Add workflow_ref constraints.

adhocteam · Nov 11, 2024 · 816cda4 · 816cda4
1 parent 4aaa0b8
commit 816cda4
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 0 deletions.
diff --git a/main.tf b/main.tf
@@ -48,6 +48,15 @@ data "aws_iam_policy_document" "assume_role_policy" {
         ]
       }
     }
+
+    dynamic "condition" {
+      for_each = var.permitted_workflow_refs == null ? [] : [true]
+      content {
+        test     = "ForAnyValue:StringLike"
+        variable = "token.actions.githubusercontent:workflow_ref"
+        values   = var.permitted_workflow_refs
+      }
+    }
   }
 }
 

diff --git a/variables.tf b/variables.tf
@@ -34,6 +34,12 @@ variable "custom_repository_identifiers" {
   default     = null
 }
 
+variable "permitted_workflow_refs" {
+  description = "List of workflow_ref values allowed to assume the role."
+  type        = list(string)
+  default     = null
+}
+
 variable "preset_permission_level" {
   description = "Preset permission level to attach to the IAM role. Can be either 'FullAdministrator', 'PowerUserWithIAM', 'PowerUser', or 'None'. Defaults to 'None'"
   type        = string