Skip to content

Commit

Permalink
Add support for managed policies in permission sets
Browse files Browse the repository at this point in the history
  • Loading branch information
LiamMacP committed Mar 14, 2024
1 parent 53d0e7a commit 7ef4ec9
Show file tree
Hide file tree
Showing 3 changed files with 18 additions and 1 deletion.
4 changes: 3 additions & 1 deletion modules/aws/permission_sets/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ module "permission_sets" {
description = <VALUE>
identity_store_arn = <VALUE>
inline_policies = ARRAY(<INLINE_POLICY>)
managed_policies = ARRAY(<MANAGED_POLICY>)
}
```

Expand All @@ -23,7 +24,8 @@ This module expects the variables to conform to the following:
- `name` - Must be a string between 1 and 64 characters.
- `description` - Must be a string between 1 and 256 characters.
- `identity_store_arn` - Must be a valid Identity Store ARN.
- `inline_policies` - Must be a list of objects that conforms to [Inline Policy](#inline-policy) schema.
- `inline_policies` - Must be a list of objects that conforms to [Inline Policy](#inline-policy) schema. Can be empty.
- `managed_policies` - Must be a list of strings that are valid managed policy ARNs. Can be empty.

### Inline Policy

Expand Down
8 changes: 8 additions & 0 deletions modules/aws/permission_sets/main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -30,3 +30,11 @@ resource "aws_ssoadmin_permission_set_inline_policy" "permission_set_inline_poli
instance_arn = var.identity_store_arn
permission_set_arn = aws_ssoadmin_permission_set.identity_store_permission_set.arn
}

resource "aws_ssoadmin_managed_policy_attachment" "permission_set_managed_policy" {
for_each = toset(var.managed_policies)

managed_policy_arn = each.value
permission_set_arn = aws_ssoadmin_permission_set.identity_store_permission_set.arn
instance_arn = var.identity_store_arn
}
7 changes: 7 additions & 0 deletions modules/aws/permission_sets/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -30,4 +30,11 @@ variable "inline_policies" {
actions = list(string)
resources = list(string)
}))
default = []
}

variable "managed_policies" {
description = "The inline policy to attach to the permission set."
type = list(string)
default = []
}

0 comments on commit 7ef4ec9

Please sign in to comment.