FormidableLabs / terraform-aws-serverless

Infrastructure support for Serverless framework apps, done the right way
https://registry.terraform.io/modules/FormidableLabs/serverless/aws
MIT License
144 stars 19 forks source link

Export AWS service principals needed for AssumeRole in each module #53

Closed tptee closed 4 years ago

tptee commented 5 years ago

See:

In #52, we added IAM policies as outputs to allow users to compose an assumable IAM role from those policies. To use these policies in a service role, the user must provide an assume role statement with all of the principals that are allowed to assume the role. Users can't guess which principals to add without inspecting the IAM policies.

In each module, let's add a list of service principals to the outputs like so:

output "service_principals" {
  value = ["lambda.amazonaws.com", "codedeploy.amazonaws.com"]
}
tptee commented 4 years ago

I misunderstood how service principals worked when writing this ticket. They aren't necessary for any of our IAM to work–they're necessary to specify that an AWS service can assume a role. Since we don't know which services a user will allow to assume the role, we can't (and shouldn't) provide any service principals.