Skip to content

Commit 1cbd524

Browse files
lawliet89lawliet89
authored
Initial commit (#1)
1 parent 8f0fc9f commit 1cbd524

File tree

7 files changed

+204
-2
lines changed

7 files changed

+204
-2
lines changed

‎.github/workflows/ci.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,4 @@ jobs:
88
ci:
99
uses: SPHTech-Platform/reusable-workflows/.github/workflows/terraform.yaml@main
1010
with:
11-
upload_sarif: false
11+
upload_sarif: true

‎README.md

Lines changed: 54 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,54 @@
1-
# Terraform Modules Template
1+
# TFC Workload Identity for AWS
2+
3+
<!-- BEGIN_TF_DOCS -->
4+
## Requirements
5+
6+
| Name | Version |
7+
|------|---------|
8+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
9+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.0 |
10+
11+
## Providers
12+
13+
| Name | Version |
14+
|------|---------|
15+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.0 |
16+
| <a name="provider_tls"></a> [tls](#provider\_tls) | n/a |
17+
18+
## Modules
19+
20+
| Name | Source | Version |
21+
|------|--------|---------|
22+
| <a name="module_tfc_workload_identity_role"></a> [tfc\_workload\_identity\_role](#module\_tfc\_workload\_identity\_role) | terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc | ~> 5.3.0 |
23+
24+
## Resources
25+
26+
| Name | Type |
27+
|------|------|
28+
| [aws_iam_openid_connect_provider.tfc_provider](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_openid_connect_provider) | resource |
29+
| [tls_certificate.tfc_certificate](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/data-sources/certificate) | data source |
30+
31+
## Inputs
32+
33+
| Name | Description | Type | Default | Required |
34+
|------|-------------|------|---------|:--------:|
35+
| <a name="input_create_tfc_oidc_provider"></a> [create\_tfc\_oidc\_provider](#input\_create\_tfc\_oidc\_provider) | Create TFC OIDC Provider. Only one can exist in an account | `bool` | `true` | no |
36+
| <a name="input_create_tfc_workload_identity_role"></a> [create\_tfc\_workload\_identity\_role](#input\_create\_tfc\_workload\_identity\_role) | Create IAM Role for TFC Workload Identity | `bool` | `true` | no |
37+
| <a name="input_tags"></a> [tags](#input\_tags) | List of tags for resources | `map(string)` | `{}` | no |
38+
| <a name="input_tfc_oidc_provider_audiences"></a> [tfc\_oidc\_provider\_audiences](#input\_tfc\_oidc\_provider\_audiences) | List of TFC OIDC Provider audiences. This is part of the security configuration between TFC and your AWS account | `list(string)` | `[]` | no |
39+
| <a name="input_tfc_workload_identity_role"></a> [tfc\_workload\_identity\_role](#input\_tfc\_workload\_identity\_role) | Name of the IAM Role for TFC | `string` | `"TfcWorkloadIdentity"` | no |
40+
| <a name="input_tfc_workload_identity_role_audiences"></a> [tfc\_workload\_identity\_role\_audiences](#input\_tfc\_workload\_identity\_role\_audiences) | List of allowed audiences for the IAM Role. Defaults to the one for the OIDC provider if unspecified. | `list(string)` | `[]` | no |
41+
| <a name="input_tfc_workload_identity_role_description"></a> [tfc\_workload\_identity\_role\_description](#input\_tfc\_workload\_identity\_role\_description) | Description of the IAM Role for TFC | `string` | `"Terraform Cloud Workload Identity"` | no |
42+
| <a name="input_tfc_workload_identity_role_max_session_duration"></a> [tfc\_workload\_identity\_role\_max\_session\_duration](#input\_tfc\_workload\_identity\_role\_max\_session\_duration) | Maximum CLI/API session duration in seconds between 3600 and 43200 | `number` | `3600` | no |
43+
| <a name="input_tfc_workload_identity_role_permissions_boundary_arn"></a> [tfc\_workload\_identity\_role\_permissions\_boundary\_arn](#input\_tfc\_workload\_identity\_role\_permissions\_boundary\_arn) | Permissions boundary ARN to use for IAM role for TFC | `string` | `""` | no |
44+
| <a name="input_tfc_workload_identity_role_policy_arns"></a> [tfc\_workload\_identity\_role\_policy\_arns](#input\_tfc\_workload\_identity\_role\_policy\_arns) | List of ARN to attach the IAM Role for TFC | `list(string)` | `[]` | no |
45+
| <a name="input_tfc_workload_identity_workspaces"></a> [tfc\_workload\_identity\_workspaces](#input\_tfc\_workload\_identity\_workspaces) | Workspaces to allow access to the workload identity for this account | `map(list(string))` | `{}` | no |
46+
47+
## Outputs
48+
49+
| Name | Description |
50+
|------|-------------|
51+
| <a name="output_tfc_workload_identity_audience"></a> [tfc\_workload\_identity\_audience](#output\_tfc\_workload\_identity\_audience) | Audience value for TFC workload identity |
52+
| <a name="output_tfc_workload_identity_role_arn"></a> [tfc\_workload\_identity\_role\_arn](#output\_tfc\_workload\_identity\_role\_arn) | IAM Role ARN for TFC Workload Identity |
53+
| <a name="output_tfc_workload_identity_workspaces"></a> [tfc\_workload\_identity\_workspaces](#output\_tfc\_workload\_identity\_workspaces) | Workspaces allowed to assume the Workload Identity IAM Role |
54+
<!-- END_TF_DOCS -->

‎data.tf

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
locals {
2+
tfc_workload_identity_workspaces_exact = flatten([
3+
for org, workspaces in var.tfc_workload_identity_workspaces : [
4+
for workspace in workspaces : [
5+
"organization:${org}:workspace:${workspace}:run_phase:plan",
6+
"organization:${org}:workspace:${workspace}:run_phase:apply",
7+
] if !can(regex("\\*+", workspace))
8+
]
9+
])
10+
tfc_workload_identity_workspaces_wildcard = flatten([
11+
for org, workspaces in var.tfc_workload_identity_workspaces : [
12+
for workspace in workspaces : "organization:${org}:workspace:${workspace}:run_phase:*" if can(regex("\\*+", workspace))
13+
]
14+
])
15+
16+
oidc_provider_url = "https://app.terraform.io"
17+
}
18+
19+
data "tls_certificate" "tfc_certificate" {
20+
url = "https://app.terraform.io"
21+
}

‎main.tf

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
resource "aws_iam_openid_connect_provider" "tfc_provider" {
2+
count = var.create_tfc_oidc_provider ? 1 : 0
3+
4+
url = local.oidc_provider_url
5+
client_id_list = var.tfc_oidc_provider_audiences
6+
thumbprint_list = [
7+
data.tls_certificate.tfc_certificate.certificates.0.sha1_fingerprint,
8+
]
9+
}
10+
11+
module "tfc_workload_identity_role" {
12+
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
13+
version = "~> 5.3.0"
14+
15+
# Role must not be created if no workspaces are listed. Otherwise, anyone on TFC with the right
16+
# audience can assume this role.
17+
create_role = var.create_tfc_workload_identity_role && (
18+
length(local.tfc_workload_identity_workspaces_exact) + length(local.tfc_workload_identity_workspaces_wildcard) > 0
19+
)
20+
21+
role_name = var.tfc_workload_identity_role
22+
role_description = var.tfc_workload_identity_role_description
23+
24+
role_policy_arns = var.tfc_workload_identity_role_policy_arns
25+
role_permissions_boundary_arn = var.tfc_workload_identity_role_permissions_boundary_arn
26+
force_detach_policies = true
27+
28+
max_session_duration = var.tfc_workload_identity_role_max_session_duration
29+
30+
provider_url = var.create_tfc_oidc_provider ? aws_iam_openid_connect_provider.tfc_provider[0].url : local.oidc_provider_url
31+
32+
oidc_fully_qualified_subjects = local.tfc_workload_identity_workspaces_exact
33+
oidc_subjects_with_wildcards = local.tfc_workload_identity_workspaces_wildcard
34+
oidc_fully_qualified_audiences = coalescelist(var.tfc_workload_identity_role_audiences, aws_iam_openid_connect_provider.tfc_provider[0].client_id_list)
35+
36+
tags = var.tags
37+
}

‎output.tf

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
output "tfc_workload_identity_role_arn" {
2+
description = "IAM Role ARN for TFC Workload Identity"
3+
value = module.tfc_workload_identity_role.iam_role_arn
4+
}
5+
6+
output "tfc_workload_identity_audience" {
7+
description = "Audience value for TFC workload identity"
8+
value = var.create_tfc_oidc_provider ? aws_iam_openid_connect_provider.tfc_provider[0].client_id_list : []
9+
}
10+
11+
output "tfc_workload_identity_workspaces" {
12+
description = "Workspaces allowed to assume the Workload Identity IAM Role"
13+
value = concat(
14+
local.tfc_workload_identity_workspaces_exact,
15+
local.tfc_workload_identity_workspaces_wildcard,
16+
)
17+
}

‎variables.tf

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
variable "tags" {
2+
description = "List of tags for resources"
3+
type = map(string)
4+
default = {}
5+
}
6+
7+
variable "create_tfc_oidc_provider" {
8+
description = "Create TFC OIDC Provider. Only one can exist in an account"
9+
type = bool
10+
default = true
11+
}
12+
13+
variable "tfc_oidc_provider_audiences" {
14+
description = "List of TFC OIDC Provider audiences. This is part of the security configuration between TFC and your AWS account"
15+
type = list(string)
16+
default = []
17+
}
18+
19+
variable "create_tfc_workload_identity_role" {
20+
description = "Create IAM Role for TFC Workload Identity"
21+
type = bool
22+
default = true
23+
}
24+
25+
variable "tfc_workload_identity_role" {
26+
description = "Name of the IAM Role for TFC"
27+
type = string
28+
default = "TfcWorkloadIdentity"
29+
}
30+
31+
variable "tfc_workload_identity_role_description" {
32+
description = "Description of the IAM Role for TFC"
33+
type = string
34+
default = "Terraform Cloud Workload Identity"
35+
}
36+
37+
variable "tfc_workload_identity_role_max_session_duration" {
38+
description = "Maximum CLI/API session duration in seconds between 3600 and 43200"
39+
type = number
40+
default = 3600
41+
}
42+
43+
variable "tfc_workload_identity_role_policy_arns" {
44+
description = "List of ARN to attach the IAM Role for TFC"
45+
type = list(string)
46+
default = []
47+
}
48+
49+
variable "tfc_workload_identity_role_permissions_boundary_arn" {
50+
description = "Permissions boundary ARN to use for IAM role for TFC"
51+
type = string
52+
default = ""
53+
}
54+
55+
variable "tfc_workload_identity_workspaces" {
56+
description = "Workspaces to allow access to the workload identity for this account"
57+
type = map(list(string)) # Key is the organization, values are the list of workspaces
58+
default = {}
59+
}
60+
61+
variable "tfc_workload_identity_role_audiences" {
62+
description = "List of allowed audiences for the IAM Role. Defaults to the one for the OIDC provider if unspecified."
63+
type = list(string)
64+
default = []
65+
}

‎versions.tf

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
terraform {
2+
required_version = ">= 1.0"
3+
required_providers {
4+
aws = {
5+
source = "hashicorp/aws"
6+
version = ">= 4.0"
7+
}
8+
}
9+
}

0 commit comments

Comments
 (0)