feat: add option to attach a permissions boundary

It is now possible to attach a permissions boundary to the cloudbench role.
sysdiglabs · Aug 14, 2024 · 92a76c2 · 92a76c2
1 parent 220725f
commit 92a76c2
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 3 deletions.
diff --git a/modules/services/cloud-bench/main.tf b/modules/services/cloud-bench/main.tf
@@ -69,9 +69,10 @@ data "aws_iam_policy_document" "trust_relationship" {
 resource "aws_iam_role" "cloudbench_role" {
   count = var.is_organizational && !var.provision_caller_account ? 0 : 1
 
-  name               = var.name
-  assume_role_policy = data.aws_iam_policy_document.trust_relationship.json
-  tags               = var.tags
+  name                 = var.name
+  assume_role_policy   = data.aws_iam_policy_document.trust_relationship.json
+  tags                 = var.tags
+  permissions_boundary = var.permissions_boundary_arn
 }
 
 

diff --git a/modules/services/cloud-bench/variables.tf b/modules/services/cloud-bench/variables.tf
@@ -34,3 +34,9 @@ variable "tags" {
     "product" = "sysdig-secure-for-cloud"
   }
 }
+
+variable "permissions_boundary_arn" {
+  type        = string
+  description = "ARN of a permissions boundary policy to attach to the cloudbench role"
+  default     = null
+}