Skip to content

Commit 726b1c5

Browse files
author
rohit-ng
committed
feat: add module for iam
1 parent 983af8e commit 726b1c5

File tree

11 files changed

+105
-54
lines changed

11 files changed

+105
-54
lines changed

‎README.md

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,10 @@
1414

1515
| Name | Source | Version |
1616
|------|--------|---------|
17+
| <a name="module_ecs_exec_role"></a> [ecs\_exec\_role](#module\_ecs\_exec\_role) | ./modules/iam | n/a |
1718
| <a name="module_ecs_kong"></a> [ecs\_kong](#module\_ecs\_kong) | github.com/infraspecdev/terraform-aws-ecs-deployment | v1.1.1 |
1819
| <a name="module_ecs_node_security_group"></a> [ecs\_node\_security\_group](#module\_ecs\_node\_security\_group) | terraform-aws-modules/security-group/aws | ~> 5.1.2 |
20+
| <a name="module_ecs_task_role"></a> [ecs\_task\_role](#module\_ecs\_task\_role) | ./modules/iam | n/a |
1921
| <a name="module_ecs_task_security_group"></a> [ecs\_task\_security\_group](#module\_ecs\_task\_security\_group) | terraform-aws-modules/security-group/aws | ~> 5.1.2 |
2022
| <a name="module_internal_alb_kong"></a> [internal\_alb\_kong](#module\_internal\_alb\_kong) | github.com/infraspecdev/terraform-aws-ecs-deployment//modules/alb | v1.1.1 |
2123
| <a name="module_internal_alb_security_group"></a> [internal\_alb\_security\_group](#module\_internal\_alb\_security\_group) | terraform-aws-modules/security-group/aws | ~> 5.1.2 |
@@ -29,12 +31,6 @@
2931

3032
| Name | Type |
3133
|------|------|
32-
| [aws_iam_role.ecs_exec_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
33-
| [aws_iam_role.ecs_node_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
34-
| [aws_iam_role.ecs_task_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
35-
| [aws_iam_role_policy_attachment.ecs_exec_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
36-
| [aws_iam_policy_document.ecs_node_doc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
37-
| [aws_iam_policy_document.ecs_task_doc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
3834
| [aws_ssm_parameter.ecs_node_ami](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source |
3935
| [aws_vpc.vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc) | data source |
4036

‎iam.tf

Lines changed: 14 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,44 +1,15 @@
1-
2-
data "aws_iam_policy_document" "ecs_node_doc" {
3-
statement {
4-
actions = ["sts:AssumeRole"]
5-
effect = "Allow"
6-
7-
principals {
8-
type = "Service"
9-
identifiers = ["ec2.amazonaws.com"]
10-
}
11-
}
12-
}
13-
14-
resource "aws_iam_role" "ecs_node_role" {
15-
name_prefix = "ecs-node-role"
16-
assume_role_policy = data.aws_iam_policy_document.ecs_node_doc.json
17-
}
18-
19-
data "aws_iam_policy_document" "ecs_task_doc" {
20-
statement {
21-
actions = ["sts:AssumeRole"]
22-
effect = "Allow"
23-
24-
principals {
25-
type = "Service"
26-
identifiers = ["ecs-tasks.amazonaws.com"]
27-
}
28-
}
29-
}
30-
31-
resource "aws_iam_role" "ecs_task_role" {
32-
name_prefix = "ecs-task-role"
33-
assume_role_policy = data.aws_iam_policy_document.ecs_task_doc.json
34-
}
35-
36-
resource "aws_iam_role" "ecs_exec_role" {
37-
name_prefix = "demo-ecs-exec-role"
38-
assume_role_policy = data.aws_iam_policy_document.ecs_task_doc.json
39-
}
40-
41-
resource "aws_iam_role_policy_attachment" "ecs_exec_role" {
42-
role = aws_iam_role.ecs_exec_role.name
43-
policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
1+
module "ecs_task_role" {
2+
source = "./modules/iam"
3+
name_prefix = "ecs-task-role"
4+
principal_type = "Service"
5+
principal_identifiers = ["ecs-tasks.amazonaws.com"]
6+
policy_arns = ["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]
7+
}
8+
9+
module "ecs_exec_role" {
10+
source = "./modules/iam"
11+
name_prefix = "ecs-exec-role"
12+
principal_type = "Service"
13+
principal_identifiers = ["ecs-tasks.amazonaws.com"]
14+
policy_arns = ["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]
4415
}

‎main.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -185,8 +185,8 @@ module "ecs_kong" {
185185
network_mode = local.kong.network_mode
186186
cpu = var.cpu_for_kong_task
187187
memory = var.memory_for_kong_task
188-
task_role_arn = aws_iam_role.ecs_task_role.arn
189-
execution_role_arn = aws_iam_role.ecs_exec_role.arn
188+
task_role_arn = module.ecs_task_role.role_arn
189+
execution_role_arn = module.ecs_exec_role.role_arn
190190

191191
container_definitions = [
192192
{

‎modules/iam/.header.md

Whitespace-only changes.

‎modules/iam/README.md

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
## Requirements
2+
3+
No requirements.
4+
5+
## Providers
6+
7+
| Name | Version |
8+
|------|---------|
9+
| <a name="provider_aws"></a> [aws](#provider\_aws) | n/a |
10+
11+
## Modules
12+
13+
No modules.
14+
15+
## Resources
16+
17+
| Name | Type |
18+
|------|------|
19+
| [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
20+
| [aws_iam_role_policy_attachment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
21+
| [aws_iam_policy_document.assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
22+
23+
## Inputs
24+
25+
| Name | Description | Type | Default | Required |
26+
|------|-------------|------|---------|:--------:|
27+
| <a name="input_name_prefix"></a> [name\_prefix](#input\_name\_prefix) | Prefix for IAM role name | `string` | n/a | yes |
28+
| <a name="input_policy_arns"></a> [policy\_arns](#input\_policy\_arns) | List of IAM policy ARNs to attach to the role | `list(string)` | `[]` | no |
29+
| <a name="input_principal_identifiers"></a> [principal\_identifiers](#input\_principal\_identifiers) | List of principal identifiers (e.g., ec2.amazonaws.com, ecs-tasks.amazonaws.com) | `list(string)` | n/a | yes |
30+
| <a name="input_principal_type"></a> [principal\_type](#input\_principal\_type) | Type of the principal (e.g., Service, User, etc.) | `string` | n/a | yes |
31+
32+
## Outputs
33+
34+
| Name | Description |
35+
|------|-------------|
36+
| <a name="output_role_arn"></a> [role\_arn](#output\_role\_arn) | The ARN of the IAM role |
37+
| <a name="output_role_name"></a> [role\_name](#output\_role\_name) | The name of the IAM role |

‎modules/iam/data.tf

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
data "aws_iam_policy_document" "assume_role_policy" {
2+
statement {
3+
actions = ["sts:AssumeRole"]
4+
effect = "Allow"
5+
6+
principals {
7+
type = var.principal_type
8+
identifiers = var.principal_identifiers
9+
}
10+
}
11+
}

‎modules/iam/main.tf

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
resource "aws_iam_role" "this" {
2+
name_prefix = var.name_prefix
3+
assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
4+
}
5+
6+
resource "aws_iam_role_policy_attachment" "this" {
7+
count = length(var.policy_arns)
8+
role = aws_iam_role.this.name
9+
policy_arn = element(var.policy_arns, count.index)
10+
}

‎modules/iam/outputs.tf

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
output "role_name" {
2+
description = "The name of the IAM role"
3+
value = aws_iam_role.this.name
4+
}
5+
6+
output "role_arn" {
7+
description = "The ARN of the IAM role"
8+
value = aws_iam_role.this.arn
9+
}

‎modules/iam/variables.tf

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
variable "name_prefix" {
2+
description = "Prefix for IAM role name"
3+
type = string
4+
}
5+
6+
variable "principal_type" {
7+
description = "Type of the principal (e.g., Service, User, etc.)"
8+
type = string
9+
}
10+
11+
variable "principal_identifiers" {
12+
description = "List of principal identifiers (e.g., ec2.amazonaws.com, ecs-tasks.amazonaws.com)"
13+
type = list(string)
14+
}
15+
16+
variable "policy_arns" {
17+
description = "List of IAM policy ARNs to attach to the role"
18+
type = list(string)
19+
default = []
20+
}

‎modules/route-53-record/.header.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +0,0 @@
1-
# Main

0 commit comments

Comments
 (0)