IAM Fixes (#2)

Fixes IAM permissions related to var.task_role_arn
hyperscience · Aug 27, 2021 · 018f09a · 018f09a
1 parent 0996805
commit 018f09a
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/main.tf b/main.tf
@@ -224,9 +224,9 @@ data "aws_iam_policy_document" "cloudwatch" {
   statement {
     effect  = "Allow"
     actions = ["iam:PassRole"]
-    resources = [
+    resources = concat([
       aws_iam_role.task_execution_role.arn
-    ]
+    ], var.task_role_arn != null ? [var.task_role_arn] : [])
   }
 }
 

diff --git a/variables.tf b/variables.tf
@@ -46,5 +46,5 @@ variable "extra_container_defs" {
 
 variable "task_role_arn" {
   default     = null
-  description = "IAM role ARN for your task if it needs to access any AWS resources"
+  description = "IAM role ARN for your task if it needs to access any AWS resources.  IMPORTANT: This must have an AssumeRolePolicy that includes the 'ecs-tasks.amazonaws.com' provider!!"
 }