diff --git a/examples/iam-group-with-assumable-roles-policy/main.tf b/examples/iam-group-with-assumable-roles-policy/main.tf index 612dfacb..eef55d8f 100644 --- a/examples/iam-group-with-assumable-roles-policy/main.tf +++ b/examples/iam-group-with-assumable-roles-policy/main.tf @@ -107,7 +107,8 @@ module "iam_group_with_assumable_roles_policy_production_readonly" { module "iam_group_with_assumable_roles_policy_production_admin" { source = "../../modules/iam-group-with-assumable-roles-policy" - name = "production-admin" + name = "production-admin" + assumable_roles_policy_name_suffix = "-assumable-roles" assumable_roles = [module.iam_assumable_roles_in_prod.admin_iam_role_arn] diff --git a/modules/iam-group-with-assumable-roles-policy/README.md b/modules/iam-group-with-assumable-roles-policy/README.md index b0671fdc..f6f05dfc 100644 --- a/modules/iam-group-with-assumable-roles-policy/README.md +++ b/modules/iam-group-with-assumable-roles-policy/README.md @@ -35,6 +35,7 @@ No modules. | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | [assumable\_roles](#input\_assumable\_roles) | List of IAM roles ARNs which can be assumed by the group | `list(string)` | `[]` | no | +| [assumable\_roles\_policy\_name\_suffix](#input\_assumable\_roles\_policy\_name\_suffix) | Append this name to the policy name that will be created for assuming the given roles (default: null -- the policy name will be group name) | `string` | `""` | no | | [group\_users](#input\_group\_users) | List of IAM users to have in an IAM group which can assume the role | `list(string)` | `[]` | no | | [name](#input\_name) | Name of IAM policy and IAM group | `string` | n/a | yes | | [path](#input\_path) | Path of IAM policy and IAM group | `string` | `"/"` | no | diff --git a/modules/iam-group-with-assumable-roles-policy/main.tf b/modules/iam-group-with-assumable-roles-policy/main.tf index 7e550072..5dcff275 100644 --- a/modules/iam-group-with-assumable-roles-policy/main.tf +++ b/modules/iam-group-with-assumable-roles-policy/main.tf @@ -7,7 +7,7 @@ data "aws_iam_policy_document" "assume_role" { } resource "aws_iam_policy" "this" { - name = var.name + name = "${var.name}${var.assumable_roles_policy_name_suffix}" path = var.path description = "Allows to assume role in another AWS account" policy = data.aws_iam_policy_document.assume_role.json diff --git a/modules/iam-group-with-assumable-roles-policy/variables.tf b/modules/iam-group-with-assumable-roles-policy/variables.tf index b1b2b411..b28e6337 100644 --- a/modules/iam-group-with-assumable-roles-policy/variables.tf +++ b/modules/iam-group-with-assumable-roles-policy/variables.tf @@ -15,6 +15,12 @@ variable "assumable_roles" { default = [] } +variable "assumable_roles_policy_name_suffix" { + description = "Append this name to the policy name that will be created for assuming the given roles (default: null -- the policy name will be group name)" + type = string + default = "" +} + variable "group_users" { description = "List of IAM users to have in an IAM group which can assume the role" type = list(string) diff --git a/wrappers/iam-group-with-assumable-roles-policy/main.tf b/wrappers/iam-group-with-assumable-roles-policy/main.tf index 816d9f84..7ba6241e 100644 --- a/wrappers/iam-group-with-assumable-roles-policy/main.tf +++ b/wrappers/iam-group-with-assumable-roles-policy/main.tf @@ -3,9 +3,10 @@ module "wrapper" { for_each = var.items - assumable_roles = try(each.value.assumable_roles, var.defaults.assumable_roles, []) - group_users = try(each.value.group_users, var.defaults.group_users, []) - name = try(each.value.name, var.defaults.name) - path = try(each.value.path, var.defaults.path, "/") - tags = try(each.value.tags, var.defaults.tags, {}) + assumable_roles = try(each.value.assumable_roles, var.defaults.assumable_roles, []) + assumable_roles_policy_name_suffix = try(each.value.assumable_roles_policy_name_suffix, var.defaults.assumable_roles_policy_name_suffix, "") + group_users = try(each.value.group_users, var.defaults.group_users, []) + name = try(each.value.name, var.defaults.name) + path = try(each.value.path, var.defaults.path, "/") + tags = try(each.value.tags, var.defaults.tags, {}) }