v0.2.4

v0.2.3...v0.2.4

Fixes

#267 Remove the permission for S3 native state locking from IAM Role for tfmigrate plan

tfmigrate plan doesn't need this permission.

v0.2.3

v0.2.2...v0.2.3

Features

#265 #266 Enable to use S3 native state locking @cappyzawa

As of Terraform v1.10, the s3 backend now supports S3 native state locking.
This release grants permissions for this feature to IAM Roles.

https://github.com/hashicorp/terraform/releases/tag/v1.10.0

backend/s3: The s3 backend now supports S3 native state locking. When used with DynamoDB-based locking, locks will be acquired from both sources. In a future minor release of Terraform the DynamoDB locking mechanism and associated arguments will be deprecated. (hashicorp/terraform#35661)

https://developer.hashicorp.com/terraform/language/state/locking
https://developer.hashicorp.com/terraform/language/backend/s3

v0.2.2

v0.2.1...v0.2.2

Features

#190 Enable to create a aws_iam_openid_connect_provider resource

v0.2.1

Pull Requests | v0.2.0...v0.2.1

#52 Support changing Assume Role conditions

Added input variables

• assume_role_policy_main_conditions
• assume_role_policy_pr_conditions

e.g.

  assume_role_policy_pr_conditions = [
    {
      test     = "StringEquals"
      variable = "token.actions.githubusercontent.com:aud"
      values   = ["sts.amazonaws.com"]
    },
    {
      test     = "StringLike"
      variable = "token.actions.githubusercontent.com:sub"
      values = [
        # pull request to the main branch
        "repo:${local.repo}:event_name:pull_request_target:base_ref:${local.main_branch}:*",
        # workflow_dispatch and schedule on the main branch
        "repo:${local.repo}:event_name:workflow_dispatch:base_ref::ref:refs/heads/${local.main_branch}",
        "repo:${local.repo}:event_name:schedule:base_ref::ref:refs/heads/${local.main_branch}",
      ]
    },
  ]

  assume_role_policy_main_conditions = [
    {
      test     = "StringEquals"
      variable = "token.actions.githubusercontent.com:aud"
      values   = ["sts.amazonaws.com"]
    },
    {
      test     = "StringEquals"
      variable = "token.actions.githubusercontent.com:sub"
      # push to the main branch
      values = ["repo:${local.repo}:event_name:push:base_ref::ref:refs/heads/${local.main_branch}"]
    },
  ]

v0.2.0

Pull Requests | v0.1.4...v0.2.0

#48 Remove permissions for plan files

This change is for tfaction v0.7.0.
As of tfaction v0.7.0, these permissions are unnecessary.

• https://github.com/suzuki-shunsuke/tfaction/releases/tag/v0.7.0
• suzuki-shunsuke/tfaction#1175

⚠️ Breaking Changes

• #48 The variable s3_bucket_terraform_plan_file_name is removed
• #48 Some resources are removed
  • aws_iam_policy.delete_plan_file
  • aws_iam_policy.put_plan_file
  • aws_iam_policy.read_plan_file
  • aws_iam_role_policy_attachment.terraform_apply_put_plan_file
  • aws_iam_role_policy_attachment.terraform_apply_read_plan_file
  • aws_iam_role_policy_attachment.terraform_plan_delete_plan_file
  • aws_iam_role_policy_attachment.terraform_plan_put_plan_file
  • aws_iam_role_policy_attachment.tfmigrate_plan_delete_plan_file

How to upgrade

• Please upgrade tfaction to v0.7.0 or later
• Please remove the variable s3_bucket_terraform_plan_file_name

v0.1.4

Pull Requests | v0.1.3...v0.1.4

Bug Fixes

#24 #25 Fixed output description

Actual output is IAM Role name, but the description is IAM Role ARN.

• aws_iam_role_terraform_plan_name
• aws_iam_role_terraform_apply_name
• aws_iam_role_tfmigrate_plan_name
• aws_iam_role_tfmigrate_apply_name

Contributors

Thanks, Contributors!

@yutachaos #24

v0.1.3

Pull Requests | v0.1.2...v0.1.3

Bug Fixes

#22 Fix typo of IAM Policy name

Resource: aws_iam_policy.delete_plan_file

AS IS

GitHubActions_Terraform_${var.name}_deletete_plan_file

TO BE

GitHubActions_Terraform_${var.name}_delete_plan_file

Contributors

Thanks, Contributors!

@koka831 #22

v0.1.2

Pull Requests | v0.1.1...v0.1.2

#5 fix invalid action s3:HeadObject

v0.1.1

Pull Requests | v0.1.0...v0.1.1

#4 fix: allow IAM Role for terraform plan to delete plan file

For suzuki-shunsuke/tfaction#77

v0.1.0

Merge pull request #3 from suzuki-shunsuke/fix/fix-count-condition

fix: fix count condition