PGAP-10: Add local IAM role module (feat)

modules/aws-iam-role/main.tf

@@ -0,0 +1,52 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+# DEPLOY AN IAM ROLE
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+terraform {
+  required_version = ">= 0.12"
+}
+
+data "aws_iam_policy_document" "assume_role_policy" {
+  statement {
+    effect  = "Allow"
+    actions = ["sts:AssumeRole"]
+
+    dynamic "principals" {
+      for_each = length(var.aws_principals) > 0 ? [1] : []
+
+      content {
+        type        = "AWS"
+        identifiers = var.aws_principals
+      }
+    }
+
+    dynamic "principals" {
+      for_each = length(var.service_principals) > 0 ? [1] : []
+
+      content {
+        type        = "Service"
+        identifiers = var.service_principals
+      }
+    }
+
+    dynamic "principals" {
+      for_each = length(var.federated_principals) > 0 ? [1] : []
+
+      content {
+        type        = "Federated"
+        identifiers = var.federated_principals
+      }
+    }
+  }
+}
+
+resource "aws_iam_role" "role" {
+  name               = var.name
+  assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
+}
+
+resource "aws_iam_role_policy_attachment" "policy" {
+  for_each   = var.iam_policy_arns
+  role       = aws_iam_role.role.id
+  policy_arn = each.value
+}

modules/aws-iam-role/outputs.tf

@@ -0,0 +1,9 @@
+output "arn" {
+  description = "The ARN of the IAM role."
+  value       = aws_iam_role.role.arn
+}
+
+output "id" {
+  description = "The ID of the IAM role."
+  value       = aws_iam_role.role.id
+}

modules/aws-iam-role/vars.tf

@@ -0,0 +1,28 @@
+variable "name" {
+  description = "The name of the IAM role."
+  type        = string
+}
+
+variable "service_principals" {
+  description = "A list service principals permitted to assume this role."
+  type        = set(string)
+  default     = []
+}
+
+variable "aws_principals" {
+  description = "A list of AWS principals (ARNs) permitted to assume this role."
+  type        = set(string)
+  default     = []
+}
+
+variable "federated_principals" {
+  description = "A list of federated principals permitted to assume this role."
+  type        = set(string)
+  default     = []
+}
+
+variable "iam_policy_arns" {
+  description = "The ARNs of IAM policies to attach to this role."
+  type        = set(string)
+  default     = []
+}