more options

chanzuckerberg · Oct 30, 2023 · d78220d · d78220d
1 parent 2e33003
commit d78220d
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 1 deletion.
diff --git a/aws-iam-role-github-action/main.tf b/aws-iam-role-github-action/main.tf
@@ -44,12 +44,19 @@ data "aws_iam_policy_document" "assume_role" {
   }
 }
 
+data "aws_iam_policy_document" "this" {
+  source_policy_documents = compact([
+    data.aws_iam_policy_document.assume_role.json,
+    var.additional_assume_role_policies_json,
+  ])
+}
+
 resource "aws_iam_role" "role" {
   name = var.role.name
 
   tags = var.tags
 
-  assume_role_policy   = data.aws_iam_policy_document.assume_role.json
+  assume_role_policy   = data.aws_iam_policy_document.this.json
   max_session_duration = 60 * 60 // 1 hour, not sure what max github action exec time is
 
   # We have to force detach policies in order to recreate roles.

diff --git a/aws-iam-role-github-action/variables.tf b/aws-iam-role-github-action/variables.tf
@@ -30,4 +30,10 @@ variable "authorized_aws_accounts" {
   type        = map(string)
   description = "The map of authorized AWS accounts to assume the created role."
   default     = {}
+}
+
+variable "additional_assume_role_policies_json" {
+  type        = string
+  description = "The JSON string of any other additional assume role policies to add to the Github Actions role"
+  default     = ""
 }