Skip to content

Commit

Permalink
fix: remove leading / from SSM parameter names in policy ARNs (#1146)
Browse files Browse the repository at this point in the history
## Description

Using SSM parameter hierarchies (as described in
https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-hierarchies.html)
results in an error. See #1128

Several workarounds exist, but using `trimprefix` makes them
superfluous. Having a `/` as first character results in the above
mentioned error.

## Verification

Checked the ARN of parameter `/test/test`. It showed up as
`arn:aws:ssm:eu-central-1:123456789012:parameter/test/test` in the
console. So no `//` at first place.

---------

Co-authored-by: kirkchong <kirk_ang_from.tp@tech.gov.sg>
Co-authored-by: Matthias Kay <matthias.kay@hlag.com>
Co-authored-by: Matthias Kay <github@matthiaskay.de>
  • Loading branch information
4 people authored Jul 22, 2024
1 parent 13276ac commit beea51d
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 2 deletions.
1 change: 1 addition & 0 deletions .cspell.json
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,7 @@
"tfvars",
"tmpfs",
"tonumber",
"trimprefix",
"trivy",
"userns",
"xanzy",
Expand Down
4 changes: 2 additions & 2 deletions main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -615,14 +615,14 @@ data "aws_iam_policy_document" "ssm" {
var.runner_gitlab.preregistered_runner_token_ssm_parameter_name,
aws_ssm_parameter.runner_registration_token.name
]
) : "arn:${data.aws_partition.current.partition}:ssm:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:parameter/${name}"
) : "arn:${data.aws_partition.current.partition}:ssm:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:parameter/${trimprefix(name, "/")}"
]
}

statement {
actions = ["ssm:PutParameter"]
resources = [
"arn:${data.aws_partition.current.partition}:ssm:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:parameter/${aws_ssm_parameter.runner_registration_token.name}"
"arn:${data.aws_partition.current.partition}:ssm:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:parameter/${trimprefix(aws_ssm_parameter.runner_registration_token.name, "/")}"
]
}
}
Expand Down

0 comments on commit beea51d

Please sign in to comment.