Skip to content

Commit 314c32c

Browse files
Felix Ziegerfelixzieger
Felix Zieger
authored and
felixzieger
committed
feat: choose partition from context
1 parent 848c572 commit 314c32c

File tree

12 files changed

+28
-24
lines changed

12 files changed

+28
-24
lines changed

‎.github/workflows/workflow.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,10 @@ jobs:
1414
with:
1515
terraform_version: 1.0.10
1616

17-
# note: we can only validate the example atm. see https://github.com/hashicorp/terraform/issues/28490
17+
# note: we can only validate the example atm. see https://github.com/hashicorp/terraform/issues/28490
1818
- run: terraform init -backend=false
1919
working-directory: examples/basic-aws-integration
20-
20+
2121
- run: terraform validate
2222
working-directory: examples/basic-aws-integration
2323

‎README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,7 @@ Before opening a Pull Request, we recommend following the below steps to get a f
165165
166166
| Name | Version |
167167
|------|---------|
168+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.33.0 |
168169
| <a name="provider_aws.automation"></a> [aws.automation](#provider\_aws.automation) | 5.33.0 |
169170
| <a name="provider_aws.management"></a> [aws.management](#provider\_aws.management) | 5.33.0 |
170171
| <a name="provider_aws.meshcloud"></a> [aws.meshcloud](#provider\_aws.meshcloud) | 5.33.0 |
@@ -186,6 +187,7 @@ Before opening a Pull Request, we recommend following the below steps to get a f
186187
| [aws_caller_identity.automation](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
187188
| [aws_caller_identity.management](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
188189
| [aws_caller_identity.meshcloud](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
190+
| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
189191
190192
## Inputs
191193

‎main.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ data "aws_caller_identity" "automation" {
88
provider = aws.automation
99
}
1010

11+
data "aws_partition" "current" {}
12+
1113
module "meshcloud_account_metering_access" {
1214
source = "./modules/meshcloud-cost-explorer/ce-meshcloud-account-access"
1315
providers = {

‎modules/meshcloud-cost-explorer/ce-management-account-access/data.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ data "aws_iam_policy_document" "cost_explorer_service_assume_role" {
3939
effect = "Allow"
4040
principals {
4141
type = "AWS"
42-
identifiers = ["arn:aws:iam::${var.meshcloud_account_id}:user/${var.meshcloud_account_service_user_name}"]
42+
identifiers = ["arn:${data.aws_partition.current.partition}:iam::${var.meshcloud_account_id}:user/${var.meshcloud_account_service_user_name}"]
4343
}
4444
actions = ["sts:AssumeRole"]
4545
condition {

‎modules/meshcloud-cost-explorer/ce-meshcloud-account-access/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
| Name | Version |
1111
|------|---------|
12-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.21.0 |
12+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 2.7.0 |
1313

1414
## Modules
1515

‎modules/meshcloud-cost-explorer/ce-meshcloud-account-access/data.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ data "aws_iam_policy_document" "meshcloud_cost_explorer_user_assume_role" {
99
statement {
1010
effect = "Allow"
1111
actions = ["sts:AssumeRole"]
12-
resources = ["arn:aws:iam::${var.management_account_id}:role/${var.management_account_service_role_name}"]
12+
resources = ["arn:${data.aws_partition.current.partition}:iam::${var.management_account_id}:role/${var.management_account_service_role_name}"]
1313
condition {
1414
test = "StringEquals"
1515
variable = "sts:ExternalId"

‎modules/meshcloud-replicator/replicator-automation-account-access/data.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ data "aws_iam_policy_document" "meshfed_automation_assume_role" {
1010
effect = "Allow"
1111
principals {
1212
type = "AWS"
13-
identifiers = ["arn:aws:iam::${var.meshcloud_account_id}:user/${var.meshcloud_account_service_user_name}"]
13+
identifiers = ["arn:${data.aws_partition.current.partition}:iam::${var.meshcloud_account_id}:user/${var.meshcloud_account_service_user_name}"]
1414
}
1515
actions = ["sts:AssumeRole"]
1616
condition {
@@ -59,6 +59,6 @@ data "aws_iam_policy_document" "cloudformation_stackset_execution" {
5959
sid = "VisualEditor0"
6060
effect = "Allow"
6161
actions = ["sts:AssumeRole"]
62-
resources = ["arn:aws:iam::*:role/AWSCloudFormationStackSetExecutionRole"]
62+
resources = ["arn:${data.aws_partition.current.partition}:iam::*:role/AWSCloudFormationStackSetExecutionRole"]
6363
}
6464
}

‎modules/meshcloud-replicator/replicator-management-account-access/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ No modules.
2626
| [aws_iam_role_policy_attachment.meshfed_service_enrollment_additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
2727
| [aws_iam_role_policy_attachment.meshfed_service_enrollment_sc_adm_read](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
2828
| [aws_iam_role_policy_attachment.meshfed_service_enrollment_sc_enduser](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
29-
| [aws_servicecatalog_principal_portfolio_association.example](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/servicecatalog_principal_portfolio_association) | resource |
29+
| [aws_servicecatalog_principal_portfolio_association.meshfed_service](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/servicecatalog_principal_portfolio_association) | resource |
3030
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
3131
| [aws_iam_policy_document.meshfed_service](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
3232
| [aws_iam_policy_document.meshfed_service_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

‎modules/meshcloud-replicator/replicator-management-account-access/data.tf

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ data "aws_iam_policy_document" "meshfed_service" {
1010
sid = "StsAccessMemberAccount"
1111
effect = "Allow"
1212
actions = ["sts:AssumeRole"]
13-
resources = ["arn:aws:iam::*:role/${var.meshstack_access_role_name}"]
13+
resources = ["arn:${data.aws_partition.current.partition}:iam::*:role/${var.meshstack_access_role_name}"]
1414
condition {
1515
test = "StringEquals"
1616
variable = "sts:ExternalId"
@@ -30,9 +30,9 @@ data "aws_iam_policy_document" "meshfed_service" {
3030
"organizations:ListTagsForResource"
3131
]
3232
resources = [
33-
"arn:aws:organizations::*:account/o-*/*",
34-
"arn:aws:organizations::*:ou/o-*/ou-*",
35-
"arn:aws:organizations::${local.account_id}:root/o-*/r-*"
33+
"arn:${data.aws_partition.current.partition}:organizations::*:account/o-*/*",
34+
"arn:${data.aws_partition.current.partition}:organizations::*:ou/o-*/ou-*",
35+
"arn:${data.aws_partition.current.partition}:organizations::${local.account_id}:root/o-*/r-*"
3636
]
3737
}
3838

@@ -49,9 +49,9 @@ data "aws_iam_policy_document" "meshfed_service" {
4949
# The actions organizations:TagResource and organizations:UntagResource act on accounts.
5050
# The actions can not be restricted to a subtree of the OU hierarchy. This is a limitation in the permission model of AWS Organization Service.
5151
# To supprt tagging for this meshPlatform we need to allow both actions on all accounts.
52-
"arn:aws:organizations::*:account/o-*/*",
52+
"arn:${data.aws_partition.current.partition}:organizations::*:account/o-*/*",
5353
# New accounts need to be moved from root to the target OU.
54-
"arn:aws:organizations::${local.account_id}:root/o-*/r-*"
54+
"arn:${data.aws_partition.current.partition}:organizations::${local.account_id}:root/o-*/r-*"
5555
],
5656
var.landing_zone_ou_arns)
5757
}
@@ -80,8 +80,8 @@ data "aws_iam_policy_document" "meshfed_service" {
8080
]
8181
resources = [
8282
"${var.aws_sso_instance_arn}",
83-
"arn:aws:sso:::permissionSet/*/*",
84-
"arn:aws:sso:::account/*"
83+
"arn:${data.aws_partition.current.partition}:sso:::permissionSet/*/*",
84+
"arn:${data.aws_partition.current.partition}:sso:::account/*"
8585
]
8686
}
8787

@@ -99,8 +99,8 @@ data "aws_iam_policy_document" "meshfed_service" {
9999
"iam:GetSAMLProvider"
100100
]
101101
resources = [
102-
"arn:aws:iam::${local.account_id}:saml-provider/*",
103-
"arn:aws:iam::${local.account_id}:role/*"
102+
"arn:${data.aws_partition.current.partition}:iam::${local.account_id}:saml-provider/*",
103+
"arn:${data.aws_partition.current.partition}:iam::${local.account_id}:role/*"
104104
]
105105
}
106106
}
@@ -112,7 +112,7 @@ data "aws_iam_policy_document" "meshfed_service_assume_role" {
112112
effect = "Allow"
113113
principals {
114114
type = "AWS"
115-
identifiers = ["arn:aws:iam::${var.meshcloud_account_id}:user/${var.meshcloud_account_service_user_name}"]
115+
identifiers = ["arn:${data.aws_partition.current.partition}:iam::${var.meshcloud_account_id}:user/${var.meshcloud_account_service_user_name}"]
116116
}
117117
actions = ["sts:AssumeRole"]
118118
condition {

‎modules/meshcloud-replicator/replicator-management-account-access/module.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,13 @@ resource "aws_iam_role_policy_attachment" "meshfed_service" {
1818
resource "aws_iam_role_policy_attachment" "meshfed_service_enrollment_sc_enduser" {
1919
count = var.control_tower_enrollment_enabled ? 1 : 0
2020
role = aws_iam_role.meshfed_service.name
21-
policy_arn = "arn:aws:iam::aws:policy/AWSServiceCatalogEndUserFullAccess"
21+
policy_arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/AWSServiceCatalogEndUserFullAccess"
2222
}
2323

2424
resource "aws_iam_role_policy_attachment" "meshfed_service_enrollment_sc_adm_read" {
2525
count = var.control_tower_enrollment_enabled ? 1 : 0
2626
role = aws_iam_role.meshfed_service.name
27-
policy_arn = "arn:aws:iam::aws:policy/AWSServiceCatalogAdminReadOnlyAccess"
27+
policy_arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/AWSServiceCatalogAdminReadOnlyAccess"
2828
}
2929

3030
resource "aws_iam_policy" "meshfed_service_enrollment_additional" {

0 commit comments

Comments
 (0)