KIL-2960 Add sts:AssumeRole policy to Agent execution Role

monte-carlo-data · Jan 5, 2024 · ba7d147 · ba7d147
1 parent 70c571c
commit ba7d147
Showing 1 changed file with 25 additions and 1 deletion.
diff --git a/main.tf b/main.tf
@@ -346,6 +346,30 @@ resource "aws_iam_role_policy" "mcd_agent_service_lambda_info_policy" {
   role = aws_iam_role.mcd_agent_service_execution_role.id
 }
 
+resource "aws_iam_role_policy" "mcd_agent_service_assume_role_policy" {
+  name = "assume_role_policy"
+  policy = jsonencode({
+    "Version" : "2012-10-17",
+    "Statement" : [
+      {
+        "Action" : [
+          "sts:AssumeRole"
+        ],
+        "Condition": {
+          "StringEquals": {
+            "iam:ResourceTag/MonteCarloData": ""
+          }
+        },
+        "Resource" : [
+          "*"
+        ],
+        "Effect" : "Allow"
+      }
+    ]
+  })
+  role = aws_iam_role.mcd_agent_service_execution_role.id
+}
+
 resource "aws_iam_role_policy" "mcd_agent_service_repo_policy" {
   count = var.remote_upgradable ? 1 : 0
   name  = "repo_access_policy"
@@ -430,4 +454,4 @@ resource "aws_iam_role" "mcd_agent_service_invocation_role" {
   tags = {
     MonteCarloData = ""
   }
-}
+}