feat: Add trusted_role_arns to eks-service-account-iam-role

.github/workflows/main.yml

@@ -9,9 +9,13 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: hashicorp/terraform:1.5.7
+    env:
+      TF_PLUGIN_CACHE_DIR: /github/home/.terraform.d/plugin-cache
     steps:
       - name: Checkout
         uses: actions/checkout@v3
+      - name: Create Plugin Cache Dir
+        run: mkdir -p $TF_PLUGIN_CACHE_DIR
       - name: Check format
         run: terraform fmt -diff=true -check=true
       - name: Validate

eks-service-account-iam-role/main.tf

@@ -52,6 +52,18 @@ data "aws_iam_policy_document" "assume_role" {
       values   = local.all_service_accounts
     }
   }
+
+  dynamic "statement" {
+    for_each = length(var.trusted_role_arns) > 0 ? [1] : []
+    content {
+      effect = "Allow"
+      principals {
+        type        = "AWS"
+        identifiers = var.trusted_role_arns
+      }
+      actions = ["sts:AssumeRole"]
+    }
+  }
 }
 
 resource "aws_iam_role_policy" "main" {

eks-service-account-iam-role/vars.tf

@@ -60,3 +60,9 @@ variable "add_policy" {
 variable "id" {
   default = ""
 }
+
+variable "trusted_role_arns" {
+  type        = list(string)
+  description = "List of AWS IAM Role ARNs that can assume this role"
+  default     = []
+}

validate.sh

@@ -12,5 +12,6 @@ for dir in $dirs; do
     cd $dir
     terraform init
     terraform validate
+    rm -rf .terraform
     cd - > /dev/null
 done