New resource: Amazon Macie account association

[ewbankkit]

Add support for associating a specified AWS account with Amazon Macie as a member account.
Follows on from #4992.
Requires #5201.

[ewbankkit]

Fully automated acceptance tests will be difficult as there are steps that must be taken in the context of the member account to allow Macie to associate.

[bflad]

Looks like the CloudFormation template is really straightforward:

Resources:
  AWSMacieServiceCustomerHandshakeRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: AWSMacieServiceCustomerHandshakeRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - "macie.amazonaws.com"
          Action:
          - sts:AssumeRole
          Condition:
            StringEquals:
              "sts:ExternalId": 
              - Ref : MasterAccount
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonMacieHandshakeRole

So essentially the below (adding the service linked role for good measure):

resource "aws_iam_service_linked_role" "AWSServiceRoleForAmazonMacie" {
  aws_service_name = "macie.amazonaws.com"
}

resource "aws_iam_role" "AWSMacieServiceCustomerHandshakeRole" {
  name = "AWSMacieServiceCustomerHandshakeRole"

  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "macie.amazonaws.com"
      },
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "123456789012"
        }
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
POLICY
}

resource "aws_iam_role_policy_attachment" "AWSMacieServiceCustomerHandshakeRole-AmazonMacieHandshakeRole" {
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonMacieHandshakeRole"
  role       = "${aws_iam_role.AWSMacieServiceCustomerHandshakeRole.name}"
}

[bflad]

The new aws_macie_member_account_association resource has been merged into master and will release with version 1.30.0 of the AWS provider.

[bflad]

This has been released in version 1.30.0 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!