Merge branch 'master' into patch-1

Author: jaydeland

CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to this project will be documented in this file.
 
+### [5.14.1](https://github.com/terraform-aws-modules/terraform-aws-iam/compare/v5.14.0...v5.14.1) (2023-03-21)
+
+
+### Bug Fixes
+
+* Update self manage policy to support users with path ([#335](https://github.com/terraform-aws-modules/terraform-aws-iam/issues/335)) ([9a8d5cb](https://github.com/terraform-aws-modules/terraform-aws-iam/commit/9a8d5cb68da61f8bf19e45051f2faf399026dd44))
+
+## [5.14.0](https://github.com/terraform-aws-modules/terraform-aws-iam/compare/v5.13.0...v5.14.0) (2023-03-17)
+
+
+### Features
+
+* Update efs_csi policy to support resource tagging ([#352](https://github.com/terraform-aws-modules/terraform-aws-iam/issues/352)) ([47cb7a2](https://github.com/terraform-aws-modules/terraform-aws-iam/commit/47cb7a234786c0ce3d3eb9f403d975a17823ba76))
+
 ## [5.13.0](https://github.com/terraform-aws-modules/terraform-aws-iam/compare/v5.12.0...v5.13.0) (2023-03-10)
 
 

examples/iam-group-with-policies/main.tf

@@ -14,6 +14,7 @@ module "iam_user2" {
   source = "../../modules/iam-user"
 
   name = "user2"
+  path = "/developers/"
 
   create_iam_user_login_profile = false
   create_iam_access_key         = false

modules/iam-group-with-policies/policies.tf

@@ -35,7 +35,10 @@ data "aws_iam_policy_document" "iam_self_management" {
       "iam:GetUser"
     ]
 
-    resources = ["arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}"]
+    resources = [
+      "arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}",
+      "arn:${local.partition}:iam::${local.aws_account_id}:user/*/$${aws:username}"
+    ]
   }
 
   statement {
@@ -50,7 +53,10 @@ data "aws_iam_policy_document" "iam_self_management" {
       "iam:UpdateAccessKey"
     ]
 
-    resources = ["arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}"]
+    resources = [
+      "arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}",
+      "arn:${local.partition}:iam::${local.aws_account_id}:user/*/$${aws:username}"
+    ]
   }
 
   statement {
@@ -65,7 +71,10 @@ data "aws_iam_policy_document" "iam_self_management" {
       "iam:UploadSigningCertificate"
     ]
 
-    resources = ["arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}"]
+    resources = [
+      "arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}",
+      "arn:${local.partition}:iam::${local.aws_account_id}:user/*/$${aws:username}"
+    ]
   }
 
   statement {
@@ -81,7 +90,10 @@ data "aws_iam_policy_document" "iam_self_management" {
       "iam:UploadSSHPublicKey"
     ]
 
-    resources = ["arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}"]
+    resources = [
+      "arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}",
+      "arn:${local.partition}:iam::${local.aws_account_id}:user/*/$${aws:username}"
+    ]
   }
 
   statement {
@@ -97,7 +109,10 @@ data "aws_iam_policy_document" "iam_self_management" {
       "iam:UpdateServiceSpecificCredential"
     ]
 
-    resources = ["arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}"]
+    resources = [
+      "arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}",
+      "arn:${local.partition}:iam::${local.aws_account_id}:user/*/$${aws:username}"
+    ]
   }
 
   statement {
@@ -124,8 +139,10 @@ data "aws_iam_policy_document" "iam_self_management" {
       "iam:ResyncMFADevice"
     ]
 
-    resources = ["arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}"]
-
+    resources = [
+      "arn:${local.partition}:iam::${local.aws_account_id}:user/$${aws:username}",
+      "arn:${local.partition}:iam::${local.aws_account_id}:user/*/$${aws:username}"
+    ]
   }
 
   statement {

modules/iam-role-for-service-accounts-eks/policies.tf

@@ -341,6 +341,17 @@ data "aws_iam_policy_document" "efs_csi" {
     }
   }
 
+  statement {
+    actions   = ["elasticfilesystem:TagResource"]
+    resources = ["*"]
+
+    condition {
+      test     = "StringLike"
+      variable = "aws:RequestTag/efs.csi.aws.com/cluster"
+      values   = ["true"]
+    }
+  }
+
   statement {
     actions   = ["elasticfilesystem:DeleteAccessPoint"]
     resources = ["*"]