diff --git a/examples/iam-group-with-assumable-roles-policy/main.tf b/examples/iam-group-with-assumable-roles-policy/main.tf
index 612dfacb..eef55d8f 100644
--- a/examples/iam-group-with-assumable-roles-policy/main.tf
+++ b/examples/iam-group-with-assumable-roles-policy/main.tf
@@ -107,7 +107,8 @@ module "iam_group_with_assumable_roles_policy_production_readonly" {
module "iam_group_with_assumable_roles_policy_production_admin" {
source = "../../modules/iam-group-with-assumable-roles-policy"
- name = "production-admin"
+ name = "production-admin"
+ assumable_roles_policy_name_suffix = "-assumable-roles"
assumable_roles = [module.iam_assumable_roles_in_prod.admin_iam_role_arn]
diff --git a/modules/iam-group-with-assumable-roles-policy/README.md b/modules/iam-group-with-assumable-roles-policy/README.md
index b0671fdc..f6f05dfc 100644
--- a/modules/iam-group-with-assumable-roles-policy/README.md
+++ b/modules/iam-group-with-assumable-roles-policy/README.md
@@ -35,6 +35,7 @@ No modules.
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| [assumable\_roles](#input\_assumable\_roles) | List of IAM roles ARNs which can be assumed by the group | `list(string)` | `[]` | no |
+| [assumable\_roles\_policy\_name\_suffix](#input\_assumable\_roles\_policy\_name\_suffix) | Append this name to the policy name that will be created for assuming the given roles (default: null -- the policy name will be group name) | `string` | `""` | no |
| [group\_users](#input\_group\_users) | List of IAM users to have in an IAM group which can assume the role | `list(string)` | `[]` | no |
| [name](#input\_name) | Name of IAM policy and IAM group | `string` | n/a | yes |
| [path](#input\_path) | Path of IAM policy and IAM group | `string` | `"/"` | no |
diff --git a/modules/iam-group-with-assumable-roles-policy/main.tf b/modules/iam-group-with-assumable-roles-policy/main.tf
index 7e550072..5dcff275 100644
--- a/modules/iam-group-with-assumable-roles-policy/main.tf
+++ b/modules/iam-group-with-assumable-roles-policy/main.tf
@@ -7,7 +7,7 @@ data "aws_iam_policy_document" "assume_role" {
}
resource "aws_iam_policy" "this" {
- name = var.name
+ name = "${var.name}${var.assumable_roles_policy_name_suffix}"
path = var.path
description = "Allows to assume role in another AWS account"
policy = data.aws_iam_policy_document.assume_role.json
diff --git a/modules/iam-group-with-assumable-roles-policy/variables.tf b/modules/iam-group-with-assumable-roles-policy/variables.tf
index b1b2b411..b28e6337 100644
--- a/modules/iam-group-with-assumable-roles-policy/variables.tf
+++ b/modules/iam-group-with-assumable-roles-policy/variables.tf
@@ -15,6 +15,12 @@ variable "assumable_roles" {
default = []
}
+variable "assumable_roles_policy_name_suffix" {
+ description = "Append this name to the policy name that will be created for assuming the given roles (default: null -- the policy name will be group name)"
+ type = string
+ default = ""
+}
+
variable "group_users" {
description = "List of IAM users to have in an IAM group which can assume the role"
type = list(string)
diff --git a/wrappers/iam-group-with-assumable-roles-policy/main.tf b/wrappers/iam-group-with-assumable-roles-policy/main.tf
index 816d9f84..7ba6241e 100644
--- a/wrappers/iam-group-with-assumable-roles-policy/main.tf
+++ b/wrappers/iam-group-with-assumable-roles-policy/main.tf
@@ -3,9 +3,10 @@ module "wrapper" {
for_each = var.items
- assumable_roles = try(each.value.assumable_roles, var.defaults.assumable_roles, [])
- group_users = try(each.value.group_users, var.defaults.group_users, [])
- name = try(each.value.name, var.defaults.name)
- path = try(each.value.path, var.defaults.path, "/")
- tags = try(each.value.tags, var.defaults.tags, {})
+ assumable_roles = try(each.value.assumable_roles, var.defaults.assumable_roles, [])
+ assumable_roles_policy_name_suffix = try(each.value.assumable_roles_policy_name_suffix, var.defaults.assumable_roles_policy_name_suffix, "")
+ group_users = try(each.value.group_users, var.defaults.group_users, [])
+ name = try(each.value.name, var.defaults.name)
+ path = try(each.value.path, var.defaults.path, "/")
+ tags = try(each.value.tags, var.defaults.tags, {})
}