Closed tptee closed 4 years ago
I misunderstood how service principals worked when writing this ticket. They aren't necessary for any of our IAM to work–they're necessary to specify that an AWS service can assume a role. Since we don't know which services a user will allow to assume the role, we can't (and shouldn't) provide any service principals.
See:
In #52, we added IAM policies as outputs to allow users to compose an assumable IAM role from those policies. To use these policies in a service role, the user must provide an assume role statement with all of the principals that are allowed to assume the role. Users can't guess which principals to add without inspecting the IAM policies.
In each module, let's add a list of service principals to the outputs like so: