removed cross account requirements

ministryofjustice · Nov 14, 2023 · 27dfb0c · 27dfb0c
1 parent 15a5cb1
commit 27dfb0c
Show file tree

Hide file tree

Showing 3 changed files with 136 additions and 164 deletions.
diff --git a/main.tf b/main.tf
@@ -15,24 +15,6 @@ provider "aws" {
   }
 }
 
-provider "aws" {
-  region = var.aws_region
-  alias  = "development"
-
-  assume_role {
-    role_arn = var.assume_role_development
-  }
-}
-
-provider "aws" {
-  region = var.aws_region
-  alias  = "pre_production"
-
-  assume_role {
-    role_arn = var.assume_role_pre_production
-  }
-}
-
 data "aws_availability_zones" "available_zones" {
   count = var.enabled ? 1 : 0
   state = "available"
@@ -91,7 +73,7 @@ module "eks" {
 
   providers = {
     aws                = aws.main
-    aws.development    = aws.development
-    aws.pre_production = aws.pre_production
+#    aws.development    = aws.development
+#    aws.pre_production = aws.pre_production
   }
 }
diff --git a/modules/eks/iam.tf b/modules/eks/iam.tf
@@ -433,140 +433,140 @@ data "aws_iam_policy_document" "cloudwatch_exporter_assume_role_policy_other_aws
 
 # IAM role for Cloudwatch Exporter in development aws account
 
-resource "aws_iam_role" "cloudwatch_exporter_development" {
-  count              = terraform.workspace == "development" ? 0 : 1
-  assume_role_policy = data.aws_iam_policy_document.cloudwatch_exporter_assume_role_policy_other_aws_accounts.json
-  name               = "${var.prefix}-CloudwatchExporter"
-
-  tags = var.tags
-
-  provider = aws.development
-}
-
-resource "aws_iam_policy" "cloudwatch_exporter_iam_policy_development" {
-  count       = terraform.workspace == "development" ? 0 : 1
-  name        = "${var.prefix}-CloudwatchExporterIAMPolicy"
-  path        = "/"
-  description = "IAM role policy for Cloudwatch Exporter in EKS Cluster for ${var.prefix}"
-
-  policy = data.template_file.cloudwatch_exporter_iam_policy.rendered
-
-  tags = var.tags
-
-  provider = aws.development
-}
-
-resource "aws_iam_role_policy_attachment" "cloudwatch_exporter_IAMPolicy_development" {
-  count      = terraform.workspace == "development" ? 0 : 1
-  policy_arn = aws_iam_policy.cloudwatch_exporter_iam_policy_development[0].arn
-  role       = aws_iam_role.cloudwatch_exporter_development[0].name
-
-  provider = aws.development
-}
-
-resource "aws_iam_policy" "development_cloudwatch_exporter_role_allow_assume_policy" {
-  count       = terraform.workspace == "development" ? 0 : 1
-  name        = "development_cloudwatch_exporter_role_allow_assume_policy"
-  path        = "/"
-  description = "Policy that allows cloudwatch exporter in EKS Cluster for ${var.prefix} to assume role in development AWS account"
-
-  policy = <<POLICY
-{
-  "Version": "2012-10-17",
-  "Statement": [
-      {
-          "Sid": "Statement",
-          "Effect": "Allow",
-          "Action": "sts:AssumeRole",
-          "Resource": [
-            "${aws_iam_role.cloudwatch_exporter_development[0].arn}"
-          ]
-      }
-  ]
-}
-POLICY
-
-  depends_on = [
-    aws_iam_role.cloudwatch_exporter_development
-  ]
-}
-
-resource "aws_iam_role_policy_attachment" "development_cloudwatch_exporter_allow_assume_IAMPolicy" {
-  count      = terraform.workspace == "development" ? 0 : 1
-  policy_arn = aws_iam_policy.development_cloudwatch_exporter_role_allow_assume_policy[0].arn
-  role       = aws_iam_role.cloudwatch_exporter.name
-
-  depends_on = [
-    aws_iam_policy.development_cloudwatch_exporter_role_allow_assume_policy
-  ]
-}
+#resource "aws_iam_role" "cloudwatch_exporter_development" {
+#  count              = terraform.workspace == "development" ? 0 : 1
+#  assume_role_policy = data.aws_iam_policy_document.cloudwatch_exporter_assume_role_policy_other_aws_accounts.json
+#  name               = "${var.prefix}-CloudwatchExporter"
+#
+#  tags = var.tags
+#
+#  provider = aws.development
+#}
+
+#resource "aws_iam_policy" "cloudwatch_exporter_iam_policy_development" {
+#  count       = terraform.workspace == "development" ? 0 : 1
+#  name        = "${var.prefix}-CloudwatchExporterIAMPolicy"
+#  path        = "/"
+#  description = "IAM role policy for Cloudwatch Exporter in EKS Cluster for ${var.prefix}"
+#
+#  policy = data.template_file.cloudwatch_exporter_iam_policy.rendered
+#
+#  tags = var.tags
+#
+#  provider = aws.development
+#}
+
+#resource "aws_iam_role_policy_attachment" "cloudwatch_exporter_IAMPolicy_development" {
+#  count      = terraform.workspace == "development" ? 0 : 1
+#  policy_arn = aws_iam_policy.cloudwatch_exporter_iam_policy_development[0].arn
+#  role       = aws_iam_role.cloudwatch_exporter_development[0].name
+#
+#  provider = aws.development
+#}
+
+#resource "aws_iam_policy" "development_cloudwatch_exporter_role_allow_assume_policy" {
+#  count       = terraform.workspace == "development" ? 0 : 1
+#  name        = "development_cloudwatch_exporter_role_allow_assume_policy"
+#  path        = "/"
+#  description = "Policy that allows cloudwatch exporter in EKS Cluster for ${var.prefix} to assume role in development AWS account"
+#
+#  policy = <<POLICY
+#{
+#  "Version": "2012-10-17",
+#  "Statement": [
+#      {
+#          "Sid": "Statement",
+#          "Effect": "Allow",
+#          "Action": "sts:AssumeRole",
+#          "Resource": [
+#            "${aws_iam_role.cloudwatch_exporter_development[0].arn}"
+#          ]
+#      }
+#  ]
+#}
+#POLICY
+#
+#  depends_on = [
+#    aws_iam_role.cloudwatch_exporter_development
+#  ]
+#}
+
+#resource "aws_iam_role_policy_attachment" "development_cloudwatch_exporter_allow_assume_IAMPolicy" {
+#  count      = terraform.workspace == "development" ? 0 : 1
+#  policy_arn = aws_iam_policy.development_cloudwatch_exporter_role_allow_assume_policy[0].arn
+#  role       = aws_iam_role.cloudwatch_exporter.name
+#
+#  depends_on = [
+#    aws_iam_policy.development_cloudwatch_exporter_role_allow_assume_policy
+#  ]
+#}
 
 # IAM role for Cloudwatch Exporter in pre-production AWS account
 
-resource "aws_iam_role" "cloudwatch_exporter_pre_production" {
-  count              = terraform.workspace == "pre-production" ? 0 : 1
-  assume_role_policy = data.aws_iam_policy_document.cloudwatch_exporter_assume_role_policy_other_aws_accounts.json
-  name               = "${var.prefix}-CloudwatchExporter"
-
-  tags = var.tags
-
-  provider = aws.pre_production
-}
-
-resource "aws_iam_policy" "cloudwatch_exporter_iam_policy_pre_production" {
-  count       = terraform.workspace == "pre-production" ? 0 : 1
-  name        = "${var.prefix}-CloudwatchExporterIAMPolicy"
-  path        = "/"
-  description = "IAM role policy for Cloudwatch Exporter in EKS Cluster for ${var.prefix}"
-
-  policy = data.template_file.cloudwatch_exporter_iam_policy.rendered
-
-  tags = var.tags
-
-  provider = aws.pre_production
-}
-
-resource "aws_iam_role_policy_attachment" "cloudwatch_exporter_IAMPolicy_pre_production" {
-  count      = terraform.workspace == "pre-production" ? 0 : 1
-  policy_arn = aws_iam_policy.cloudwatch_exporter_iam_policy_pre_production[0].arn
-  role       = aws_iam_role.cloudwatch_exporter_pre_production[0].name
-
-  provider = aws.pre_production
-}
-
-resource "aws_iam_policy" "pre_production_cloudwatch_exporter_role_allow_assume_policy" {
-  count       = terraform.workspace == "pre-production" ? 0 : 1
-  name        = "pre_production_cloudwatch_exporter_role_allow_assume_policy"
-  path        = "/"
-  description = "Policy that allows cloudwatch exporter in EKS Cluster for ${var.prefix} to assume role in pre-production AWS account"
-
-  policy = <<POLICY
-{
-  "Version": "2012-10-17",
-  "Statement": [
-      {
-          "Sid": "Statement",
-          "Effect": "Allow",
-          "Action": "sts:AssumeRole",
-          "Resource": [
-            "${aws_iam_role.cloudwatch_exporter_pre_production[0].arn}"
-          ]
-      }
-  ]
-}
-POLICY
-
-  depends_on = [
-    aws_iam_role.cloudwatch_exporter_pre_production
-  ]
-}
-
-resource "aws_iam_role_policy_attachment" "pre_production_cloudwatch_exporter_allow_assume_IAMPolicy" {
-  count      = terraform.workspace == "pre-production" ? 0 : 1
-  policy_arn = aws_iam_policy.pre_production_cloudwatch_exporter_role_allow_assume_policy[0].arn
-  role       = aws_iam_role.cloudwatch_exporter.name
-
-  depends_on = [
-    aws_iam_policy.pre_production_cloudwatch_exporter_role_allow_assume_policy
-  ]
-}
+#resource "aws_iam_role" "cloudwatch_exporter_pre_production" {
+#  count              = terraform.workspace == "pre-production" ? 0 : 1
+#  assume_role_policy = data.aws_iam_policy_document.cloudwatch_exporter_assume_role_policy_other_aws_accounts.json
+#  name               = "${var.prefix}-CloudwatchExporter"
+#
+#  tags = var.tags
+#
+#  provider = aws.pre_production
+#}
+
+#resource "aws_iam_policy" "cloudwatch_exporter_iam_policy_pre_production" {
+#  count       = terraform.workspace == "pre-production" ? 0 : 1
+#  name        = "${var.prefix}-CloudwatchExporterIAMPolicy"
+#  path        = "/"
+#  description = "IAM role policy for Cloudwatch Exporter in EKS Cluster for ${var.prefix}"
+#
+#  policy = data.template_file.cloudwatch_exporter_iam_policy.rendered
+#
+#  tags = var.tags
+#
+#  provider = aws.pre_production
+#}
+
+#resource "aws_iam_role_policy_attachment" "cloudwatch_exporter_IAMPolicy_pre_production" {
+#  count      = terraform.workspace == "pre-production" ? 0 : 1
+#  policy_arn = aws_iam_policy.cloudwatch_exporter_iam_policy_pre_production[0].arn
+#  role       = aws_iam_role.cloudwatch_exporter_pre_production[0].name
+#
+#  provider = aws.pre_production
+#}
+
+#resource "aws_iam_policy" "pre_production_cloudwatch_exporter_role_allow_assume_policy" {
+#  count       = terraform.workspace == "pre-production" ? 0 : 1
+#  name        = "pre_production_cloudwatch_exporter_role_allow_assume_policy"
+#  path        = "/"
+#  description = "Policy that allows cloudwatch exporter in EKS Cluster for ${var.prefix} to assume role in pre-production AWS account"
+#
+#  policy = <<POLICY
+#{
+#  "Version": "2012-10-17",
+#  "Statement": [
+#      {
+#          "Sid": "Statement",
+#          "Effect": "Allow",
+#          "Action": "sts:AssumeRole",
+#          "Resource": [
+#            "${aws_iam_role.cloudwatch_exporter_pre_production[0].arn}"
+#          ]
+#      }
+#  ]
+#}
+#POLICY
+#
+#  depends_on = [
+#    aws_iam_role.cloudwatch_exporter_pre_production
+#  ]
+#}
+
+#resource "aws_iam_role_policy_attachment" "pre_production_cloudwatch_exporter_allow_assume_IAMPolicy" {
+#  count      = terraform.workspace == "pre-production" ? 0 : 1
+#  policy_arn = aws_iam_policy.pre_production_cloudwatch_exporter_role_allow_assume_policy[0].arn
+#  role       = aws_iam_role.cloudwatch_exporter.name
+#
+#  depends_on = [
+#    aws_iam_policy.pre_production_cloudwatch_exporter_role_allow_assume_policy
+#  ]
+#}
diff --git a/variables.tf b/variables.tf
@@ -15,16 +15,6 @@ variable "assume_role" {
   type        = string
 }
 
-variable "assume_role_development" {
-  description = "The role to assume in development aws account"
-  type        = string
-}
-
-variable "assume_role_pre_production" {
-  description = "The role to assume in pre-production aws account"
-  type        = string
-}
-
 variable "aws_region" {
   description = "The AWS region to create things in"
   type        = string