From 84657aed522e0cf1b49b77ae5c6d71726aa059ef Mon Sep 17 00:00:00 2001 From: mitch-hamm Date: Wed, 13 Nov 2024 09:58:39 -0800 Subject: [PATCH 1/3] Set org id as a list to allow multiple orgs in the same AWS account --- modules/aws/vendor-access/main.tf | 2 +- modules/aws/vendor-access/variables.tf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/aws/vendor-access/main.tf b/modules/aws/vendor-access/main.tf index 08f620a..26f7641 100644 --- a/modules/aws/vendor-access/main.tf +++ b/modules/aws/vendor-access/main.tf @@ -37,7 +37,7 @@ locals { aws_partition = data.aws_partition.current.partition build_r53_arns = [for i, v in var.hosted_zone_allowed_ids : format("\"arn:%s:route53:::hostedzone/%s\"", local.aws_partition, v)] ebs_kms_key_arn = length(var.ebs_kms_key_arns) > 0 ? var.ebs_kms_key_arns : [data.aws_kms_key.ebs_default.arn] - external_id = (var.external_id != "" ? [{ test : "StringEquals", variable : "sts:ExternalId", values : [var.external_id] }] : []) + external_id = (length(var.external_id) != 0 ? [{ test : "ForAllValues:StringEquals", variable : "sts:ExternalId", values : var.external_id }] : []) kms_key_arns = join(", ", formatlist("\"%s\"", distinct(concat(local.ebs_kms_key_arn, local.s3_kms_key_arn)))) r53_zone_arns = format("[%s]", join(",", local.build_r53_arns)) s3_kms_key_arn = length(var.s3_kms_key_arns) > 0 ? var.s3_kms_key_arns : [data.aws_kms_key.s3_default.arn] diff --git a/modules/aws/vendor-access/variables.tf b/modules/aws/vendor-access/variables.tf index dde02b6..bdee1db 100644 --- a/modules/aws/vendor-access/variables.tf +++ b/modules/aws/vendor-access/variables.tf @@ -53,7 +53,7 @@ variable "eks_cluster_pattern" { variable "external_id" { description = "A external ID that correspond to your Organization within StreamNative Cloud, used for all STS assume role calls to the IAM roles created by the module. This will be the organization ID in the StreamNative console, e.g. \"o-xhopj\"." - type = string + type = list(string) } variable "hosted_zone_allowed_ids" { From c7ba306edf2c952e87098a6b8f4fa05c9c48cb6b Mon Sep 17 00:00:00 2001 From: mitch-hamm Date: Thu, 14 Nov 2024 10:57:38 -0800 Subject: [PATCH 2/3] Update to use new variable --- modules/aws/vendor-access/main.tf | 7 ++++--- modules/aws/vendor-access/variables.tf | 7 +++++++ 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/modules/aws/vendor-access/main.tf b/modules/aws/vendor-access/main.tf index 26f7641..7fa5ce2 100644 --- a/modules/aws/vendor-access/main.tf +++ b/modules/aws/vendor-access/main.tf @@ -32,12 +32,13 @@ locals { allowed_iam_policies = join(", ", formatlist("\"%s\"", distinct(concat(local.additional_iam_policy_arns, local.default_allowed_iam_policies)))) arn_like_vpcs = formatlist("\"arn:%s:ec2:%s:%s:vpc/%s\"", local.aws_partition, var.region, local.account_id, var.vpc_allowed_ids) arn_like_vpcs_str = format("[%s]", join(",", local.arn_like_vpcs)) - assume_conditions = concat(local.external_id, local.source_identity, local.principal_check, local.vendor_federation) - support_assume_conditions = concat(local.external_id, local.source_identity) + assume_conditions = length(var.external_ids) != 0 ? concat(local.external_ids, local.source_identity, local.principal_check, local.vendor_federation) : concat(local.external_id, local.source_identity, local.principal_check, local.vendor_federation) + support_assume_conditions = length(var.external_ids) != 0 ? concat(local.external_ids, local.source_identity) : concat(local.external_id, local.source_identity) aws_partition = data.aws_partition.current.partition build_r53_arns = [for i, v in var.hosted_zone_allowed_ids : format("\"arn:%s:route53:::hostedzone/%s\"", local.aws_partition, v)] ebs_kms_key_arn = length(var.ebs_kms_key_arns) > 0 ? var.ebs_kms_key_arns : [data.aws_kms_key.ebs_default.arn] - external_id = (length(var.external_id) != 0 ? [{ test : "ForAllValues:StringEquals", variable : "sts:ExternalId", values : var.external_id }] : []) + external_id = (var.external_id != "" ? [{ test : "StringEquals", variable : "sts:ExternalId", values : [var.external_id] }] : []) + external_ids = (length(var.external_ids) != 0 ? [{ test : "ForAllValues:StringEquals", variable : "sts:ExternalId", values : var.external_ids }] : []) kms_key_arns = join(", ", formatlist("\"%s\"", distinct(concat(local.ebs_kms_key_arn, local.s3_kms_key_arn)))) r53_zone_arns = format("[%s]", join(",", local.build_r53_arns)) s3_kms_key_arn = length(var.s3_kms_key_arns) > 0 ? var.s3_kms_key_arns : [data.aws_kms_key.s3_default.arn] diff --git a/modules/aws/vendor-access/variables.tf b/modules/aws/vendor-access/variables.tf index bdee1db..7ff886f 100644 --- a/modules/aws/vendor-access/variables.tf +++ b/modules/aws/vendor-access/variables.tf @@ -52,7 +52,14 @@ variable "eks_cluster_pattern" { } variable "external_id" { + default = "" description = "A external ID that correspond to your Organization within StreamNative Cloud, used for all STS assume role calls to the IAM roles created by the module. This will be the organization ID in the StreamNative console, e.g. \"o-xhopj\"." + type = string +} + +variable "external_ids" { + default = [] + description = "A list of external IDs that correspond to your Organization within StreamNative Cloud, used for all STS assume role calls to the IAM roles created by the module. This will be the organization ID in the StreamNative console, e.g. \"o-xhopj\"." type = list(string) } From 53245fdf078a4201122d6dd304ee054155710c6e Mon Sep 17 00:00:00 2001 From: mitch-hamm Date: Wed, 20 Nov 2024 09:47:43 -0800 Subject: [PATCH 3/3] Update readme --- modules/aws/vendor-access/README.md | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/modules/aws/vendor-access/README.md b/modules/aws/vendor-access/README.md index dcb6926..f2655ad 100644 --- a/modules/aws/vendor-access/README.md +++ b/modules/aws/vendor-access/README.md @@ -74,6 +74,21 @@ module "sn_managed_cloud" { } ``` +Or if using multiple orgs + +```hcl + +provider "aws" { + region = +} + +module "sn_managed_cloud" { + source = "github.com/streamnative/terraform-managed-cloud//modules/aws/vendor-access?ref=" + + external_ids = ["", ""] +} +``` + After [authenticating to your AWS account](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#authentication-and-configuration) execute the following sequence of commands from the directory containing the `main.tf` configuration file: 1. Run `terraform init` @@ -136,8 +151,9 @@ No modules. | [ebs\_kms\_key\_arns](#input\_ebs\_kms\_key\_arns) | Sets the list of allowed kms key arns, if not set, uses the default ebs kms key | `list(any)` | `[]` | no | | [eks\_cluster\_pattern](#input\_eks\_cluster\_pattern) | Defines the eks clsuter prefix for streamnative clusters. This should normally remain the default value. | `string` | `"*snc*"` | no | | [enforce\_vendor\_federation](#input\_enforce\_vendor\_federation) | Do not enable this unless explicitly told to do so by StreamNative. Restrict access for the streamnative\_vendor\_access\_role\_arns to only federated Google accounts. Intended to be true by default in the future. | `bool` | `false` | no | -| [external\_id](#input\_external\_id) | A external ID that correspond to your Organization within StreamNative Cloud, used for all STS assume role calls to the IAM roles created by the module. This will be the organization ID in the StreamNative console, e.g. "o-xhopj". | `string` | n/a | yes | -| [hosted\_zone\_allowed\_ids](#input\_hosted\_zone\_allowed\_ids) | Allows for further scoping down policy for allowed hosted zones. The IDs provided are constructed into ARNs | `list(any)` | 
[
  "*"
]
| no | +| [external\_id](#input\_external\_id) | A external ID that correspond to your Organization within StreamNative Cloud, used for all STS assume role calls to the IAM roles created by the module. This will be the organization ID in the StreamNative console, e.g. "o-xhopj". | `string` | `""` | no | +| [external\_ids](#input\_external\_ids) | A list of external IDs that correspond to your Organization within StreamNative Cloud, used for all STS assume role calls to the IAM roles created by the module. This will be the organization ID in the StreamNative console, e.g. "o-xhopj". | `list(string)` | `[]` | no | +| [hosted\_zone\_allowed\_ids](#input\_hosted\_zone\_allowed\_ids) | Allows for further scoping down policy for allowed hosted zones. The IDs provided are constructed into ARNs | `list(any)` | 
[
  "*"
]
| no | | [region](#input\_region) | The AWS region where your instance of StreamNative Cloud is deployed. Defaults to all regions "*" | `string` | `"*"` | no | | [s3\_bucket\_pattern](#input\_s3\_bucket\_pattern) | Defines the bucket prefix for streamnative managed buckets (backup and offload). Typically defaults to "snc-*", but should match the bucket created using the tiered-storage-resources module | `string` | `"*snc*"` | no | | [s3\_kms\_key\_arns](#input\_s3\_kms\_key\_arns) | List of KMS key ARNs to use for S3 buckets | `list(string)` | `[]` | no |