Merge pull request #7 from tamu-edu/feature/fix-deprecations

Feature/fix deprecations

Author: joraff

README.md

@@ -45,9 +45,8 @@ module "github_oidc" {
 | -- | -- | -- | -- |
 | `name` | The name of the role. | `string` | Required |
 | `subjects` | A list of GitHub subject values. | `list(string)` | Required |
-| `inline_policies` | A map of inline policies to attach to the role. | `map(string)` | Optional |
+| `policies` | A map of policies to create and attach to the role. The key will be used in the policy name. | `map(string)` | Optional |
 | `managed_policy_arns` | A list of managed policies ARNs to attach to the role. | `list(string)` | Optional
-| `add_oidc_provider` | Whether to add the OIDC provider to the account. | `bool` | `true` |
 | `tags` | A map of tags to add to the role. | `map(string)` | Optional |
 
 ## Outputs

inputs.tf

@@ -9,24 +9,18 @@ variable "subjects" {
   description = "The list of subjects to allow to assume this role."
 }
 
-variable "inline_policies" {
+variable "policies" {
   type        = map(string)
-  description = "A map of inline policies (JSON) to attach to this role. Keys will be used as the policy name."
+  description = "A map of policies (JSON) to attach to this role. Keys will be used as the policy name."
   default     = {}
 }
 
 variable "managed_policy_arns" {
   type        = list(string)
-  description = "A list of AWS managed policies arns to attach to this role."
+  description = "A list of AWS managed policy ARNs to attach to this role."
   default     = []
 }
 
-variable "add_oidc_provider" {
-  type        = bool
-  description = "Whether to add the OIDC provider for GitHub Actions. Default true"
-  default     = true
-}
-
 variable "tags" {
   type        = map(string)
   description = "A map of tags to add to the role."

main.tf

@@ -11,14 +11,31 @@ terraform {
 
 data "aws_caller_identity" "current" {}
 
+
+# See if the GitHub OIDC provider already exists
+data "aws_iam_openid_connect_provider" "github" {
+  url = "https://token.actions.githubusercontent.com"
+
+  # This will return empty if not found, rather than error
+  count = 1
+}
+
+locals {
+  oidc_provider_exists = length(data.aws_iam_openid_connect_provider.github) > 0 && try(data.aws_iam_openid_connect_provider.github[0].arn, "") != ""
+}
+
+# Only create if it doesn't exist
 resource "aws_iam_openid_connect_provider" "github" {
-  count          = var.add_oidc_provider ? 1 : 0
-  client_id_list = ["sts.amazonaws.com"]
-  url            = "https://token.actions.githubusercontent.com"
-  thumbprint_list = [
-    "1c58a3a8518e8759bf075b76b750d4f2df264fcd",
-    "6938fd4d98bab03faadb97b34396831e3780aea1"
-  ]
+  count = local.oidc_provider_exists ? 0 : 1
+
+  url             = "https://token.actions.githubusercontent.com"
+  client_id_list  = ["sts.amazonaws.com"]
+  thumbprint_list = ["6938fd4d98bab03faadb97b34396831e3780aea1"]
+}
+
+# Use this output to reference the ARN regardless of creation method
+locals {
+  oidc_provider_arn = local.oidc_provider_exists ? data.aws_iam_openid_connect_provider.github[0].arn : aws_iam_openid_connect_provider.github[0].arn
 }
 
 resource "aws_iam_role" "github_actions" {
@@ -38,29 +55,35 @@ resource "aws_iam_role" "github_actions" {
                 },
                 "Effect":"Allow",
                 "Principal":{
-                    "Federated":"arn:aws:iam::${data.aws_caller_identity.current.account_id}:oidc-provider/token.actions.githubusercontent.com"
+                    "Federated":"${local.oidc_provider_arn}"
                 }
             }
         ],
         "Version":"2012-10-17"
     }
   EOF
 
-  dynamic "inline_policy" {
-    for_each = var.inline_policies
-    content {
-      name   = "inline_policy_${inline_policy.key}"
-      policy = inline_policy.value
-    }
-  }
-
-  managed_policy_arns = var.managed_policy_arns
-
   tags = var.tags
 
   max_session_duration = var.max_session_duration
 }
 
+resource "aws_iam_role_policy" "policy" {
+  for_each = var.policies
+
+  name   = "${aws_iam_role.github_actions.name}_${each.key}"
+  role   = aws_iam_role.github_actions.name
+  policy = each.value
+}
+
+resource "aws_iam_role_policy_attachment" "managed" {
+  for_each = toset(var.managed_policy_arns)
+
+  role       = aws_iam_role.github_actions.name
+  policy_arn = each.value
+}
+
 output "role_arn" {
   value = aws_iam_role.github_actions.arn
 }
+