initial commit

modules/security_identity_compliance/iam-role/main.tf

@@ -0,0 +1,40 @@
+# Assume role policy can be provided as-is, or built using the trusted-entity variable
+locals {
+  assume-role-policy = var.assume-role-policy != null ? var.assume-role-policy : jsonencode(
+    {
+      "Version" : "2012-10-17",
+      "Statement" : [
+        {
+          "Effect" : "Allow",
+          "Principal" : {
+            "Service" : [
+              var.trusted-entity
+            ]
+          },
+          "Action" : "sts:AssumeRole"
+        }
+      ]
+    }
+  )
+}
+
+resource "aws_iam_instance_profile" "this" {
+  count = var.create-instance-profile ? 1 : 0
+  name  = "${var.role-name}-profile"
+  role  = aws_iam_role.this.name
+  path  = var.path
+}
+
+resource "aws_iam_role" "this" {
+  name                  = var.role-name
+  description           = var.description
+  assume_role_policy    = local.assume-role-policy
+  managed_policy_arns   = var.managed-policy-arns
+  force_detach_policies = true
+  path                  = var.path
+  # disable use of inline policy
+  #   inline_policy {
+  #     name   = var.inline-policy-name
+  #     policy = var.inline-policy
+  #   }
+}