Merge pull request #62 from cisagov/improvement/optional-ssm-parameters

Make SSM parameters optional

Author: dav3r

README.md

@@ -82,14 +82,14 @@ module "example" {
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | entity | The name of the entity (usually a GitHub repository) being tested (e.g. molecule-iam-user-tf-module). | `string` | n/a | yes |
-| ssm\_parameters | The AWS SSM parameters that the IAM user needs to be able to read (e.g. ["/example/parameter1", "/example/config/*"]). | `list(string)` | n/a | yes |
+| ssm\_parameters | The AWS SSM parameters that the IAM user needs to be able to read (e.g. ["/example/parameter1", "/example/config/*"]). | `list(string)` | `[]` | no |
 
 ## Outputs ##
 
 | Name | Description |
 |------|-------------|
 | access\_key | The IAM access key associated with the CI IAM user created by this module. |
-| role | The IAM role that the CI user can assume to read SSM parameters. |
+| role | The IAM role that the CI user can assume to perform testing. |
 | user | The CI IAM user created by this module. |
 <!-- END_TF_DOCS -->
 

assume_parameterstorereadonly_role.tf

@@ -1,22 +1,26 @@
 # IAM policy document that allows assumption of the ParameterStoreReadOnly
 # role in the Images account for this user
 data "aws_iam_policy_document" "assume_parameterstorereadonly_role_doc" {
+  count = local.ssm_needed
+
   statement {
     actions = [
       "sts:AssumeRole",
       "sts:TagSession",
     ]
     effect = "Allow"
     resources = [
-      module.parameterstorereadonly_role.role.arn
+      module.parameterstorereadonly_role[0].role.arn
     ]
   }
 }
 
 # The IAM policy allowing this user to assume their custom
 # ParameterStoreReadOnly role in the Images account
 resource "aws_iam_user_policy" "assume_parameterstorereadonly" {
-  name   = "Images-Assume${module.parameterstorereadonly_role.role.name}"
-  policy = data.aws_iam_policy_document.assume_parameterstorereadonly_role_doc.json
+  count = local.ssm_needed
+
+  name   = "Images-Assume${module.parameterstorereadonly_role[0].role.name}"
+  policy = data.aws_iam_policy_document.assume_parameterstorereadonly_role_doc[0].json
   user   = module.ci_user.user.name
 }

locals.tf

@@ -1,5 +1,9 @@
 locals {
-  user_name        = format("test-%s", var.entity)
-  role_name        = format("Test-%s", var.entity)
   role_description = format("A role that can be assumed to allow for CI testing of %s via Molecule.", var.entity)
+  role_name        = format("Test-%s", var.entity)
+
+  # Determine if the CI user needs to be able to read SSM parameters
+  ssm_needed = length(var.ssm_parameters) > 0 ? 1 : 0
+
+  user_name = format("test-%s", var.entity)
 }

outputs.tf

@@ -5,7 +5,7 @@ output "access_key" {
 }
 
 output "role" {
-  description = "The IAM role that the CI user can assume to read SSM parameters."
+  description = "The IAM role that the CI user can assume to perform testing."
   value       = module.ci_user.role
 }
 

parameterstorereadonly_role.tf

@@ -9,6 +9,7 @@ data "aws_caller_identity" "users" {
 }
 
 module "parameterstorereadonly_role" {
+  count  = local.ssm_needed
   source = "github.com/cisagov/ssm-read-role-tf-module"
 
   providers = {

user.tf

@@ -13,8 +13,9 @@ module "ci_user" {
 
 # Attach the AWS SSM Parameter Store read role policy to the CI role
 resource "aws_iam_role_policy_attachment" "ssm" {
+  count    = local.ssm_needed
   provider = aws.images-provisionaccount
 
-  policy_arn = module.parameterstorereadonly_role.policy.arn
+  policy_arn = module.parameterstorereadonly_role[0].policy.arn
   role       = module.ci_user.role.name
 }

variables.tf

@@ -10,14 +10,15 @@ variable "entity" {
   type        = string
 }
 
-variable "ssm_parameters" {
-  description = "The AWS SSM parameters that the IAM user needs to be able to read (e.g. [\"/example/parameter1\", \"/example/config/*\"])."
-  nullable    = false
-  type        = list(string)
-}
-
 # ------------------------------------------------------------------------------
 # OPTIONAL PARAMETERS
 #
 # These parameters have reasonable defaults.
 # ------------------------------------------------------------------------------
+
+variable "ssm_parameters" {
+  default     = []
+  description = "The AWS SSM parameters that the IAM user needs to be able to read (e.g. [\"/example/parameter1\", \"/example/config/*\"])."
+  nullable    = false
+  type        = list(string)
+}