trusted_entities input is only accepting Service Principals

[flibustier]

Is your request related to a new offering from AWS?

I don’t think so

Is your request related to a problem? Please describe.

We want our trusted entities from our lambda role to look like the following:

"Principal": {
  "Service": "lambda.amazonaws.com",
  "AWS": "arn:aws:sts::************:assumed-role/OktaRoleFor*****/******@*****.com"
},

Unfortunately, when using the input trusted_entities as following:

trusted_entities = ["arn:aws:sts::************:assumed-role/OktaRoleFor*****/******@*****.com"]

Terraform tries to perform this :

# module.aws_iam_role.lambda[0] will be updated in-place
  ~ resource "aws_iam_role" "lambda" {
      ~ assume_role_policy    = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Principal = {
                          - AWS     = "arn:aws:sts::************:assumed-role/OktaRoleFor*****/******@*****.com" -> null
                          ~ Service = "lambda.amazonaws.com" -> [
                              + "lambda.amazonaws.com",
                              + "arn:aws:sts::************:assumed-role/OktaRoleFor*****/******@*****.com",
                            ]
                        }
                        # (3 unchanged elements hidden)
                    },
                ]
                # (1 unchanged element hidden)
            }
        )

Which will result in a
Error Updating IAM Role (****) Assume Role Policy: MalformedPolicyDocument: Invalid principal in policy: "SERVICE":"arn:aws:sts::************:assumed-role/OktaRoleFor*****/******@*****.com"

Describe the solution you'd like.

It would be nice to use trusted_entities like so:

trusted_entities = {
  "AWS" = "arn:aws:sts::************:assumed-role/OktaRoleFor*****/******@*****.com"
}

Describe alternatives you've considered.

We don’t find an alternative at this moment, we would appreciate any direction :)

Additional context

Thank you all for your great work on this fabulous module !! 🎉

[milosbackonja]

@flibustier You could create role and policy separately, and specify role ARN in lambda together with create_role = false

[antonbabenko]

+1 to what @milosbackonja says.

This module does not support the use-case you describe out-of-the-box because it is less common.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.