Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Add role name suffix #64

Closed
wants to merge 2 commits into from
Closed

feat: Add role name suffix #64

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0afc129
add role name suffix
automaticgiant Aug 15, 2024
f9f5425
precommit changes
automaticgiant Aug 15, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -211,6 +211,7 @@ No modules.
| <a name="input_resolver_caching_ttl"></a> [resolver\_caching\_ttl](#input\_resolver\_caching\_ttl) | Default caching TTL for resolvers when caching is enabled | `number` | `60` | no |
| <a name="input_resolver_count_limit"></a> [resolver\_count\_limit](#input\_resolver\_count\_limit) | The maximum number of resolvers that can be invoked in a single request. | `number` | `null` | no |
| <a name="input_resolvers"></a> [resolvers](#input\_resolvers) | Map of resolvers to create | `any` | `{}` | no |
| <a name="input_role_suffix"></a> [role\_suffix](#input\_role\_suffix) | value to append to the role name | `string` | `""` | no |
| <a name="input_schema"></a> [schema](#input\_schema) | The schema definition, in GraphQL schema language format. Terraform cannot perform drift detection of this configuration. | `string` | `""` | no |
| <a name="input_secrets_manager_allowed_actions"></a> [secrets\_manager\_allowed\_actions](#input\_secrets\_manager\_allowed\_actions) | List of allowed IAM actions for secrets manager datasources type RELATIONAL\_DATABASE | `list(string)` | <pre>[<br> "secretsmanager:GetSecretValue"<br>]</pre> | no |
| <a name="input_tags"></a> [tags](#input\_tags) | Map of tags to add to all GraphQL resources created by this module | `map(string)` | `{}` | no |
Expand Down
4 changes: 2 additions & 2 deletions iam.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,7 +108,7 @@ data "aws_iam_policy_document" "assume_role" {
resource "aws_iam_role" "logs" {
count = var.logging_enabled && var.create_logs_role ? 1 : 0

name = coalesce(var.logs_role_name, "${var.name}-logs")
name = "${coalesce(var.logs_role_name, "${var.name}-logs")}${var.role_suffix}"
automaticgiant marked this conversation as resolved.
Show resolved Hide resolved
assume_role_policy = data.aws_iam_policy_document.assume_role.json
permissions_boundary = var.iam_permissions_boundary

Expand All @@ -126,7 +126,7 @@ resource "aws_iam_role_policy_attachment" "logs" {
resource "aws_iam_role" "service_role" {
for_each = local.service_roles_with_specific_policies

name = lookup(each.value, "service_role_name", "${each.key}-role")
name = "${lookup(each.value, "service_role_name", "${each.key}-role")}${var.role_suffix}"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You need to specify service_role_name argument in services to achieve what you want.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not sure what you mean by services

undocumented field of maps passed into datasources variable?

https://github.com/search?q=repo%3Aterraform-aws-modules%2Fterraform-aws-appsync%20service_role_name&type=code

i think that's what you're implying
will try to validate next week
might update pull request to be documentation-focused if it validates

speaking of variables/inputs with nested maps, are you aware of any prior art for documenting schemas for these complex inputs?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My bad, it was not services, but datasources:

datasources = {
    lambda1 = {
      # omitted...
      service_role_name = "whatever-you-want-as-a-role-name"
    }
}

Regarding documenting nested map types, I am not sure I understand what you mean or whether it is related to this module.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

validated service_role_name. thanks.

Regarding documenting nested map types, I am not sure I understand what you mean or whether it is related to this module.

not this module specifically...

the terraform authors gave us a way to document variables and specify types for them, but i've seen no guidance on any pattern to document the contents of a map, especially with nested fields.

oh wow - i've been sleeping on the tf docs - this exists! https://developer.hashicorp.com/terraform/language/v1.5.x/expressions/type-constraints#optional-object-type-attributes

well, i guess one of us might should make a pr updating the variables types

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

take a look at #65 and let me know if i'm on the right track. ty.

permissions_boundary = var.iam_permissions_boundary
assume_role_policy = data.aws_iam_policy_document.assume_role.json
}
Expand Down
6 changes: 6 additions & 0 deletions variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -338,3 +338,9 @@ variable "resolver_count_limit" {
type = number
default = null
}

variable "role_suffix" {
description = "value to append to the role name"
type = string
default = ""
}
6 changes: 3 additions & 3 deletions wrappers/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,9 @@ This wrapper does not implement any extra functionality.

```hcl
terraform {
source = "tfr:///terraform-aws-modules/appsync/aws//wrappers"
source = "tfr:///terraform-aws-modules/lint/aws//wrappers"
# Alternative source:
# source = "git::git@github.com:terraform-aws-modules/terraform-aws-appsync.git//wrappers?ref=master"
# source = "git::git@github.com:terraform-aws-modules/terraform-aws-lint.git//wrappers?ref=master"
}

inputs = {
Expand Down Expand Up @@ -42,7 +42,7 @@ inputs = {

```hcl
module "wrapper" {
source = "terraform-aws-modules/appsync/aws//wrappers"
source = "terraform-aws-modules/lint/aws//wrappers"

defaults = { # Default values
create = true
Expand Down
1 change: 1 addition & 0 deletions wrappers/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,7 @@ module "wrapper" {
resolver_caching_ttl = try(each.value.resolver_caching_ttl, var.defaults.resolver_caching_ttl, 60)
resolver_count_limit = try(each.value.resolver_count_limit, var.defaults.resolver_count_limit, null)
resolvers = try(each.value.resolvers, var.defaults.resolvers, {})
role_suffix = try(each.value.role_suffix, var.defaults.role_suffix, "")
schema = try(each.value.schema, var.defaults.schema, "")
secrets_manager_allowed_actions = try(each.value.secrets_manager_allowed_actions, var.defaults.secrets_manager_allowed_actions, ["secretsmanager:GetSecretValue"])
tags = try(each.value.tags, var.defaults.tags, {})
Expand Down
Loading