Skip to content

feat: Add permissions boundary for IAM role #104

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
antonbabenko merged 6 commits into from
Jun 10, 2020
Merged

feat: Add permissions boundary for IAM role #104

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
b8cee31
Add parameter permissions_boundary into aws_iam_role.rds_enhanced_mon…
Feb 10, 2020
1aa46e9
Update documentation
Feb 10, 2020
d3f4bbb
Merge branch 'master' into add_permissions_boundary_aws_iam_role
edersonbrilhante Mar 19, 2020
f8ce693
Merge branch 'master' into add_permissions_boundary_aws_iam_role
edersonbrilhante Apr 24, 2020
448acaf
docs: update inputs
May 13, 2020
5279ccb
Updated docs
antonbabenko Jun 10, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .pre-commit-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
repos:
- repo: git://github.com/antonbabenko/pre-commit-terraform
rev: v1.27.0
rev: v1.31.0
hooks:
- id: terraform_fmt
- id: terraform_docs
- repo: git://github.com/pre-commit/pre-commit-hooks
rev: v2.5.0
rev: v3.1.0
hooks:
- id: check-merge-conflict
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,6 +117,7 @@ Terraform documentation is generated automatically using [pre-commit hooks](http
| password | Master DB password | `string` | `""` | no |
| performance\_insights\_enabled | Specifies whether Performance Insights is enabled or not. | `bool` | `false` | no |
| performance\_insights\_kms\_key\_id | The ARN for the KMS key to encrypt Performance Insights data. | `string` | `""` | no |
| permissions\_boundary | The ARN of the policy that is used to set the permissions boundary for the role. | `string` | `null` | no |
| port | The port on which to accept connections | `string` | `""` | no |
| predefined\_metric\_type | The metric type to scale on. Valid values are RDSReaderAverageCPUUtilization and RDSReaderAverageDatabaseConnections. | `string` | `"RDSReaderAverageCPUUtilization"` | no |
| preferred\_backup\_window | When to perform DB backups | `string` | `"02:00-03:00"` | no |
Expand Down
2 changes: 2 additions & 0 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,6 +127,8 @@ resource "aws_iam_role" "rds_enhanced_monitoring" {

name = "rds-enhanced-monitoring-${var.name}"
assume_role_policy = data.aws_iam_policy_document.monitoring_rds_assume_role.json

permissions_boundary = var.permissions_boundary
}

resource "aws_iam_role_policy_attachment" "rds_enhanced_monitoring" {
Expand Down
6 changes: 6 additions & 0 deletions variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -315,6 +315,12 @@ variable "security_group_description" {
default = "Managed by Terraform"
}

variable "permissions_boundary" {
description = "The ARN of the policy that is used to set the permissions boundary for the role."
type = string
default = null

@antonbabenko antonbabenko Jun 10, 2020

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe the default value should be null for people who don't want to enforce any permissions_boundary. I have updated it.

}

variable "ca_cert_identifier" {
description = "The identifier of the CA certificate for the DB instance"
type = string
Expand Down