Skip to content

Instantly share code, notes, and snippets.

@eculver

eculver/owning-account-assume-role.tf

Last active February 4, 2021 21:32
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save eculver/78b533603ba2b2b34f1fd41f8713fea8 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save eculver/78b533603ba2b2b34f1fd41f8713fea8 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. eculver revised this gist Aug 12, 2019. 1 changed file with 23 additions and 0 deletions.
    23 changes: 23 additions & 0 deletions owning-account-assume-role.tf
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,23 @@
    # this defines a role "role-name" in the account where this TF will be applied
    resource "aws_iam_role" "role_name" {
    name = "role-name"
    description = "Allows role-name to do things in account"
    assume_role_policy = "${data.aws_iam_policy_document.my_role.json}"
    }

    # this says that any one in a separate account with ID 123456789012 can assume the "role-name" role
    data "aws_iam_policy_document" "role_name" {
    statement {
    actions = [
    "sts:AssumeRole",
    ]

    principals {
    type = "AWS"

    identifiers = [
    "arn:aws:iam::123456789012:root",
    ]
    }
    }
    }
  2. eculver created this gist Aug 12, 2019.
    26 changes: 26 additions & 0 deletions owning-account-policy.json
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,26 @@
    {
    "Sid": "",
    "Effect": "Allow",
    "Action": "ssm:DescribeParameters",
    "Resource": "arn:aws:ssm:*:*:*"
    },
    {
    "Sid": "",
    "Effect": "Allow",
    "Action": [
    "ssm:GetParametersByPath",
    "ssm:GetParameters"
    ],
    "Resource": "arn:aws:ssm:*:*:parameter/service/*"
    },
    {
    "Sid": "",
    "Effect": "Allow",
    "Action": [
    "kms:ListKeys",
    "kms:ListAliases",
    "kms:Describe*",
    "kms:Decrypt"
    ],
    "Resource": "parameter_store_key"
    }