How can I modify a created IAM Role's assume-role policy?

user_11271048 0
Viewed 901

My objective is to be able to set up an IAM Role which can assume a role of a certain IAM user. After the creation of the role, I would like to come back later and modify this role by adding external IDs to establish a trust relationship. Let me illustrate with an example:

Let's say I want to create role:

resource "aws_iam_role" "happy_role" {
  name               = "happy-role"
  assume_role_policy = data.aws_iam_policy_document.happy_assume_rule_policy.json
}

Let's also assume that happy_assume_role_policy looks something like:

data "aws_iam_policy_document" "happy_assume_role_policy" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    principals {
      type        = "AWS"
      identifiers = [var.some_iam_user_arn]
    }
  }
}

Now, I will use the created role to create an external integration. But once I am done creating that integration, I want to go back to the role I originally created and modify it's assumed role policy. So now I want to add a condition to the assume role policy and make it look like:

data "aws_iam_policy_document" "happy_assume_role_policy" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    principals {
      type        = "AWS"
      identifiers = [var.snowflake_iam_user_arn]
    }
    condition {
      test     = "StringEquals"
      values   = [some_integration.integration.external_id]
      variable = "sts:ExternalId"
    }
  }
}

In other words, my workflow should be like:

  1. Create role without assume conditions
  2. Create an integration with that role
  3. Take the ID from the created integration and go back to the created role and add a condition on it

Edit: By "integration" I mean something like this. Once an Integration is created, there is an outputted ID, and then I need to take that ID and feed it back to the Assume Role I originally created. That should happen everytime I add a new integration.

terraform amazon-web-services
2 Answers

I first tried to create two IAM roles, one for managing the integration creation, and another for managing the integration itself. That ran without circular reference errors; however, I was not able to establish a connection from the storage to the database, as it needs to be the same IAM Role creating and managing the integration.

This is what I have ended up doing (still not good for an accepted way to do it IMO). I created a role (with targeting) like:

resource "aws_iam_role" "happy_role" {
  name               = "happy-role"
  assume_role_policy = data.aws_iam_policy_document.basic_policy.json
}

And used a basic assume role policy (without conditions). And then for the next run, I applied (without targeting) and it worked.

user_112710480

I followed the approach mentioned here, How to create a Snowflake Storage Integration with AWS S3 with Terraform?

As part of Storage Integration creation, just provide the role arn which is manually constructed without the resource is created. Terraform wont complain. Then create the role with the assume policy referring to the External Id and User ARN created by the Storage Integration

user_11947880
Related