feat: allow adding more trusted principals to task role (users and ro…

README.md

@@ -260,7 +260,8 @@ allow_github_webhooks        = true
 | start\_timeout | Time duration (in seconds) to wait before giving up on resolving dependencies for a container | `number` | `30` | no |
 | stop\_timeout | Time duration (in seconds) to wait before the container is forcefully killed if it doesn't exit normally on its own | `number` | `30` | no |
 | tags | A map of tags to use on all resources | `map(string)` | `{}` | no |
-| trusted\_principals | A list of principals, in addition to ecs-tasks.amazonaws.com, that can assume the task role | `list(string)` | `[]` | no |
+| trusted\_entities | A list of  users or roles, that can assume the task role | `list(string)` | `[]` | no |
+| trusted\_principals | A list of services, in addition to ecs-tasks.amazonaws.com, that can assume the task role | `list(string)` | `[]` | no |
 | ulimits | Container ulimit settings. This is a list of maps, where each map should contain "name", "hardLimit" and "softLimit" | <pre>list(object({<br>    name      = string<br>    hardLimit = number<br>    softLimit = number<br>  }))</pre> | `null` | no |
 | user | The user to run as inside the container. Can be any of these formats: user, user:group, uid, uid:gid, user:gid, uid:group. The default (null) will use the container's configured `USER` directive or root if not set. | `string` | `null` | no |
 | volumes\_from | A list of VolumesFrom maps which contain "sourceContainer" (name of the container that has the volumes to mount) and "readOnly" (whether the container can write to the volume) | <pre>list(object({<br>    sourceContainer = string<br>    readOnly        = bool<br>  }))</pre> | `[]` | no |

examples/github-complete/main.tf

@@ -62,6 +62,7 @@ module "atlantis" {
 
   # Security
   trusted_principals = var.trusted_principals
+  trusted_entities   = [data.aws_caller_identity.caller_arn]
 
   # DNS
   route53_zone_name = var.domain

main.tf

@@ -375,6 +375,11 @@ data "aws_iam_policy_document" "ecs_tasks" {
       type        = "Service"
       identifiers = compact(distinct(concat(["ecs-tasks.amazonaws.com"], var.trusted_principals)))
     }
+
+    principals {
+      type        = "AWS"
+      identifiers = compact(distinct(var.trusted_entities))
+    }
   }
 }
 

variables.tf

@@ -246,7 +246,13 @@ variable "policies_arn" {
 }
 
 variable "trusted_principals" {
-  description = "A list of principals, in addition to ecs-tasks.amazonaws.com, that can assume the task role"
+  description = "A list of services, in addition to ecs-tasks.amazonaws.com, that can assume the task role"
+  type        = list(string)
+  default     = []
+}
+
+variable "trusted_entities" {
+  description = "A list of  users or roles, that can assume the task role"
   type        = list(string)
   default     = []
 }