Merge pull request #16 from lacework/afiune/aws/iam_role/external_id

fix(aws): configure an External ID in IAM Role
lacework · Mar 27, 2020 · 2a70585 · 2a70585
2 parents b31c772 + 572dc97
commit 2a70585
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 1 deletion.
diff --git a/aws/main.tf b/aws/main.tf
@@ -138,7 +138,12 @@ resource "aws_iam_role" "lacework_iam_role" {
     "Principal": {
       "AWS": "arn:aws:iam::${var.lacework_aws_account_id}:root"
     },
-    "Action": "sts:AssumeRole"
+    "Action": "sts:AssumeRole",
+    "Condition": {
+      "StringEquals": {
+        "sts:ExternalId": "${var.external_id}"
+      }
+    }
   }
 }
 EOF

diff --git a/aws/variables.tf b/aws/variables.tf
@@ -19,6 +19,10 @@ variable "bucket_name" {
   default = "lacework-cloudtrail-bucket"
 }
 
+variable "external_id" {
+  default = "12345"
+}
+
 variable "iam_role_name" {
   default = "lacework_iam_role"
 }