Repository navigation
feat(iam-policy): add generic IAM policy factory component - #18
Merged
Merged
Conversation
Wraps caller-composed IAM policy JSON (the policies map) into named, tagged aws_iam_policy resources and outputs policy_arns keyed by entry. Models no IAM semantics — the environment authors each document and feeds an ARN into a consumer role (e.g. ec2 iam_role_policy_arns). Greenfield- plannable (no data sources); validates map keys (RFC1035) and policy_json (jsondecode). Closes part of #13. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a ManagedPolicies statement granting iam:*Policy lifecycle actions on arn:aws:iam::<account>:policy/<env>-* so the dev pipeline can apply the new iam-policy component. Attaching policies to instance roles is already covered by the existing AttachRolePolicy grant on role/<env>-*. Closes part of #13. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add iam-policy to the CI fmt/validate/tflint matrix, the root README components table, and CHANGELOG [Unreleased] (Added iam-policy; Changed automation-roles). Closes #13. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
📝 Changelog preview (draft)Generated from Conventional Commits. Curate into [Unreleased]Added
Fixed
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add a generic
iam-policycomponent that wraps caller-composed IAM policy JSON into named, taggedaws_iam_policyresources — the environment authors the document, the component owns naming/tagging and exposes the ARN. Also grant theautomation-rolesCI role the IAM-policy lifecycle actions needed to apply it. Resolves #13.Component(s)
iam-policy · automation-roles — plus docs / ci
Type
automation-rolespermissions)Changes
policiesmap → oneaws_iam_policyper entry, named<env>-<key>, body taken verbatim from the entry'spolicy_json,common_tagsapplied; outputspolicy_arnskeyed by the map key (feedsec2iam_role_policy_arns). No data sources — greenfield-plannable. Validates map keys (RFC1035 regex) andpolicy_json(jsondecode), both proven to fail at plan.ManagedPoliciesstatement grantingiam:*Policylifecycle actions scoped toarn:aws:iam::<account>:policy/<env>-*, so the dev pipeline can applyiam-policy. Attaching to instance roles is already covered by the existingAttachRolePolicygrant.[Unreleased](Added + Changed).Validation
terraform fmt/validate/tflintpass on the changed components (the gate)CHANGELOG.md[Unreleased]updatedFollow-ups (out of band, not in this PR)
automation-rolesto the dev account before the dev pipeline first appliesiam-policy(it is human-applied, off-pipeline).infra-environments-dev: add theiam-policyunit (compose thepostiz-ssmpolicy_json) and wiredependency.iam_policy.outputs.policy_arns["postiz-ssm"]into theec2unit'siam_role_policy_arns.🤖 Generated with Claude Code