposes of this definition, 18 | "control" means (i) the power, direct or indirect, to cause the 19 | direction or management of such entity, whether by contract or 20 | otherwise, or (ii) ownership of fifty percent (50%) or more of the 21 | outstanding shares, or (iii) beneficial ownership of such entity. 22 | 23 | "You" (or "Your") shall mean an individual or Legal Entity 24 | exercising permissions granted by this License. 25 | 26 | "Source" form shall mean the preferred form for making modifications, 27 | including but not limited to software source code, documentation 28 | source, and configuration files. 29 | 30 | "Object" form shall mean any form resulting from mechanical 31 | transformation or translation of a Source form, including but 32 | not limited to compiled object code, generated documentation, 33 | and conversions to other media types. 34 | 35 | "Work" shall mean the work of authorship, whether in Source or 36 | Object form, made available under the License, as indicated by a 37 | copyright notice that is included in or attached to the work 38 | (an example is provided in the Appendix below). 39 | 40 | "Derivative Works" shall mean any work, whether in Source or Object 41 | form, that is based on (or derived from) the Work and for which the 42 | editorial revisions, annotations, elaborations, or other modifications 43 | represent, as a whole, an original work of authorship. For the purposes 44 | of this License, Derivative Works shall not include works that remain 45 | separable from, or merely link (or bind by name) to the interfaces of, 46 | the Work and Derivative Works thereof. 47 | 48 | "Contribution" shall mean any work of authorship, including 49 | the original version of the Work and any modifications or additions 50 | to that Work or Derivative Works thereof, that is intentionally 51 | submitted to Licensor for inclusion in the Work by the copyright owner 52 | or by an individual or Legal Entity authorized to submit on behalf of 53 | the copyright owner. For the purposes of this definition, "submitted" 54 | means any form of electronic, verbal, or written communication sent 55 | to the Licensor or its representatives, including but not limited to 56 | communication on electronic mailing lists, source code control systems, 57 | and issue tracking systems that are managed by, or on behalf of, the 58 | Licensor for the purpose of discussing and improving the Work, but 59 | excluding communication that is conspicuously marked or otherwise 60 | designated in writing by the copyright owner as "Not a Contribution." 61 | 62 | "Contributor" shall mean Licensor and any individual or Legal Entity 63 | on behalf of whom a Contribution has been received by Licensor and 64 | subsequently incorporated within the Work. 65 | 66 | 2. Grant of Copyright License. Subject to the terms and conditions of 67 | this License, each Contributor hereby grants to You a perpetual, 68 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 69 | copyright license to reproduce, prepare Derivative Works of, 70 | publicly display, publicly perform, sublicense, and distribute the 71 | Work and such Derivative Works in Source or Object form. 72 | 73 | 3. Grant of Patent License. Subject to the terms and conditions of 74 | this License, each Contributor hereby grants to You a perpetual, 75 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 76 | (except as stated in this section) patent license to make, have made, 77 | use, offer to sell, sell, import, and otherwise transfer the Work, 78 | where such license applies only to those patent claims licensable 79 | by such Contributor that are necessarily infringed by their 80 | Contribution(s) alone or by combination of their Contribution(s) 81 | with the Work to which such Contribution(s) was submitted. If You 82 | institute patent litigation against any entity (including a 83 | cross-claim or counterclaim in a lawsuit) alleging that the Work 84 | or a Contribution incorporated within the Work constitutes direct 85 | or contributory patent infringement, then any patent licenses 86 | granted to You under this License for that Work shall terminate 87 | as of the date such litigation is filed. 88 | 89 | 4. Redistribution. You may reproduce and distribute copies of the 90 | Work or Derivative Works thereof in any medium, with or without 91 | modifications, and in Source or Object form, provided that You 92 | meet the following conditions: 93 | 94 | (a) You must give any other recipients of the Work or 95 | Derivative Works a copy of this License; and 96 | 97 | (b) You must cause any modified files to carry prominent notices 98 | stating that You changed the files; and 99 | 100 | (c) You must retain, in the Source form of any Derivative Works 101 | that You distribute, all copyright, patent, trademark, and 102 | attribution notices from the Source form of the Work, 103 | excluding those notices that do not pertain to any part of 104 | the Derivative Works; and 105 | 106 | (d) If the Work includes a "NOTICE" text file as part of its 107 | distribution, then any Derivative Works that You distribute must 108 | include a readable copy of the attribution notices contained 109 | within such NOTICE file, excluding those notices that do not 110 | pertain to any part of the Derivative Works, in at least one 111 | of the following places: within a NOTICE text file distributed 112 | as part of the Derivative Works; within the Source form or 113 | documentation, if provided along with the Derivative Works; or, 114 | within a display generated by the Derivative Works, if and 115 | wherever such third-party notices normally appear. The contents 116 | of the NOTICE file are for informational purposes only and 117 | do not modify the License. You may add Your own attribution 118 | notices within Derivative Works that You distribute, alongside 119 | or as an addendum to the NOTICE text from the Work, provided 120 | that such additional attribution notices cannot be construed 121 | as modifying the License. 122 | 123 | You may add Your own copyright statement to Your modifications and 124 | may provide additional or different license terms and conditions 125 | for use, reproduction, or distribution of Your modifications, or 126 | for any such Derivative Works as a whole, provided Your use, 127 | reproduction, and distribution of the Work otherwise complies with 128 | the conditions stated in this License. 129 | 130 | 5. Submission of Contributions. Unless You explicitly state otherwise, 131 | any Contribution intentionally submitted for inclusion in the Work 132 | by You to the Licensor shall be under the terms and conditions of 133 | this License, without any additional terms or conditions. 134 | Notwithstanding the above, nothing herein shall supersede or modify 135 | the terms of any separate license agreement you may have executed 136 | with Licensor regarding such Contributions. 137 | 138 | 6. Trademarks. This License does not grant permission to use the trade 139 | names, trademarks, service marks, or product names of the Licensor, 140 | except as required for reasonable and customary use in describing the 141 | origin of the Work and reproducing the content of the NOTICE file. 142 | 143 | 7. Disclaimer of Warranty. Unless required by applicable law or 144 | agreed to in writing, Licensor provides the Work (and each 145 | Contributor provides its Contributions) on an "AS IS" BASIS, 146 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or 147 | implied, including, without limitation, any warranties or conditions 148 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A 149 | PARTICULAR PURPOSE. You are solely responsible for determining the 150 | appropriateness of using or redistributing the Work and assume any 151 | risks associated with Your exercise of permissions under this License. 152 | 153 | 8. Limitation of Liability. In no event and under no legal theory, 154 | whether in tort (including negligence), contract, or otherwise, 155 | unless required by applicable law (such as deliberate and grossly 156 | negligent acts) or agreed to in writing, shall any Contributor be 157 | liable to You for damages, including any direct, indirect, special, 158 | incidental, or consequential damages of any character arising as a 159 | result of this License or out of the use or inability to use the 160 | Work (including but not limited to damages for loss of goodwill, 161 | work stoppage, computer failure or malfunction, or any and all 162 | other commercial damages or losses), even if such Contributor 163 | has been advised of the possibility of such damages. 164 | 165 | 9. Accepting Warranty or Additional Liability. While redistributing 166 | the Work or Derivative Works thereof, You may choose to offer, 167 | and charge a fee for, acceptance of support, warranty, indemnity, 168 | or other liability obligations and/or rights consistent with this 169 | License. However, in accepting such obligations, You may act only 170 | on Your own behalf and on Your sole responsibility, not on behalf 171 | of any other Contributor, and only if You agree to indemnify, 172 | defend, and hold each Contributor harmless for any liability 173 | incurred by, or claims asserted against, such Contributor by reason 174 | of your accepting any such warranty or additional liability. 175 | 176 | END OF TERMS AND CONDITIONS 177 | 178 | APPENDIX: How to apply the Apache License to your work. 179 | 180 | To apply the Apache License to your work, attach the following 181 | boilerplate notice, with the fields enclosed by brackets "[]" 182 | replaced with your own identifying information. (Don't include 183 | the brackets!) The text should be enclosed in the appropriate 184 | comment syntax for the file format. We also recommend that a 185 | file or class name and description of purpose be included on the 186 | same "printed page" as the copyright notice for easier 187 | identification within third-party archives. 188 | 189 | Copyright 2018 Cloud Posse, LLC 190 | 191 | Licensed under the Apache License, Version 2.0 (the "License"); 192 | you may not use this file except in compliance with the License. 193 | You may obtain a copy of the License at 194 | 195 | http://www.apache.org/licenses/LICENSE-2.0 196 | 197 | Unless required by applicable law or agreed to in writing, software 198 | distributed under the License is distributed on an "AS IS" BASIS, 199 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 200 | See the License for the specific language governing permissions and 201 | limitations under the License. 202 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Project Banner
5 |

6 | Latest ReleaseLast UpdatedSlack Community

7 | 8 | 9 | 29 | 30 | Terraform module to provision an IAM role with configurable permissions to access [SSM Parameter Store](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-paramstore.html). 31 | 32 | 33 | > [!TIP] 34 | > #### 👽 Use Atmos with Terraform 35 | > Cloud Posse uses [`atmos`](https://atmos.tools) to easily orchestrate multiple environments using Terraform.
36 | > Works with [Github Actions](https://atmos.tools/integrations/github-actions/), [Atlantis](https://atmos.tools/integrations/atlantis), or [Spacelift](https://atmos.tools/integrations/spacelift). 37 | > 38 | >
39 | > Watch demo of using Atmos with Terraform 40 | >
41 | > Example of running atmos to manage infrastructure from our Quick Start tutorial. 42 | > 43 | 44 | 45 | ## Introduction 46 | 47 | For more information on how to control access to Systems Manager parameters by using AWS Identity and Access Management, see [Controlling Access to Systems Manager Parameters](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-access.html). 48 | 49 | For more information on how to use parameter hierarchies to help organize and manage parameters, see [Organizing Parameters into Hierarchies](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-su-organize.html). 50 | 51 | __NOTE:__ This module can be used to provision IAM roles with SSM permissions for [chamber](https://docs.cloudposse.com/tools/chamber/). 52 | 53 | 54 | 55 | 56 | ## Usage 57 | 58 | This example creates a role with the name `cp-prod-app-all` with permission to read all SSM parameters, 59 | and gives permission to the entities specified in `assume_role_arns` to assume the role. 60 | 61 | ```hcl 62 | module "ssm_iam_role" { 63 | source = "git::https://github.com/cloudposse/terraform-aws-ssm-iam-role.git?ref=master" 64 | namespace = "cp" 65 | stage = "prod" 66 | name = "app" 67 | attributes = ["all"] 68 | region = "us-west-2" 69 | account_id = "XXXXXXXXXXX" 70 | assume_role_arns = ["arn:aws:xxxxxxxxxx", "arn:aws:yyyyyyyyyyyy"] 71 | kms_key_arn = "arn:aws:kms:us-west-2:123454095951:key/aced568e-3375-4ece-85e5-b35abc46c243" 72 | ssm_parameters = ["*"] 73 | ssm_actions = ["ssm:GetParametersByPath", "ssm:GetParameters"] 74 | } 75 | ``` 76 | 77 | > [!IMPORTANT] 78 | > In Cloud Posse's examples, we avoid pinning modules to specific versions to prevent discrepancies between the documentation 79 | > and the latest released versions. However, for your own projects, we strongly advise pinning each module to the exact version 80 | > you're using. This practice ensures the stability of your infrastructure. Additionally, we recommend implementing a systematic 81 | > approach for updating versions to avoid unexpected changes. 82 | 83 | 84 | 85 | 86 | 87 | ## Examples 88 | 89 | ### Example With Permission For Specific Resources 90 | 91 | This example creates a role with the name `cp-prod-app-secrets` with permission to read the SSM parameters that begin with `secret-`, 92 | and gives permission to the entities specified in `assume_role_arns` to assume the role. 93 | 94 | ```hcl 95 | module "ssm_iam_role" { 96 | source = "git::https://github.com/cloudposse/terraform-aws-ssm-iam-role.git?ref=master" 97 | namespace = "cp" 98 | stage = "prod" 99 | name = "app" 100 | attributes = ["secrets"] 101 | region = "us-west-2" 102 | account_id = "XXXXXXXXXXX" 103 | assume_role_arns = ["arn:aws:xxxxxxxxxx", "arn:aws:yyyyyyyyyyyy"] 104 | kms_key_arn = "arn:aws:kms:us-west-2:123454095951:key/aced568e-3375-4ece-85e5-b35abc46c243" 105 | ssm_parameters = ["secret-*"] 106 | ssm_actions = ["ssm:GetParameters"] 107 | } 108 | ``` 109 | 110 | ### Complete Example 111 | 112 | This example: 113 | 114 | * Provisions a KMS key to encrypt SSM Parameter Store secrets using [terraform-aws-kms-key](https://github.com/cloudposse/terraform-aws-kms-key) module 115 | * Performs `Kops` cluster lookup to find the ARNs of `masters` and `nodes` by using [terraform-aws-kops-metadata](https://github.com/cloudposse/terraform-aws-kops-metadata) module 116 | * Creates a role with the name `cp-prod-chamber-kops` with permission to read all SSM parameters from the path `kops`, 117 | and gives permission to the Kops `masters` and `nodes` to assume the role 118 | 119 | ```hcl 120 | module "kms_key" { 121 | source = "git::https://github.com/cloudposse/terraform-aws-kms-key.git?ref=master" 122 | namespace = "cp" 123 | stage = "prod" 124 | name = "chamber" 125 | description = "KMS key for SSM" 126 | } 127 | 128 | module "kops_metadata" { 129 | source = "git::https://github.com/cloudposse/terraform-aws-kops-metadata.git?ref=master" 130 | dns_zone = "us-west-2.prod.cloudposse.co" 131 | masters_name = "masters" 132 | nodes_name = "nodes" 133 | } 134 | 135 | module "ssm_iam_role" { 136 | source = "git::https://github.com/cloudposse/terraform-aws-ssm-iam-role.git?ref=master" 137 | namespace = "cp" 138 | stage = "prod" 139 | name = "chamber" 140 | attributes = ["kops"] 141 | region = "us-west-2" 142 | account_id = "XXXXXXXXXXX" 143 | assume_role_arns = ["${module.kops_metadata.masters_role_arn}", "${module.kops_metadata.nodes_role_arn}"] 144 | kms_key_arn = "${module.kms_key.key_arn}" 145 | ssm_parameters = ["kops/*"] 146 | ssm_actions = ["ssm:GetParametersByPath", "ssm:GetParameters"] 147 | } 148 | ``` 149 | 150 | > [!TIP] 151 | > #### Use Terraform Reference Architectures for AWS 152 | > 153 | > Use Cloud Posse's ready-to-go [terraform architecture blueprints](https://cloudposse.com/reference-architecture/) for AWS to get up and running quickly. 154 | > 155 | > ✅ We build it together with your team.
156 | > ✅ Your team owns everything.
157 | > ✅ 100% Open Source and backed by fanatical support.
158 | > 159 | > Request Quote 160 | >
📚 Learn More 161 | > 162 | >
163 | > 164 | > Cloud Posse is the leading [**DevOps Accelerator**](https://cpco.io/commercial-support?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-ssm-iam-role&utm_content=commercial_support) for funded startups and enterprises. 165 | > 166 | > *Your team can operate like a pro today.* 167 | > 168 | > Ensure that your team succeeds by using Cloud Posse's proven process and turnkey blueprints. Plus, we stick around until you succeed. 169 | > #### Day-0: Your Foundation for Success 170 | > - **Reference Architecture.** You'll get everything you need from the ground up built using 100% infrastructure as code. 171 | > - **Deployment Strategy.** Adopt a proven deployment strategy with GitHub Actions, enabling automated, repeatable, and reliable software releases. 172 | > - **Site Reliability Engineering.** Gain total visibility into your applications and services with Datadog, ensuring high availability and performance. 173 | > - **Security Baseline.** Establish a secure environment from the start, with built-in governance, accountability, and comprehensive audit logs, safeguarding your operations. 174 | > - **GitOps.** Empower your team to manage infrastructure changes confidently and efficiently through Pull Requests, leveraging the full power of GitHub Actions. 175 | > 176 | > Request Quote 177 | > 178 | > #### Day-2: Your Operational Mastery 179 | > - **Training.** Equip your team with the knowledge and skills to confidently manage the infrastructure, ensuring long-term success and self-sufficiency. 180 | > - **Support.** Benefit from a seamless communication over Slack with our experts, ensuring you have the support you need, whenever you need it. 181 | > - **Troubleshooting.** Access expert assistance to quickly resolve any operational challenges, minimizing downtime and maintaining business continuity. 182 | > - **Code Reviews.** Enhance your team’s code quality with our expert feedback, fostering continuous improvement and collaboration. 183 | > - **Bug Fixes.** Rely on our team to troubleshoot and resolve any issues, ensuring your systems run smoothly. 184 | > - **Migration Assistance.** Accelerate your migration process with our dedicated support, minimizing disruption and speeding up time-to-value. 185 | > - **Customer Workshops.** Engage with our team in weekly workshops, gaining insights and strategies to continuously improve and innovate. 186 | > 187 | > Request Quote 188 | >
189 | 190 | 191 | 192 | 193 | ## Requirements 194 | 195 | No requirements. 196 | 197 | ## Providers 198 | 199 | | Name | Version | 200 | |------|---------| 201 | | [aws](#provider\_aws) | n/a | 202 | 203 | ## Modules 204 | 205 | | Name | Source | Version | 206 | |------|--------|---------| 207 | | [label](#module\_label) | git::https://github.com/cloudposse/terraform-terraform-label.git | 0.1.3 | 208 | 209 | ## Resources 210 | 211 | | Name | Type | 212 | |------|------| 213 | | [aws_iam_policy.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | 214 | | [aws_iam_role.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | 215 | | [aws_iam_role_policy_attachment.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | 216 | | [aws_iam_policy_document.assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | 217 | | [aws_iam_policy_document.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | 218 | | [aws_kms_key.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/kms_key) | data source | 219 | 220 | ## Inputs 221 | 222 | | Name | Description | Type | Default | Required | 223 | |------|-------------|------|---------|:--------:| 224 | | [account\_id](#input\_account\_id) | AWS account ID | `string` | n/a | yes | 225 | | [assume\_role\_arns](#input\_assume\_role\_arns) | List of ARNs to allow assuming the role. Could be AWS services or accounts, Kops nodes, IAM users or groups | `list(string)` | n/a | yes | 226 | | [attributes](#input\_attributes) | Additional attributes (e.g. `1`) | `list(string)` | `[]` | no | 227 | | [delimiter](#input\_delimiter) | Delimiter to be used between `namespace`, `stage`, `name` and `attributes` | `string` | `"-"` | no | 228 | | [kms\_key\_reference](#input\_kms\_key\_reference) | The Key ID, Key ARN, Key Alias Name, or Key Alias ARN of the KMS key which will encrypt/decrypt SSM secret strings | `any` | n/a | yes | 229 | | [max\_session\_duration](#input\_max\_session\_duration) | The maximum session duration (in seconds) for the role. Can have a value from 1 hour to 12 hours | `number` | `3600` | no | 230 | | [name](#input\_name) | Name (e.g. `app` or `chamber`) | `string` | n/a | yes | 231 | | [namespace](#input\_namespace) | Namespace (e.g. `cp` or `cloudposse`) | `string` | n/a | yes | 232 | | [region](#input\_region) | AWS Region | `string` | n/a | yes | 233 | | [ssm\_actions](#input\_ssm\_actions) | SSM actions to allow | `list(string)` | 
[
  "ssm:GetParametersByPath",
  "ssm:GetParameters"
]
| no | 234 | | [ssm\_parameters](#input\_ssm\_parameters) | List of SSM parameters to apply the actions. A parameter can include a path and a name pattern that you define by using forward slashes, e.g. `kops/secret-*` | `list(string)` | n/a | yes | 235 | | [stage](#input\_stage) | Stage (e.g. `prod`, `dev`, `staging`) | `string` | n/a | yes | 236 | | [tags](#input\_tags) | Additional tags (e.g. map(`BusinessUnit`,`XYZ`) | `map(string)` | `{}` | no | 237 | 238 | ## Outputs 239 | 240 | | Name | Description | 241 | |------|-------------| 242 | | [role\_arn](#output\_role\_arn) | The Amazon Resource Name (ARN) specifying the role | 243 | | [role\_id](#output\_role\_id) | The stable and unique string identifying the role | 244 | | [role\_name](#output\_role\_name) | The name of the crated role | 245 | | [role\_policy\_document](#output\_role\_policy\_document) | A copy of the IAM policy document (JSON) that grants permissions to this role. | 246 | 247 | 248 | 249 | 250 | 251 | 252 | 253 | 254 | ## Related Projects 255 | 256 | Check out these related projects. 257 | 258 | - [terraform-aws-ssm-parameter-store](https://github.com/cloudposse/terraform-aws-ssm-parameter-store) - Terraform module to populate AWS Systems Manager (SSM) Parameter Store with values from Terraform. Works great with Chamber. 259 | - [terraform-aws-ssm-parameter-store-policy-documents](https://github.com/cloudposse/terraform-aws-ssm-parameter-store-policy-documents) - A Terraform module that generates JSON documents for access for common AWS SSM Parameter Store policies 260 | - [terraform-aws-iam-chamber-user](https://github.com/cloudposse/terraform-aws-iam-chamber-user) - Terraform module to provision a basic IAM chamber user with access to SSM parameters and KMS key to decrypt secrets, suitable for CI/CD systems (e.g. TravisCI, CircleCI, CodeFresh) or systems which are external to AWS that cannot leverage AWS IAM Instance Profiles 261 | 262 | 263 | 264 | ## ✨ Contributing 265 | 266 | This project is under active development, and we encourage contributions from our community. 267 | 268 | 269 | 270 | Many thanks to our outstanding contributors: 271 | 272 | 273 | 274 | 275 | 276 | For 🐛 bug reports & feature requests, please use the [issue tracker](https://github.com/cloudposse/terraform-aws-ssm-iam-role/issues). 277 | 278 | In general, PRs are welcome. We follow the typical "fork-and-pull" Git workflow. 279 | 1. Review our [Code of Conduct](https://github.com/cloudposse/terraform-aws-ssm-iam-role/?tab=coc-ov-file#code-of-conduct) and [Contributor Guidelines](https://github.com/cloudposse/.github/blob/main/CONTRIBUTING.md). 280 | 2. **Fork** the repo on GitHub 281 | 3. **Clone** the project to your own machine 282 | 4. **Commit** changes to your own branch 283 | 5. **Push** your work back up to your fork 284 | 6. Submit a **Pull Request** so that we can review your changes 285 | 286 | **NOTE:** Be sure to merge the latest changes from "upstream" before making a pull request! 287 | 288 | ### 🌎 Slack Community 289 | 290 | Join our [Open Source Community](https://cpco.io/slack?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-ssm-iam-role&utm_content=slack) on Slack. It's **FREE** for everyone! Our "SweetOps" community is where you get to talk with others who share a similar vision for how to rollout and manage infrastructure. This is the best place to talk shop, ask questions, solicit feedback, and work together as a community to build totally *sweet* infrastructure. 291 | 292 | ### 📰 Newsletter 293 | 294 | Sign up for [our newsletter](https://cpco.io/newsletter?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-ssm-iam-role&utm_content=newsletter) and join 3,000+ DevOps engineers, CTOs, and founders who get insider access to the latest DevOps trends, so you can always stay in the know. 295 | Dropped straight into your Inbox every week — and usually a 5-minute read. 296 | 297 | ### 📆 Office Hours 298 | 299 | [Join us every Wednesday via Zoom](https://cloudposse.com/office-hours?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-ssm-iam-role&utm_content=office_hours) for your weekly dose of insider DevOps trends, AWS news and Terraform insights, all sourced from our SweetOps community, plus a _live Q&A_ that you can’t find anywhere else. 300 | It's **FREE** for everyone! 301 | ## License 302 | 303 | License 304 | 305 |
306 | Preamble to the Apache License, Version 2.0 307 |
308 |
309 | 310 | Complete license is available in the [`LICENSE`](LICENSE) file. 311 | 312 | ```text 313 | Licensed to the Apache Software Foundation (ASF) under one 314 | or more contributor license agreements. See the NOTICE file 315 | distributed with this work for additional information 316 | regarding copyright ownership. The ASF licenses this file 317 | to you under the Apache License, Version 2.0 (the 318 | "License"); you may not use this file except in compliance 319 | with the License. You may obtain a copy of the License at 320 | 321 | https://www.apache.org/licenses/LICENSE-2.0 322 | 323 | Unless required by applicable law or agreed to in writing, 324 | software distributed under the License is distributed on an 325 | "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 326 | KIND, either express or implied. See the License for the 327 | specific language governing permissions and limitations 328 | under the License. 329 | ``` 330 |
331 | 332 | ## Trademarks 333 | 334 | All other trademarks referenced herein are the property of their respective owners. 335 | 336 | 337 | --- 338 | Copyright © 2017-2025 [Cloud Posse, LLC](https://cpco.io/copyright) 339 | 340 | 341 | README footer 342 | 343 | Beacon 344 | -------------------------------------------------------------------------------- /README.yaml: -------------------------------------------------------------------------------- 1 | # 2 | # This is the canonical configuration for the `README.md` 3 | # Run `make readme` to rebuild the `README.md` 4 | # 5 | 6 | # Name of this project 7 | name: terraform-aws-ssm-iam-role 8 | 9 | # Logo for this project 10 | #logo: docs/logo.png 11 | 12 | # License of this project 13 | license: "APACHE2" 14 | 15 | # Canonical GitHub repo 16 | github_repo: cloudposse/terraform-aws-ssm-iam-role 17 | 18 | # Badges to display 19 | badges: 20 | - name: Latest Release 21 | image: https://img.shields.io/github/release/cloudposse/terraform-aws-ssm-iam-role.svg?style=for-the-badge 22 | url: https://github.com/cloudposse/terraform-aws-ssm-iam-role/releases/latest 23 | - name: Last Updated 24 | image: https://img.shields.io/github/last-commit/cloudposse/terraform-aws-ssm-iam-role.svg?style=for-the-badge 25 | url: https://github.com/cloudposse/terraform-aws-ssm-iam-role/commits 26 | - name: Slack Community 27 | image: https://slack.cloudposse.com/for-the-badge.svg 28 | url: https://cloudposse.com/slack 29 | 30 | # List any related terraform modules that this module may be used with or that this module depends on. 31 | related: 32 | - name: "terraform-aws-ssm-parameter-store" 33 | description: "Terraform module to populate AWS Systems Manager (SSM) Parameter Store with values from Terraform. Works great with Chamber." 34 | url: "https://github.com/cloudposse/terraform-aws-ssm-parameter-store" 35 | - name: "terraform-aws-ssm-parameter-store-policy-documents" 36 | description: "A Terraform module that generates JSON documents for access for common AWS SSM Parameter Store policies" 37 | url: "https://github.com/cloudposse/terraform-aws-ssm-parameter-store-policy-documents" 38 | - name: "terraform-aws-iam-chamber-user" 39 | description: "Terraform module to provision a basic IAM chamber user with access to SSM parameters and KMS key to decrypt secrets, suitable for CI/CD systems (e.g. TravisCI, CircleCI, CodeFresh) or systems which are external to AWS that cannot leverage AWS IAM Instance Profiles" 40 | url: "https://github.com/cloudposse/terraform-aws-iam-chamber-user" 41 | 42 | # Short description of this project 43 | description: |- 44 | Terraform module to provision an IAM role with configurable permissions to access [SSM Parameter Store](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-paramstore.html). 45 | 46 | introduction: |- 47 | For more information on how to control access to Systems Manager parameters by using AWS Identity and Access Management, see [Controlling Access to Systems Manager Parameters](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-access.html). 48 | 49 | For more information on how to use parameter hierarchies to help organize and manage parameters, see [Organizing Parameters into Hierarchies](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-su-organize.html). 50 | 51 | __NOTE:__ This module can be used to provision IAM roles with SSM permissions for [chamber](https://docs.cloudposse.com/tools/chamber/). 52 | 53 | # How to use this project 54 | usage: |- 55 | This example creates a role with the name `cp-prod-app-all` with permission to read all SSM parameters, 56 | and gives permission to the entities specified in `assume_role_arns` to assume the role. 57 | 58 | ```hcl 59 | module "ssm_iam_role" { 60 | source = "git::https://github.com/cloudposse/terraform-aws-ssm-iam-role.git?ref=master" 61 | namespace = "cp" 62 | stage = "prod" 63 | name = "app" 64 | attributes = ["all"] 65 | region = "us-west-2" 66 | account_id = "XXXXXXXXXXX" 67 | assume_role_arns = ["arn:aws:xxxxxxxxxx", "arn:aws:yyyyyyyyyyyy"] 68 | kms_key_arn = "arn:aws:kms:us-west-2:123454095951:key/aced568e-3375-4ece-85e5-b35abc46c243" 69 | ssm_parameters = ["*"] 70 | ssm_actions = ["ssm:GetParametersByPath", "ssm:GetParameters"] 71 | } 72 | ``` 73 | 74 | examples: |- 75 | ### Example With Permission For Specific Resources 76 | 77 | This example creates a role with the name `cp-prod-app-secrets` with permission to read the SSM parameters that begin with `secret-`, 78 | and gives permission to the entities specified in `assume_role_arns` to assume the role. 79 | 80 | ```hcl 81 | module "ssm_iam_role" { 82 | source = "git::https://github.com/cloudposse/terraform-aws-ssm-iam-role.git?ref=master" 83 | namespace = "cp" 84 | stage = "prod" 85 | name = "app" 86 | attributes = ["secrets"] 87 | region = "us-west-2" 88 | account_id = "XXXXXXXXXXX" 89 | assume_role_arns = ["arn:aws:xxxxxxxxxx", "arn:aws:yyyyyyyyyyyy"] 90 | kms_key_arn = "arn:aws:kms:us-west-2:123454095951:key/aced568e-3375-4ece-85e5-b35abc46c243" 91 | ssm_parameters = ["secret-*"] 92 | ssm_actions = ["ssm:GetParameters"] 93 | } 94 | ``` 95 | 96 | ### Complete Example 97 | 98 | This example: 99 | 100 | * Provisions a KMS key to encrypt SSM Parameter Store secrets using [terraform-aws-kms-key](https://github.com/cloudposse/terraform-aws-kms-key) module 101 | * Performs `Kops` cluster lookup to find the ARNs of `masters` and `nodes` by using [terraform-aws-kops-metadata](https://github.com/cloudposse/terraform-aws-kops-metadata) module 102 | * Creates a role with the name `cp-prod-chamber-kops` with permission to read all SSM parameters from the path `kops`, 103 | and gives permission to the Kops `masters` and `nodes` to assume the role 104 | 105 | ```hcl 106 | module "kms_key" { 107 | source = "git::https://github.com/cloudposse/terraform-aws-kms-key.git?ref=master" 108 | namespace = "cp" 109 | stage = "prod" 110 | name = "chamber" 111 | description = "KMS key for SSM" 112 | } 113 | 114 | module "kops_metadata" { 115 | source = "git::https://github.com/cloudposse/terraform-aws-kops-metadata.git?ref=master" 116 | dns_zone = "us-west-2.prod.cloudposse.co" 117 | masters_name = "masters" 118 | nodes_name = "nodes" 119 | } 120 | 121 | module "ssm_iam_role" { 122 | source = "git::https://github.com/cloudposse/terraform-aws-ssm-iam-role.git?ref=master" 123 | namespace = "cp" 124 | stage = "prod" 125 | name = "chamber" 126 | attributes = ["kops"] 127 | region = "us-west-2" 128 | account_id = "XXXXXXXXXXX" 129 | assume_role_arns = ["${module.kops_metadata.masters_role_arn}", "${module.kops_metadata.nodes_role_arn}"] 130 | kms_key_arn = "${module.kms_key.key_arn}" 131 | ssm_parameters = ["kops/*"] 132 | ssm_actions = ["ssm:GetParametersByPath", "ssm:GetParameters"] 133 | } 134 | ``` 135 | 136 | include: [] 137 | contributors: [] 138 | -------------------------------------------------------------------------------- /atmos.yaml: -------------------------------------------------------------------------------- 1 | # Atmos Configuration — powered by https://atmos.tools 2 | # 3 | # This configuration enables centralized, DRY, and consistent project scaffolding using Atmos. 4 | # 5 | # Included features: 6 | # - Organizational custom commands: https://atmos.tools/core-concepts/custom-commands 7 | # - Automated README generation: https://atmos.tools/cli/commands/docs/generate 8 | # 9 | 10 | # Import shared configuration used by all modules 11 | import: 12 | - https://raw.githubusercontent.com/cloudposse/.github/refs/heads/main/.github/atmos/terraform-module.yaml 13 | -------------------------------------------------------------------------------- /main.tf: -------------------------------------------------------------------------------- 1 | module "label" { 2 | source = "git::https://github.com/cloudposse/terraform-terraform-label.git?ref=0.1.3" 3 | attributes = var.attributes 4 | delimiter = var.delimiter 5 | name = var.name 6 | namespace = var.namespace 7 | stage = var.stage 8 | tags = var.tags 9 | } 10 | 11 | locals { 12 | policy_only = length(var.assume_role_arns) > 0 ? 1 : 0 13 | } 14 | 15 | data "aws_kms_key" "default" { 16 | key_id = var.kms_key_reference 17 | } 18 | 19 | data "aws_iam_policy_document" "assume_role" { 20 | count = local.policy_only 21 | 22 | statement { 23 | effect = "Allow" 24 | actions = ["sts:AssumeRole"] 25 | 26 | principals { 27 | type = "Service" 28 | identifiers = ["ec2.amazonaws.com"] 29 | } 30 | } 31 | 32 | statement { 33 | effect = "Allow" 34 | actions = ["sts:AssumeRole"] 35 | 36 | principals { 37 | type = "AWS" 38 | identifiers = ["${var.assume_role_arns}"] 39 | } 40 | } 41 | } 42 | 43 | data "aws_iam_policy_document" "default" { 44 | statement { 45 | actions = ["ssm:DescribeParameters"] 46 | resources = ["*"] 47 | effect = "Allow" 48 | } 49 | 50 | statement { 51 | actions = ["${var.ssm_actions}"] 52 | resources = ["${formatlist("arn:aws:ssm:%s:%s:parameter/%s", var.region, var.account_id, var.ssm_parameters)}"] 53 | effect = "Allow" 54 | } 55 | 56 | statement { 57 | actions = ["kms:Decrypt"] 58 | resources = ["${data.aws_kms_key.default.arn}"] 59 | effect = "Allow" 60 | } 61 | } 62 | 63 | resource "aws_iam_policy" "default" { 64 | name = module.label.id 65 | description = "Allow SSM actions" 66 | policy = data.aws_iam_policy_document.default.json 67 | } 68 | 69 | resource "aws_iam_role" "default" { 70 | count = local.policy_only 71 | 72 | name = module.label.id 73 | assume_role_policy = join("", data.aws_iam_policy_document.assume_role.*.json) 74 | description = "IAM Role with permissions to perform actions on SSM resources" 75 | max_session_duration = var.max_session_duration 76 | } 77 | 78 | resource "aws_iam_role_policy_attachment" "default" { 79 | count = local.policy_only 80 | 81 | role = join("", aws_iam_role.default.*.name) 82 | policy_arn = join("", aws_iam_policy.default.*.arn) 83 | } 84 | -------------------------------------------------------------------------------- /output.tf: -------------------------------------------------------------------------------- 1 | output "role_name" { 2 | value = join("", aws_iam_role.default.*.name) 3 | description = "The name of the crated role" 4 | } 5 | 6 | output "role_id" { 7 | value = join("", aws_iam_role.default.*.unique_id) 8 | description = "The stable and unique string identifying the role" 9 | } 10 | 11 | output "role_arn" { 12 | value = join("", aws_iam_role.default.*.arn) 13 | description = "The Amazon Resource Name (ARN) specifying the role" 14 | } 15 | 16 | output "role_policy_document" { 17 | value = data.aws_iam_policy_document.default.json 18 | description = "A copy of the IAM policy document (JSON) that grants permissions to this role." 19 | } 20 | -------------------------------------------------------------------------------- /variables.tf: -------------------------------------------------------------------------------- 1 | variable "namespace" { 2 | type = string 3 | description = "Namespace (e.g. `cp` or `cloudposse`)" 4 | } 5 | 6 | variable "stage" { 7 | type = string 8 | description = "Stage (e.g. `prod`, `dev`, `staging`)" 9 | } 10 | 11 | variable "name" { 12 | type = string 13 | description = "Name (e.g. `app` or `chamber`)" 14 | } 15 | 16 | variable "delimiter" { 17 | type = string 18 | default = "-" 19 | description = "Delimiter to be used between `namespace`, `stage`, `name` and `attributes`" 20 | } 21 | 22 | variable "attributes" { 23 | type = list(string) 24 | default = [] 25 | description = "Additional attributes (e.g. `1`)" 26 | } 27 | 28 | variable "tags" { 29 | type = map(string) 30 | default = {} 31 | description = "Additional tags (e.g. map(`BusinessUnit`,`XYZ`)" 32 | } 33 | 34 | variable "region" { 35 | type = string 36 | description = "AWS Region" 37 | } 38 | 39 | variable "account_id" { 40 | type = string 41 | description = "AWS account ID" 42 | } 43 | 44 | variable "kms_key_reference" { 45 | description = "The Key ID, Key ARN, Key Alias Name, or Key Alias ARN of the KMS key which will encrypt/decrypt SSM secret strings" 46 | } 47 | 48 | variable "assume_role_arns" { 49 | type = list(string) 50 | description = "List of ARNs to allow assuming the role. Could be AWS services or accounts, Kops nodes, IAM users or groups" 51 | } 52 | 53 | variable "ssm_actions" { 54 | type = list(string) 55 | default = ["ssm:GetParametersByPath", "ssm:GetParameters"] 56 | description = "SSM actions to allow" 57 | } 58 | 59 | variable "ssm_parameters" { 60 | type = list(string) 61 | description = "List of SSM parameters to apply the actions. A parameter can include a path and a name pattern that you define by using forward slashes, e.g. `kops/secret-*`" 62 | } 63 | 64 | variable "max_session_duration" { 65 | default = 3600 66 | description = "The maximum session duration (in seconds) for the role. Can have a value from 1 hour to 12 hours" 67 | } 68 | --------------------------------------------------------------------------------