From a1b48391f2b84ec297c8c40cee26ca233d12e09f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Manuel=20Morej=C3=B3n?= <manuel@mmorejon.io>
Date: Tue, 14 Sep 2021 15:55:57 +0200
Subject: [PATCH] Add permissions_boundary as a variable (#30)

* Add permissions_boundary as a variable

Signed-off-by: Manuel Morejon <manuel@mmorejon.io>

* Auto Format

Co-authored-by: cloudpossebot <11232728+cloudpossebot@users.noreply.github.com>
---
 README.md         | 1 +
 docs/terraform.md | 1 +
 main.tf           | 1 +
 variables.tf      | 6 ++++++
 4 files changed, 9 insertions(+)

diff --git a/README.md b/README.md
index dfa9447..2a42785 100644
--- a/README.md
+++ b/README.md
@@ -226,6 +226,7 @@ For automated tests of the complete example using [bats](https://github.com/bats
 | <a name="input_max_session_duration"></a> [max\_session\_duration](#input\_max\_session\_duration) | The maximum session duration (in seconds) for the role. Can have a value from 1 hour to 12 hours | `number` | `3600` | no |
 | <a name="input_name"></a> [name](#input\_name) | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.<br>This is the only ID element not also included as a `tag`.<br>The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. | `string` | `null` | no |
 | <a name="input_namespace"></a> [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no |
+| <a name="input_permissions_boundary"></a> [permissions\_boundary](#input\_permissions\_boundary) | ARN of the policy that is used to set the permissions boundary for the role | `string` | `""` | no |
 | <a name="input_policy_description"></a> [policy\_description](#input\_policy\_description) | The description of the IAM policy that is visible in the IAM policy manager | `string` | n/a | yes |
 | <a name="input_policy_document_count"></a> [policy\_document\_count](#input\_policy\_document\_count) | Number of policy documents (length of policy\_documents list) | `number` | `1` | no |
 | <a name="input_policy_documents"></a> [policy\_documents](#input\_policy\_documents) | List of JSON IAM policy documents | `list(string)` | `[]` | no |
diff --git a/docs/terraform.md b/docs/terraform.md
index b9353af..14c74f8 100644
--- a/docs/terraform.md
+++ b/docs/terraform.md
@@ -52,6 +52,7 @@
 | <a name="input_max_session_duration"></a> [max\_session\_duration](#input\_max\_session\_duration) | The maximum session duration (in seconds) for the role. Can have a value from 1 hour to 12 hours | `number` | `3600` | no |
 | <a name="input_name"></a> [name](#input\_name) | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.<br>This is the only ID element not also included as a `tag`.<br>The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. | `string` | `null` | no |
 | <a name="input_namespace"></a> [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no |
+| <a name="input_permissions_boundary"></a> [permissions\_boundary](#input\_permissions\_boundary) | ARN of the policy that is used to set the permissions boundary for the role | `string` | `""` | no |
 | <a name="input_policy_description"></a> [policy\_description](#input\_policy\_description) | The description of the IAM policy that is visible in the IAM policy manager | `string` | n/a | yes |
 | <a name="input_policy_document_count"></a> [policy\_document\_count](#input\_policy\_document\_count) | Number of policy documents (length of policy\_documents list) | `number` | `1` | no |
 | <a name="input_policy_documents"></a> [policy\_documents](#input\_policy\_documents) | List of JSON IAM policy documents | `list(string)` | `[]` | no |
diff --git a/main.tf b/main.tf
index ac9d91c..79e46b7 100644
--- a/main.tf
+++ b/main.tf
@@ -24,6 +24,7 @@ resource "aws_iam_role" "default" {
   assume_role_policy   = join("", data.aws_iam_policy_document.assume_role_aggregated.*.json)
   description          = var.role_description
   max_session_duration = var.max_session_duration
+  permissions_boundary = var.permissions_boundary
   tags                 = module.this.tags
 }
 
diff --git a/variables.tf b/variables.tf
index 388128d..5d35617 100644
--- a/variables.tf
+++ b/variables.tf
@@ -28,6 +28,12 @@ variable "max_session_duration" {
   description = "The maximum session duration (in seconds) for the role. Can have a value from 1 hour to 12 hours"
 }
 
+variable "permissions_boundary" {
+  type        = string
+  default     = ""
+  description = "ARN of the policy that is used to set the permissions boundary for the role"
+}
+
 variable "role_description" {
   type        = string
   description = "The description of the IAM role that is visible in the IAM role manager"