feat: support changing assume role Role conditions

README.md

@@ -90,6 +90,8 @@ No modules.
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
+| <a name="input_assume_role_policy_main_conditions"></a> [assume\_role\_policy\_main\_conditions](#input\_assume\_role\_policy\_main\_conditions) | n/a | <pre>list(object({<br>    test     = string<br>    variable = string<br>    values   = list(string)<br>  }))</pre> | `null` | no |
+| <a name="input_assume_role_policy_pr_conditions"></a> [assume\_role\_policy\_pr\_conditions](#input\_assume\_role\_policy\_pr\_conditions) | n/a | <pre>list(object({<br>    test     = string<br>    variable = string<br>    values   = list(string)<br>  }))</pre> | `null` | no |
 | <a name="input_main_branch"></a> [main\_branch](#input\_main\_branch) | n/a | `string` | `"main"` | no |
 | <a name="input_name"></a> [name](#input\_name) | n/a | `string` | n/a | yes |
 | <a name="input_repo"></a> [repo](#input\_repo) | n/a | `string` | n/a | yes |

assume_role_policy.tf

@@ -4,16 +4,13 @@ data "aws_iam_policy_document" "assume_role_policy_pr" {
   statement {
     actions = ["sts:AssumeRoleWithWebIdentity"]
 
-    condition {
-      test     = "StringEquals"
-      variable = "token.actions.githubusercontent.com:aud"
-      values   = ["sts.amazonaws.com"]
-    }
-
-    condition {
-      test     = "StringLike"
-      variable = "token.actions.githubusercontent.com:sub"
-      values   = ["repo:${var.repo}:*"]
+    dynamic "condition" {
+      for_each = var.assume_role_policy_pr_conditions != null ? var.assume_role_policy_pr_conditions : local.default_assume_role_policy_pr_conditions
+      content {
+        test     = condition.value["test"]
+        variable = condition.value["variable"]
+        values   = condition.value["values"]
+      }
     }
 
     principals {
@@ -27,16 +24,13 @@ data "aws_iam_policy_document" "assume_role_policy_main" {
   statement {
     actions = ["sts:AssumeRoleWithWebIdentity"]
 
-    condition {
-      test     = "StringEquals"
-      variable = "token.actions.githubusercontent.com:aud"
-      values   = ["sts.amazonaws.com"]
-    }
-
-    condition {
-      test     = "StringEquals"
-      variable = "token.actions.githubusercontent.com:sub"
-      values   = ["repo:${var.repo}:ref:refs/heads/${var.main_branch}"]
+    dynamic "condition" {
+      for_each = var.assume_role_policy_main_conditions != null ? var.assume_role_policy_main_conditions : local.default_assume_role_policy_main_conditions
+      content {
+        test     = condition.value["test"]
+        variable = condition.value["variable"]
+        values   = condition.value["values"]
+      }
     }
 
     principals {

locals.tf

@@ -0,0 +1,27 @@
+locals {
+  default_assume_role_policy_main_conditions = [
+    {
+      test     = "StringEquals"
+      variable = "token.actions.githubusercontent.com:aud"
+      values   = ["sts.amazonaws.com"]
+    },
+    {
+      test     = "StringEquals"
+      variable = "token.actions.githubusercontent.com:sub"
+      values   = ["repo:${var.repo}:ref:refs/heads/${var.main_branch}"]
+    },
+  ]
+
+  default_assume_role_policy_pr_conditions = [
+    {
+      test     = "StringEquals"
+      variable = "token.actions.githubusercontent.com:aud"
+      values   = ["sts.amazonaws.com"]
+    },
+    {
+      test     = "StringLike"
+      variable = "token.actions.githubusercontent.com:sub"
+      values   = ["repo:${var.repo}:*"]
+    },
+  ]
+}

variables.tf

@@ -19,3 +19,21 @@ variable "s3_bucket_terraform_state_name" {
   type    = string
   default = ""
 }
+
+variable "assume_role_policy_main_conditions" {
+  type = list(object({
+    test     = string
+    variable = string
+    values   = list(string)
+  }))
+  default = null
+}
+
+variable "assume_role_policy_pr_conditions" {
+  type = list(object({
+    test     = string
+    variable = string
+    values   = list(string)
+  }))
+  default = null
+}