Merge pull request #5 from wellcometrust/add-route53-hosted-zone

Add route 52 cross account hosted zone module

route53_cross_account_hosted_zone/README.md

@@ -0,0 +1,25 @@
+# TCAR53HZRP!
+## Terraform Cross Account Route53 Hosted Zone Role Policy
+
+Terraform module for sharing Route53 hosted zones between accounts.
+
+You might want to use this if you have multiple AWS accounts with one account looking after all hosted zones, but you have developers working in another account who want to update a particular hosted zone.
+
+## Usage
+
+Create a Terraform module like this in your existing infrastructure description.
+
+```tf
+module "my_route53_iam_role" {
+  source         = "git::https://github.com/wellcometrust/terraform.git//terraform/route53_cross_account_hosted_zone?ref=v1.0.4"
+  account_id     = "4w54cc0un71d"
+  hosted_zone_id = "H0573DZ0N31D"
+  role_name      = "my_role_name"
+}
+```
+
+Consumers of the role can use a link like the following to switch roles in their console:
+
+`
+https://signin.aws.amazon.com/switchrole?account=my_account_name&roleName=my_role_name
+`

route53_cross_account_hosted_zone/outputs.tf

@@ -0,0 +1,27 @@
+output "aws_iam_role_arn" {
+  value = "${aws_iam_role.role.arn}"
+}
+
+output "aws_iam_role_uid" {
+  value = "${aws_iam_role.role.unique_id}"
+}
+
+output "aws_iam_role_create_date" {
+  value = "${aws_iam_role.role.create_date}"
+}
+
+output "aws_iam_role_policy_id" {
+  value = "${aws_iam_role_policy.policy.id}"
+}
+
+output "aws_iam_role_policy_name" {
+  value = "${aws_iam_role_policy.policy.name}"
+}
+
+output "aws_iam_role_policy_policy" {
+  value = "${aws_iam_role_policy.policy.policy}"
+}
+
+output "aws_iam_role_policy_role" {
+  value = "${aws_iam_role_policy.policy.role}"
+}

route53_cross_account_hosted_zone/policy.tf

@@ -0,0 +1,40 @@
+resource "aws_iam_role_policy" "policy" {
+  name = "${var.role_name}-route53-policy"
+  role = "${aws_iam_role.role.id}"
+
+  policy = <<EOF
+{
+   "Version": "2012-10-17",
+   "Statement": [
+      {
+         "Effect": "Allow",
+         "Action": [
+            "route53:ListHostedZones"
+         ],
+         "Resource": "*"
+      },
+      {
+         "Effect": "Allow",
+         "Action": [
+            "route53:GetHostedZone"
+         ],
+         "Resource": "arn:aws:route53:::hostedzone/${var.hosted_zone_id}"
+      },
+      {
+         "Effect": "Allow",
+         "Action": [
+            "route53:ListResourceRecordSets"
+         ],
+         "Resource": "arn:aws:route53:::hostedzone/${var.hosted_zone_id}"
+      },
+      {
+         "Effect": "Allow",
+         "Action": [
+            "route53:ChangeResourceRecordSets"
+         ],
+         "Resource": "arn:aws:route53:::hostedzone/${var.hosted_zone_id}"
+      }
+   ]
+}
+EOF
+}

route53_cross_account_hosted_zone/role.tf

@@ -0,0 +1,16 @@
+resource "aws_iam_role" "role" {
+  name = "${var.role_name}"
+
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": {
+    "Effect": "Allow",
+    "Principal": {
+      "AWS": "arn:aws:iam::${var.account_id}:root"
+    },
+    "Action": "sts:AssumeRole"
+  }
+}
+EOF
+}

route53_cross_account_hosted_zone/variables.tf

@@ -0,0 +1,11 @@
+variable "role_name" {
+  description = "Unique name of role to create"
+}
+
+variable "account_id" {
+  description = "ID of account to trust"
+}
+
+variable "hosted_zone_id" {
+  description = "ID of hosted zone to make available"
+}