Add permissions_boundary as a variable (#30)

* Add permissions_boundary as a variable Signed-off-by: Manuel Morejon <[email protected]> * Auto Format Co-authored-by: cloudpossebot <[email protected]>
cloudposse · Sep 14, 2021 · a1b4839 · a1b4839
1 parent 3fae1bb
commit a1b4839
Show file tree

Hide file tree

Showing 4 changed files with 9 additions and 0 deletions.
diff --git a/README.md b/README.md
@@ -226,6 +226,7 @@ For automated tests of the complete example using [bats](https://github.com/bats
 | <a name="input_max_session_duration"></a> [max\_session\_duration](#input\_max\_session\_duration) | The maximum session duration (in seconds) for the role. Can have a value from 1 hour to 12 hours | `number` | `3600` | no |
 | <a name="input_name"></a> [name](#input\_name) | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.<br>This is the only ID element not also included as a `tag`.<br>The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. | `string` | `null` | no |
 | <a name="input_namespace"></a> [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no |
+| <a name="input_permissions_boundary"></a> [permissions\_boundary](#input\_permissions\_boundary) | ARN of the policy that is used to set the permissions boundary for the role | `string` | `""` | no |
 | <a name="input_policy_description"></a> [policy\_description](#input\_policy\_description) | The description of the IAM policy that is visible in the IAM policy manager | `string` | n/a | yes |
 | <a name="input_policy_document_count"></a> [policy\_document\_count](#input\_policy\_document\_count) | Number of policy documents (length of policy\_documents list) | `number` | `1` | no |
 | <a name="input_policy_documents"></a> [policy\_documents](#input\_policy\_documents) | List of JSON IAM policy documents | `list(string)` | `[]` | no |

diff --git a/docs/terraform.md b/docs/terraform.md
@@ -52,6 +52,7 @@
 | <a name="input_max_session_duration"></a> [max\_session\_duration](#input\_max\_session\_duration) | The maximum session duration (in seconds) for the role. Can have a value from 1 hour to 12 hours | `number` | `3600` | no |
 | <a name="input_name"></a> [name](#input\_name) | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.<br>This is the only ID element not also included as a `tag`.<br>The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. | `string` | `null` | no |
 | <a name="input_namespace"></a> [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no |
+| <a name="input_permissions_boundary"></a> [permissions\_boundary](#input\_permissions\_boundary) | ARN of the policy that is used to set the permissions boundary for the role | `string` | `""` | no |
 | <a name="input_policy_description"></a> [policy\_description](#input\_policy\_description) | The description of the IAM policy that is visible in the IAM policy manager | `string` | n/a | yes |
 | <a name="input_policy_document_count"></a> [policy\_document\_count](#input\_policy\_document\_count) | Number of policy documents (length of policy\_documents list) | `number` | `1` | no |
 | <a name="input_policy_documents"></a> [policy\_documents](#input\_policy\_documents) | List of JSON IAM policy documents | `list(string)` | `[]` | no |

diff --git a/main.tf b/main.tf
@@ -24,6 +24,7 @@ resource "aws_iam_role" "default" {
   assume_role_policy   = join("", data.aws_iam_policy_document.assume_role_aggregated.*.json)
   description          = var.role_description
   max_session_duration = var.max_session_duration
+  permissions_boundary = var.permissions_boundary
   tags                 = module.this.tags
 }
 

diff --git a/variables.tf b/variables.tf
@@ -28,6 +28,12 @@ variable "max_session_duration" {
   description = "The maximum session duration (in seconds) for the role. Can have a value from 1 hour to 12 hours"
 }
 
+variable "permissions_boundary" {
+  type        = string
+  default     = ""
+  description = "ARN of the policy that is used to set the permissions boundary for the role"
+}
+
 variable "role_description" {
   type        = string
   description = "The description of the IAM role that is visible in the IAM role manager"