Additional trust relashionships

See: claranet#59

Author: asavoy

README.md

@@ -67,6 +67,7 @@ Inputs for this module are the same as the [aws_lambda_function](https://www.ter
 | build\_script | The path to the script which will compile a zip of the lambda function | string | `"build.py"` | no |
 | cloudwatch\_logs | Set this to false to disable logging your Lambda output to CloudWatch Logs | bool | true | no |
 | policy | An additional policy to attach to the Lambda function role | object({json=string}) | | no |
+| trusted\_entities | Additional trusted entities for the Lambda function. The lambda.amazonaws.com (and edgelambda.amazonaws.com if lambda\_at\_edge is true) is always set  | `list(string)` | | no |
 
 The following arguments from the [aws_lambda_function](https://www.terraform.io/docs/providers/aws/r/lambda_function.html) resource are not supported:
 

iam.tf

@@ -7,7 +7,7 @@ data "aws_iam_policy_document" "assume_role" {
 
     principals {
       type        = "Service"
-      identifiers = ["lambda.amazonaws.com"]
+      identifiers = concat(list("lambda.amazonaws.com"), var.trusted_entities)
     }
   }
 }

variables.tf

@@ -108,3 +108,9 @@ variable "cloudwatch_logs" {
   type        = bool
   default     = true
 }
+
+variable "trusted_entities" {
+  description = "Lambda function additional trusted entities for assuming roles (trust relationship)"
+  type        = list(string)
+  default     = []
+}