Merge branch 'main' into LZA-163/cur-s3-modules

.github/workflows/pull-request-sast.yaml

@@ -11,15 +11,15 @@ permissions:
 
 jobs:
   RunTerraformValidation:
-    name: Run Terraform Validation
+    name: Run Terraform SAST
     runs-on: ubuntu-latest
 
     steps:
       - name: Clone the Repository
         uses: actions/checkout@v4
 
       # Results have to be a table as the organisation does not have Advanced Security license.
-      - name: Run Trivy against Terraform
+      - name: Terraform Trivy Scan
         uses: aquasecurity/[email protected]
         with:
           scan-type: 'config'

modules/aws/permission_sets/README.md

@@ -13,7 +13,8 @@ module "permission_sets" {
   name                = <VALUE>
   description         = <VALUE>
   identity_store_arn  = <VALUE>
-  inline_policies     = ARRAY(<INLINE_POLICY>)
+  inline_policies     = OPTIONAL(ARRAY(<INLINE_POLICY>))
+  managed_policies    = OPTIONAL(ARRAY(<MANAGED_POLICY_NAME>))
 }
 ```
 
@@ -23,7 +24,8 @@ This module expects the variables to conform to the following:
 - `name` - Must be a string between 1 and 64 characters.
 - `description` - Must be a string between 1 and 256 characters.
 - `identity_store_arn` - Must be a valid Identity Store ARN.
-- `inline_policies` - Must be a list of objects that conforms to [Inline Policy](#inline-policy) schema.
+- `inline_policies` - Must be a list of objects that conforms to [Inline Policy](#inline-policy) schema. Can be empty.
+- `managed_policies` - Must be a list of strings that are valid managed policy names. Can be empty.
 
 ### Inline Policy
 

modules/aws/permission_sets/main.tf

@@ -26,7 +26,17 @@ data "aws_iam_policy_document" "iam_policy_document" {
 }
 
 resource "aws_ssoadmin_permission_set_inline_policy" "permission_set_inline_policy" {
+  count              = length(var.inline_policies)
+
   inline_policy      = data.aws_iam_policy_document.iam_policy_document.json
   instance_arn       = var.identity_store_arn
   permission_set_arn = aws_ssoadmin_permission_set.identity_store_permission_set.arn
 }
+
+resource "aws_ssoadmin_managed_policy_attachment" "permission_set_managed_policy" {
+  for_each = toset(var.managed_policies)
+
+  managed_policy_arn = "arn:aws:iam::aws:policy/${each.value}"
+  permission_set_arn = aws_ssoadmin_permission_set.identity_store_permission_set.arn
+  instance_arn       = var.identity_store_arn
+}

modules/aws/permission_sets/variables.tf

@@ -30,4 +30,11 @@ variable "inline_policies" {
     actions        = list(string)
     resources = list(string)
   }))
+  default = []
+}
+
+variable "managed_policies" {
+  description = "The inline policy to attach to the permission set."
+  type        = list(string)
+  default = []
 }