diff --git a/README.md b/README.md index 3db6e6c..f0335ca 100644 --- a/README.md +++ b/README.md @@ -235,6 +235,7 @@ Available targets: |------|-------------|------|---------|:--------:| | [access\_token](#input\_access\_token) | The personal access token for a third-party source control system for the Amplify app.
The personal access token is used to create a webhook and a read-only deploy key. The token is not stored.
Make sure that the account where the token is created has access to the repository. | `string` | `null` | no | | [additional\_tag\_map](#input\_additional\_tag\_map) | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.
This is for some rare cases where resources want additional configuration of tags
and therefore take a list of maps with tag key, value, and additional configuration. | `map(string)` | `{}` | no | +| [attach\_amplify\_admin\_managed\_policy](#input\_attach\_amplify\_admin\_managed\_policy) | Flag to attach the AWS managed policy `AdministratorAccess-Amplify` to the IAM service role for the Amplify app | `bool` | `false` | no | | [attributes](#input\_attributes) | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,
in the order they appear in the list. New attributes are appended to the
end of the list. The elements of the list are joined by the `delimiter`
and treated as a single ID element. | `list(string)` | `[]` | no | | [auto\_branch\_creation\_config](#input\_auto\_branch\_creation\_config) | The automated branch creation configuration for the Amplify app | 
object({
    basic_auth_credentials        = optional(string)
    build_spec                    = optional(string)
    enable_auto_build             = optional(bool)
    enable_basic_auth             = optional(bool)
    enable_performance_mode       = optional(bool)
    enable_pull_request_preview   = optional(bool)
    environment_variables         = optional(map(string))
    framework                     = optional(string)
    pull_request_environment_name = optional(string)
    stage                         = optional(string)
  })
| `null` | no | | [auto\_branch\_creation\_patterns](#input\_auto\_branch\_creation\_patterns) | The automated branch creation glob patterns for the Amplify app | `list(string)` | `[]` | no | diff --git a/docs/terraform.md b/docs/terraform.md index 895c6e6..257887e 100644 --- a/docs/terraform.md +++ b/docs/terraform.md @@ -36,6 +36,7 @@ |------|-------------|------|---------|:--------:| | [access\_token](#input\_access\_token) | The personal access token for a third-party source control system for the Amplify app.
The personal access token is used to create a webhook and a read-only deploy key. The token is not stored.
Make sure that the account where the token is created has access to the repository. | `string` | `null` | no | | [additional\_tag\_map](#input\_additional\_tag\_map) | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.
This is for some rare cases where resources want additional configuration of tags
and therefore take a list of maps with tag key, value, and additional configuration. | `map(string)` | `{}` | no | +| [attach\_amplify\_admin\_managed\_policy](#input\_attach\_amplify\_admin\_managed\_policy) | Flag to attach the AWS managed policy `AdministratorAccess-Amplify` to the IAM service role for the Amplify app | `bool` | `false` | no | | [attributes](#input\_attributes) | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,
in the order they appear in the list. New attributes are appended to the
end of the list. The elements of the list are joined by the `delimiter`
and treated as a single ID element. | `list(string)` | `[]` | no | | [auto\_branch\_creation\_config](#input\_auto\_branch\_creation\_config) | The automated branch creation configuration for the Amplify app | 
object({
    basic_auth_credentials        = optional(string)
    build_spec                    = optional(string)
    enable_auto_build             = optional(bool)
    enable_basic_auth             = optional(bool)
    enable_performance_mode       = optional(bool)
    enable_pull_request_preview   = optional(bool)
    environment_variables         = optional(map(string))
    framework                     = optional(string)
    pull_request_environment_name = optional(string)
    stage                         = optional(string)
  })
| `null` | no | | [auto\_branch\_creation\_patterns](#input\_auto\_branch\_creation\_patterns) | The automated branch creation glob patterns for the Amplify app | `list(string)` | `[]` | no | diff --git a/examples/complete/fixtures.us-east-2.tfvars b/examples/complete/fixtures.us-east-2.tfvars index 91165af..414829c 100644 --- a/examples/complete/fixtures.us-east-2.tfvars +++ b/examples/complete/fixtures.us-east-2.tfvars @@ -28,6 +28,8 @@ iam_service_role_actions = [ "logs:PutLogEvents" ] +attach_amplify_admin_managed_policy = true + enable_auto_branch_creation = false enable_branch_auto_build = true diff --git a/examples/complete/main.tf b/examples/complete/main.tf index 946e23a..75679ae 100644 --- a/examples/complete/main.tf +++ b/examples/complete/main.tf @@ -11,26 +11,27 @@ locals { module "amplify_app" { source = "../../" - access_token = data.aws_ssm_parameter.github_pat.value - description = var.description - repository = var.repository - platform = var.platform - oauth_token = var.oauth_token - auto_branch_creation_config = var.auto_branch_creation_config - auto_branch_creation_patterns = var.auto_branch_creation_patterns - basic_auth_credentials = var.basic_auth_credentials - build_spec = var.build_spec - enable_auto_branch_creation = var.enable_auto_branch_creation - enable_basic_auth = var.enable_basic_auth - enable_branch_auto_build = var.enable_branch_auto_build - enable_branch_auto_deletion = var.enable_branch_auto_deletion - environment_variables = var.environment_variables - custom_rules = var.custom_rules - iam_service_role_enabled = var.iam_service_role_enabled - iam_service_role_arn = var.iam_service_role_arn - iam_service_role_actions = var.iam_service_role_actions - environments = var.environments - domains = local.domains + access_token = data.aws_ssm_parameter.github_pat.value + description = var.description + repository = var.repository + platform = var.platform + oauth_token = var.oauth_token + auto_branch_creation_config = var.auto_branch_creation_config + auto_branch_creation_patterns = var.auto_branch_creation_patterns + basic_auth_credentials = var.basic_auth_credentials + build_spec = var.build_spec + enable_auto_branch_creation = var.enable_auto_branch_creation + enable_basic_auth = var.enable_basic_auth + enable_branch_auto_build = var.enable_branch_auto_build + enable_branch_auto_deletion = var.enable_branch_auto_deletion + environment_variables = var.environment_variables + custom_rules = var.custom_rules + iam_service_role_enabled = var.iam_service_role_enabled + iam_service_role_arn = var.iam_service_role_arn + iam_service_role_actions = var.iam_service_role_actions + environments = var.environments + domains = local.domains + attach_amplify_admin_managed_policy = var.attach_amplify_admin_managed_policy context = module.this.context } diff --git a/examples/complete/variables.tf b/examples/complete/variables.tf index 1ebf54b..01b428d 100644 --- a/examples/complete/variables.tf +++ b/examples/complete/variables.tf @@ -187,3 +187,10 @@ variable "domains" { description = "Amplify custom domain configurations" default = null } + +variable "attach_amplify_admin_managed_policy" { + type = bool + description = "Flag to attach the AWS managed policy `AdministratorAccess-Amplify` to the IAM service role for the Amplify app" + default = false + nullable = false +} diff --git a/iam.tf b/iam.tf index cf1f982..da5b58e 100644 --- a/iam.tf +++ b/iam.tf @@ -112,5 +112,7 @@ module "role" { one(data.aws_iam_policy_document.default[*].json) ] + managed_policy_arns = var.attach_amplify_admin_managed_policy ? ["arn:aws:iam::aws:policy/AdministratorAccess-Amplify"] : [] + context = module.this.context } diff --git a/variables.tf b/variables.tf index b2f0dd6..ba2cf4a 100644 --- a/variables.tf +++ b/variables.tf @@ -187,3 +187,10 @@ variable "domains" { description = "Amplify custom domain configurations" default = {} } + +variable "attach_amplify_admin_managed_policy" { + type = bool + description = "Flag to attach the AWS managed policy `AdministratorAccess-Amplify` to the IAM service role for the Amplify app" + default = false + nullable = false +}