1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

# IAM role ===================================================================

resource "aws_iam_role" "this" {
  name                  = var.name
  description           = var.description
  path                  = var.path
  assume_role_policy    = var.assume_role_policy
  max_session_duration  = var.max_session_duration
  force_detach_policies = var.force_detach_policies
  permissions_boundary  = var.permissions_boundary

  tags = local.tags
}

# Managed policy attachments -------------------------------------------------

resource "aws_iam_role_policy_attachment" "this" {
  for_each = toset(var.managed_policy_arns)

  role       = aws_iam_role.this.name
  policy_arn = each.value
}

# Inline policies ------------------------------------------------------------

resource "aws_iam_role_policy" "this" {
  for_each = var.inline_policies

  name   = each.key
  role   = aws_iam_role.this.id
  policy = each.value
}

# Instance profile -----------------------------------------------------------

resource "aws_iam_instance_profile" "this" {
  for_each = var.instance_profile ? { profile = true } : {}

  name = local.instance_profile_name
  role = aws_iam_role.this.name

  tags = local.tags
}