feat: Allow overriding the whole assume policy

[pablotp]

what

Adds the assume_role_policy_document variable, allowing users to provide a complete JSON assume role policy for the IAM role. When set, this overrides the principals, assume_role_conditions, and assume_role_actions variables.

why

This enables advanced use cases where a custom trust policy is needed, offering more flexibility than the module’s built-in policy generation. If not set, the module’s default behavior remains unchanged.

Example of an assume policy that couldn't be generated before

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::111122223333:role/app-prod-ci-agent",
          "AROAEXAMPLEID1",
          "arn:aws:iam::444455556666:role/ci-agent",
          "arn:aws:iam::111122223333:role/app-prod-use1-mz-4-ci-agent"
        ]
      },
      "Action": "sts:AssumeRole"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::444455556666:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/EXAMPLEOIDC"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "oidc.eks.us-east-1.amazonaws.com/id/EXAMPLEOIDC:sub": "system:serviceaccount:ci:ci-agent"
        }
      }
    }
  ]
}

With the previous implementation, you could not generate the second statement with a different action (sts:AssumeRoleWithWebIdentity) and a different condition for the Federated principal.

references

• Alternative to feat: Split the actions and conditions of the assume role by principal #85
• When this feature is released, the Atmos component will be updated: feat: Allow overriding the whole assume policy cloudposse-terraform-components/aws-iam-role#29

[nitrocode]

/terratest

[nitrocode]

Tests are failing. Try running the tests locally.

[pablotp]

Tests are failing. Try running the tests locally.

The errors seem related to go setup. Locally, I pass this stage.

Any help figuring out what is broken is very welcome 🙏🏻

[nitrocode]

cc @goruha tests are failing in the setup. What would you recommend?

Here is the previous commit 4746f86 with the failed tests.

[Benbentwo]

LGTM, couple small changes

[pablotp]

@Benbentwo, thank you for the prompt review! I've just addressed your comments. Please let me know if I missed anything.

[nitrocode]

/terratest

[Benbentwo]

/terratest

[Benbentwo]

/terratest

[github-actions]

These changes were released in v0.22.0.