fix: Use IAM session context data source to resolve the identities role when using assumed_role
#2347
Conversation
…le when using `assumed_role`
| @@ -1,6 +1,14 @@ | |||
| data "aws_partition" "current" {} | |||
| data "aws_caller_identity" "current" {} | |||
|
|
|||
| data "aws_iam_session_context" "current" { | |||
There was a problem hiding this comment.
Should we consider using this resource instead of an existing one in other modules also? WDYT?
There was a problem hiding this comment.
yes, I think anywhere that we are using data.aws_caller_identity.current.arn to get the current identity's ARN, we should use this session context data source to ensure we are getting the true ARN and not the ARN of the STS session
### [19.1.1](v19.1.0...v19.1.1) (2022-12-17) ### Bug Fixes * Use IAM session context data source to resolve the identities role when using `assumed_role` ([#2347](#2347)) ([71b8eca](71b8eca))
|
This PR is included in version 19.1.1 🎉 |
| @@ -122,7 +130,7 @@ module "kms" { | |||
| # Policy | |||
| enable_default_policy = var.kms_key_enable_default_policy | |||
| key_owners = var.kms_key_owners | |||
| key_administrators = coalescelist(var.kms_key_administrators, [data.aws_caller_identity.current.arn]) | |||
| key_administrators = coalescelist(var.kms_key_administrators, [data.aws_iam_session_context.current.issuer_arn]) | |||
There was a problem hiding this comment.
great... this should fix the constant drift we are seeing for a ephemeral session
…le when using `assumed_role` (terraform-aws-modules#2347)
### [19.1.1](terraform-aws-modules/terraform-aws-eks@v19.1.0...v19.1.1) (2022-12-17) ### Bug Fixes * Use IAM session context data source to resolve the identities role when using `assumed_role` ([terraform-aws-modules#2347](terraform-aws-modules#2347)) ([71b8eca](terraform-aws-modules@71b8eca))
|
I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further. |
Description
assumed_roleMotivation and Context
aws_caller_identityreports hashicorp/terraform-provider-aws#28381Breaking Changes
How Has This Been Tested?
examples/*to demonstrate and validate my change(s)examples/*projectspre-commit run -aon my pull request