terraform refactor - conditional cross-account role

devops-pipeline/other-resources/main.tf

@@ -203,6 +203,7 @@ resource "aws_iam_role_policy_attachment" "snowflake_integration_policy_attachme
 
 # IAM role - cross-account-role 
 resource "aws_iam_role" "cross_account_role" {
+  count = var.environment != "dev"? 1 : 0
   name = local.cross_account_role_name
 
   assume_role_policy = jsonencode({
@@ -213,7 +214,7 @@ resource "aws_iam_role" "cross_account_role" {
         Effect = "Allow"
         Sid    = ""
         Principal = {
-          AWS = "arn:aws:iam::873115228912:root"
+          AWS = "arn:aws:iam::${var.cross_account_target_account_id}:root"
         }
       },
     ]
@@ -240,6 +241,7 @@ data "aws_iam_policy_document" "cross_account_policy_document" {
 
 # IAM Policy for cross-account-role
 resource "aws_iam_policy" "cross_account_policy" {
+  count = var.environment != "dev"? 1 : 0
   name        = local.cross_account_policy_name
   description = "This role is used for other AWS account to assume inorder to drop files to our data ingestion bucket. At the time of creation, this is being used by CODE DEV to drop all clients list."
   policy      = data.aws_iam_policy_document.cross_account_policy_document.json
@@ -247,8 +249,9 @@ resource "aws_iam_policy" "cross_account_policy" {
 
 # Attach IAM Policy to cross-account-role
 resource "aws_iam_role_policy_attachment" "cross_account_policy_attachment" {
-  role       = aws_iam_role.cross_account_role.name
-  policy_arn = aws_iam_policy.cross_account_policy.arn
+  count = var.environment != "dev"? 1 : 0
+  role       = aws_iam_role.cross_account_role[count.index].name
+  policy_arn = aws_iam_policy.cross_account_policy[count.index].arn
 }
 
 # IAM role - mwaa-exec-role

devops-pipeline/other-resources/outputs.tf

@@ -17,7 +17,7 @@ output "snowflake_integration_role_arn" {
 }
 
 output "cross_account_role_arn" {
-  value = aws_iam_role.cross_account_role.id
+  value = aws_iam_role.cross_account_role[*].id
 }
 
 output "mwaa_exec_role_arn" {

devops-pipeline/other-resources/variables.tf

@@ -59,4 +59,9 @@ variable "aws_account_id" {
 
 variable "storage_integration_external_id" {
   type = string
-}
+}
+
+
+variable "cross_account_target_account_id" {
+  type = string
+}

devops-pipeline/other-resources/vars-dev.tfvars

@@ -1,2 +1,3 @@
 aws_account_id                  = 660131068782
-storage_integration_external_id = "OQ11564_SFCRole=2_lNKzpyFn/e/xQgvGGpusVbEZA0A="
+storage_integration_external_id = "OQ11564_SFCRole=2_lNKzpyFn/e/xQgvGGpusVbEZA0A="
+cross_account_target_account_id = ""

devops-pipeline/other-resources/vars-uat.tfvars

@@ -1,2 +1,3 @@
 aws_account_id                  = 975049960860
-storage_integration_external_id = "OQ11564_SFCRole=2_L4NUsKqd3NIBmrATa1djc/T3ECQ="
+storage_integration_external_id = "OQ11564_SFCRole=2_L4NUsKqd3NIBmrATa1djc/T3ECQ="
+cross_account_target_account_id = 660131068782