padok-team / terraform-aws-iam Goto Github PK

It is currently not possible to provide complex assume_role_policy such as

{
        "Version": "2012-10-17",
          "Statement": [
              {
                  "Effect": "Allow",
                  "Action": "sts:AssumeRole",
                  "Principal": {
                      "AWS": "464622532012"
                  },
                  "Condition": {
                      "StringEquals": {
                          "sts:ExternalId": datadog_integration_aws.this.external_id
                      }
                  }
              }
          ]
      }

The module should provide an interface for it

Since we often build infrastructure with a Kubernetes cluster, it would be nice to have an example on how to use this module if we want a Kubernetes service account to assume an IAM role.

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

This repository currently has no open or pending branches.

Detected dependencies

• Check this box to trigger a request for Renovate to run again on this repository

For a Padok project, we need to import existing IAM roles and policies.

In the 0.1.0 version of the module (that we wanted to use), we cannot set a description for a policy as it's not provided in any way to the resource.
In the 0.2.0 version of the module, the description of the policy is automatically generated.

In both cases, this is not compatible with importing existing policies as a difference in the policy description forces it's replacement during the plan. We do not want to replace the policies as it has a cascade effect on other resources.

We should be able to provide custom descriptions for both versions of the module.