# iam-role

Creates an IAM role with managed policies, inline policies, and an optional EC2 instance profile.

Provisions a single IAM role with a caller-supplied trust policy, attaches any number of AWS-managed or customer-managed policies, defines named inline policies, and optionally creates an EC2 instance profile backed by the role. Supports permissions boundaries for privilege management.

## Usage

```hcl
module "lambda_exec_role" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/identity/iam-role/aws"
  version = "0.1.0"

  name               = "my-lambda-exec"
  assume_role_policy = data.aws_iam_policy_document.lambda_assume.json
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
  ]
}
```

<!-- BEGIN_TF_DOCS — DO NOT EDIT BELOW THIS LINE -->
## Requirements

| Name | Version |
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement_terraform) | ~> 1.5 |
| <a name="requirement_aws"></a> [aws](#requirement_aws) | ~> 6.50 |

## Providers

| Name | Version |
| ---- | ------- |
| <a name="provider_aws"></a> [aws](#provider_aws) | 6.50.0 |

## Resources

| Name | Type |
| ---- | ---- |
| [aws_iam_instance_profile.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_instance_profile) | resource |
| [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
| [aws_iam_role_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
| [aws_iam_role_policy_attachment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |

## Inputs

| Name | Description | Type | Default | Required |
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_assume_role_policy"></a> [assume_role_policy](#input_assume_role_policy) | JSON trust policy document for the role | `string` | n/a | yes |
| <a name="input_name"></a> [name](#input_name) | IAM role name | `string` | n/a | yes |
| <a name="input_description"></a> [description](#input_description) | IAM role description | `string` | `""` | no |
| <a name="input_force_detach_policies"></a> [force_detach_policies](#input_force_detach_policies) | Force-detach policies when destroying the role | `bool` | `false` | no |
| <a name="input_inline_policies"></a> [inline_policies](#input_inline_policies) | Map of inline policy name to JSON policy document | `map(string)` | `{}` | no |
| <a name="input_instance_profile"></a> [instance_profile](#input_instance_profile) | Create an EC2 instance profile for this role | `bool` | `false` | no |
| <a name="input_instance_profile_name"></a> [instance_profile_name](#input_instance_profile_name) | Name for the instance profile (defaults to role name) | `string` | `null` | no |
| <a name="input_managed_policy_arns"></a> [managed_policy_arns](#input_managed_policy_arns) | List of managed policy ARNs to attach | `list(string)` | `[]` | no |
| <a name="input_max_session_duration"></a> [max_session_duration](#input_max_session_duration) | Maximum session duration in seconds (3600–43200) | `number` | `3600` | no |
| <a name="input_path"></a> [path](#input_path) | IAM role path | `string` | `"/"` | no |
| <a name="input_permissions_boundary"></a> [permissions_boundary](#input_permissions_boundary) | ARN of the permissions boundary policy (optional) | `string` | `null` | no |
| <a name="input_tags"></a> [tags](#input_tags) | Resource tags to apply to all resources | `map(string)` | `{}` | no |

## Outputs

| Name | Description |
| ---- | ----------- |
| <a name="output_arn"></a> [arn](#output_arn) | IAM role ARN |
| <a name="output_id"></a> [id](#output_id) | IAM role name (ID) |
| <a name="output_instance_profile_arn"></a> [instance_profile_arn](#output_instance_profile_arn) | ARN of the EC2 instance profile (null if not created) |
| <a name="output_instance_profile_name"></a> [instance_profile_name](#output_instance_profile_name) | Name of the EC2 instance profile (null if not created) |
| <a name="output_name"></a> [name](#output_name) | IAM role name |
| <a name="output_unique_id"></a> [unique_id](#output_unique_id) | IAM role stable unique ID |
<!-- END_TF_DOCS — DO NOT EDIT ABOVE THIS LINE -->