Subscribe through RSS feeds to stay up-to-date with new releases!
View on GitHub
eks/echo-server and eks/alb-controller-ingress-group componentsinternal or internet-facing)profiles_enabled input to override global valueiam-roles profiles_enabled input to force getting a role ARN even when profiles are in useaccount-map profiles_enabled flag was true, iam_roles.terraform_role_arn would be
null. However, eks/cluster requires terraform_role_arn regardless.legacy_terraform_uses_admin feature flag to retain backwards compatibilityterraform roles in root and identity were not used for Terraform plan/apply, but for other
things, and so the terraform_roles map output selected the admin roles for those accounts. This "wart" has been
remove in current aws-team-roles and tfstate-backend configurations, but for people who do not want to migrate to
the new conventions, this feature flag enables them to maintain the status quo with respect to role usage while taking
advantage of other updates to account-map and other components.This update is recommended for all customers wanting to use any component version 1.227 or later.
function_name to set the lambda function name.function_name optional. When not set, the old null-lable-derived name will be use.function_name was required to set, but it wasn't actually passed to module "lambda" inputs.function_name and preserve old behavior of using automatically generated name.AWS Error: operation error STS: AssumeRole, https response error StatusCode: 403, RequestID: 00000000-0000-0000-0000-00000000, api error AccessDenied: User: arn:aws:sts::000000000000:assumed-role/acme-core-gbl-security-terraform/aws-go-sdk-1687312396297825294 is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::000000000000:role/acme-core-gbl-security-terraform
Possibly breaking change:
In this update, account-map/modules/iam-roles acquired a provider, making it no longer able to be used with count.
If you have code like
module "optional_role" {
count = local.optional_role_enabled ? 1 : 0
source = "../account-map/modules/iam-roles"
stage = var.optional_role_stage
context = module.this.context
}
You will need to rewrite it, removing the count parameter. It will be fine to always instantiate the module. If there
are problems with ensuring appropriate settings with the module is disabled, you can always replace them with the
component's inputs:
module "optional_role" {
source = "../account-map/modules/iam-roles"
stage = local.optional_role_enabled ? var.optional_role_stage : var.stage
context = module.this.context
}
The update to components 1.227.0 is huge, and you have options.
aws-teams team names. The new names are (except for support) distinct from team-roles, making it
easier to keep track. Also, the new managers team can run Terraform for identity and root in most (but not all) cases.aws-team-roles, including new permissions. The custom policies that have been removed are replaced in
the aws-team-roles configuration with AWS managed policy ARNs. This is required to add the planner role and
support the terraform plan restriction.providers.tf for all components. Or some of them now, some later. Most components do not require updates,
but all of them have updates. The new providers.tf, when used with dynamic Terraform roles, allows users directly
logged into target accounts (rather than having roles in the identity account) to use Terraform in that account, and
also allows SuperAdmin to run Terraform in more cases (almost everywhere).If you do not want any new features, you only need to update account-map to v1.235 or later, to be compatible with
future components. Note that when updating account-map this way, you should update the code everywhere (all open PRs
and branches) before applying the Terraform changes, because the applied changes break the old code.
If you want all the new features, we recommend updating all of the following to the current release in 1 PR:
The PR changes a lot of files. In particular, the providers.tf and therefore the README.md for nearly every
component. Therefore it will likely be easier to review this PR one commit at a time.
import_role_arn and import_profile_name have been removed as they are no longer needed. Current versions of
Terraform (probably beginning with v1.1.0, but maybe as late as 1.3.0, I have not found authoritative information) can
read data sources during plan and so no longer need a role to be explicitly specified while importing. Feel free to
perform your own tests to make yourself more comfortable that this is correct.
terraform plan
but not terraform applyproviders.tf to all components that need an aws providerproviders.tf can remain consistent/identical among
components and thus be easily updatedprovider-awsutils.mixin.tf to provide consistent, maintainable implementationaws-sso vendor safesso module in favor of aws-samlterraform plan without giving them permission to
make changes with Terraformaws-teams and aws-team-roles, to make aws-sso consistentdeprecated/Fix common issues in the repo
It violates our basic checks, which adds a headache to using https://github.com/cloudposse/github-action-atmos-component-updater as is
Note: It is much simpler to review PR if hide whitespace changes
Google is one of those identity providers that doesn't have good integration with AWS SSO. In order to sync groups and users across we need to use some API calls, luckily AWS Built aws-ssosync to handle that.
Unfortunately, it required ASM so we use Benbentwo/ssosync as it removes that requirement.
helm_manifest_experiment_enabled to false by defaulthelm_manifest_experiment_enabled reliably breaks when a Helm chart installs CRDs. The initial reason for
enabling it was for better drift detection, but the provider seems to have fixed most if not all of the drift
detection issues since then.providers.tf, return null for unused optionoverridable_* and update documentation to recommend variables_override.tf for customizationproviders.tf updates to support dynamic Terraform roles