Skip to content

Commit a53a091

Browse files
authored
Merge branch 'master' into patch-1
2 parents a133145 + 3cef466 commit a53a091

File tree

4 files changed

+50
-7
lines changed

4 files changed

+50
-7
lines changed

CHANGELOG.md

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,20 @@
22

33
All notable changes to this project will be documented in this file.
44

5+
### [5.14.1](https://github.com/terraform-aws-modules/terraform-aws-iam/compare/v5.14.0...v5.14.1) (2023-03-21)
6+
7+
8+
### Bug Fixes
9+
10+
* Update self manage policy to support users with path ([#335](https://github.com/terraform-aws-modules/terraform-aws-iam/issues/335)) ([9a8d5cb](https://github.com/terraform-aws-modules/terraform-aws-iam/commit/9a8d5cb68da61f8bf19e45051f2faf399026dd44))
11+
12+
## [5.14.0](https://github.com/terraform-aws-modules/terraform-aws-iam/compare/v5.13.0...v5.14.0) (2023-03-17)
13+
14+
15+
### Features
16+
17+
* Update efs_csi policy to support resource tagging ([#352](https://github.com/terraform-aws-modules/terraform-aws-iam/issues/352)) ([47cb7a2](https://github.com/terraform-aws-modules/terraform-aws-iam/commit/47cb7a234786c0ce3d3eb9f403d975a17823ba76))
18+
519
## [5.13.0](https://github.com/terraform-aws-modules/terraform-aws-iam/compare/v5.12.0...v5.13.0) (2023-03-10)
620

721

examples/iam-group-with-policies/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ module "iam_user2" {
1414
source = "../../modules/iam-user"
1515

1616
name = "user2"
17+
path = "/developers/"
1718

1819
create_iam_user_login_profile = false
1920
create_iam_access_key = false

modules/iam-group-with-policies/policies.tf

Lines changed: 24 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,10 @@ data "aws_iam_policy_document" "iam_self_management" {
3535
"iam:GetUser"
3636
]
3737

38-
resources = ["arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}"]
38+
resources = [
39+
"arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}",
40+
"arn:${local.partition}:iam::${local.aws_account_id}:user/*/$${aws:username}"
41+
]
3942
}
4043

4144
statement {
@@ -50,7 +53,10 @@ data "aws_iam_policy_document" "iam_self_management" {
5053
"iam:UpdateAccessKey"
5154
]
5255

53-
resources = ["arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}"]
56+
resources = [
57+
"arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}",
58+
"arn:${local.partition}:iam::${local.aws_account_id}:user/*/$${aws:username}"
59+
]
5460
}
5561

5662
statement {
@@ -65,7 +71,10 @@ data "aws_iam_policy_document" "iam_self_management" {
6571
"iam:UploadSigningCertificate"
6672
]
6773

68-
resources = ["arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}"]
74+
resources = [
75+
"arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}",
76+
"arn:${local.partition}:iam::${local.aws_account_id}:user/*/$${aws:username}"
77+
]
6978
}
7079

7180
statement {
@@ -81,7 +90,10 @@ data "aws_iam_policy_document" "iam_self_management" {
8190
"iam:UploadSSHPublicKey"
8291
]
8392

84-
resources = ["arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}"]
93+
resources = [
94+
"arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}",
95+
"arn:${local.partition}:iam::${local.aws_account_id}:user/*/$${aws:username}"
96+
]
8597
}
8698

8799
statement {
@@ -97,7 +109,10 @@ data "aws_iam_policy_document" "iam_self_management" {
97109
"iam:UpdateServiceSpecificCredential"
98110
]
99111

100-
resources = ["arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}"]
112+
resources = [
113+
"arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}",
114+
"arn:${local.partition}:iam::${local.aws_account_id}:user/*/$${aws:username}"
115+
]
101116
}
102117

103118
statement {
@@ -124,8 +139,10 @@ data "aws_iam_policy_document" "iam_self_management" {
124139
"iam:ResyncMFADevice"
125140
]
126141

127-
resources = ["arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}"]
128-
142+
resources = [
143+
"arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}",
144+
"arn:${local.partition}:iam::${local.aws_account_id}:user/*/$${aws:username}"
145+
]
129146
}
130147

131148
statement {

modules/iam-role-for-service-accounts-eks/policies.tf

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -341,6 +341,17 @@ data "aws_iam_policy_document" "efs_csi" {
341341
}
342342
}
343343

344+
statement {
345+
actions = ["elasticfilesystem:TagResource"]
346+
resources = ["*"]
347+
348+
condition {
349+
test = "StringLike"
350+
variable = "aws:RequestTag/efs.csi.aws.com/cluster"
351+
values = ["true"]
352+
}
353+
}
354+
344355
statement {
345356
actions = ["elasticfilesystem:DeleteAccessPoint"]
346357
resources = ["*"]

0 commit comments

Comments
 (0)