| 1 | terraform { |
| 2 | required_providers { |
| 3 | aws = { |
| 4 | source = "hashicorp/aws" |
| 5 | } |
| 6 | } |
| 7 | } |
| 8 | |
| 9 | variable "target_account_id" { |
| 10 | description = "AWS account ID where the reserved SSO roles exist (the target account)." |
| 11 | type = string |
| 12 | } |
| 13 | |
| 14 | variable "sso_region" { |
| 15 | description = "Region of the AWS IAM Identity Center instance." |
| 16 | type = string |
| 17 | default = "eu-north-1" |
| 18 | } |
| 19 | |
| 20 | variable "permission_set_name" { |
| 21 | description = "Name of the IAM Identity Center permission set (without the AWSReservedSSO_ prefix)." |
| 22 | type = string |
| 23 | } |
| 24 | |
| 25 | locals { |
| 26 | reserved_role_pattern = format( |
| 27 | "arn:aws:iam::%s:role/aws-reserved/sso.amazonaws.com/%s/AWSReservedSSO_%s_*", |
| 28 | var.target_account_id, |
| 29 | var.sso_region, |
| 30 | var.permission_set_name, |
| 31 | ) |
| 32 | } |
| 33 | |
| 34 | data "aws_iam_policy_document" "this" { |
| 35 | statement { |
| 36 | effect = "Allow" |
| 37 | actions = ["sts:AssumeRole"] |
| 38 | principals { |
| 39 | type = "AWS" |
| 40 | identifiers = [format("arn:aws:iam::%s:root", var.target_account_id)] |
| 41 | } |
| 42 | condition { |
| 43 | test = "ArnLike" |
| 44 | variable = "aws:PrincipalArn" |
| 45 | values = [local.reserved_role_pattern] |
| 46 | } |
| 47 | } |
| 48 | } |
| 49 | |
| 50 | output "json" { |
| 51 | value = data.aws_iam_policy_document.this.json |
| 52 | } |