From b4f282a9f4291bdc3a3fc7d66e589be6af3e66d4 Mon Sep 17 00:00:00 2001
From: Grzegorz Huber <ghuber@aarete.com>
Date: Wed, 12 Jun 2024 15:27:45 +0200
Subject: [PATCH] terraform refactor - conditional cross-account role

---
 devops-pipeline/other-resources/main.tf         | 9 ++++++---
 devops-pipeline/other-resources/outputs.tf      | 2 +-
 devops-pipeline/other-resources/variables.tf    | 7 ++++++-
 devops-pipeline/other-resources/vars-dev.tfvars | 3 ++-
 devops-pipeline/other-resources/vars-uat.tfvars | 3 ++-
 5 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/devops-pipeline/other-resources/main.tf b/devops-pipeline/other-resources/main.tf
index 668d449..11e41b4 100644
--- a/devops-pipeline/other-resources/main.tf
+++ b/devops-pipeline/other-resources/main.tf
@@ -203,6 +203,7 @@ resource "aws_iam_role_policy_attachment" "snowflake_integration_policy_attachme
 
 # IAM role - cross-account-role 
 resource "aws_iam_role" "cross_account_role" {
+  count = var.environment != "dev"? 1 : 0
   name = local.cross_account_role_name
 
   assume_role_policy = jsonencode({
@@ -213,7 +214,7 @@ resource "aws_iam_role" "cross_account_role" {
         Effect = "Allow"
         Sid    = ""
         Principal = {
-          AWS = "arn:aws:iam::873115228912:root"
+          AWS = "arn:aws:iam::${var.cross_account_target_account_id}:root"
         }
       },
     ]
@@ -240,6 +241,7 @@ data "aws_iam_policy_document" "cross_account_policy_document" {
 
 # IAM Policy for cross-account-role
 resource "aws_iam_policy" "cross_account_policy" {
+  count = var.environment != "dev"? 1 : 0
   name        = local.cross_account_policy_name
   description = "This role is used for other AWS account to assume inorder to drop files to our data ingestion bucket. At the time of creation, this is being used by CODE DEV to drop all clients list."
   policy      = data.aws_iam_policy_document.cross_account_policy_document.json
@@ -247,8 +249,9 @@ resource "aws_iam_policy" "cross_account_policy" {
 
 # Attach IAM Policy to cross-account-role
 resource "aws_iam_role_policy_attachment" "cross_account_policy_attachment" {
-  role       = aws_iam_role.cross_account_role.name
-  policy_arn = aws_iam_policy.cross_account_policy.arn
+  count = var.environment != "dev"? 1 : 0
+  role       = aws_iam_role.cross_account_role[count.index].name
+  policy_arn = aws_iam_policy.cross_account_policy[count.index].arn
 }
 
 # IAM role - mwaa-exec-role
diff --git a/devops-pipeline/other-resources/outputs.tf b/devops-pipeline/other-resources/outputs.tf
index a8e15a4..73b55c5 100644
--- a/devops-pipeline/other-resources/outputs.tf
+++ b/devops-pipeline/other-resources/outputs.tf
@@ -17,7 +17,7 @@ output "snowflake_integration_role_arn" {
 }
 
 output "cross_account_role_arn" {
-  value = aws_iam_role.cross_account_role.id
+  value = aws_iam_role.cross_account_role[*].id
 }
 
 output "mwaa_exec_role_arn" {
diff --git a/devops-pipeline/other-resources/variables.tf b/devops-pipeline/other-resources/variables.tf
index 400c5a7..329d40f 100644
--- a/devops-pipeline/other-resources/variables.tf
+++ b/devops-pipeline/other-resources/variables.tf
@@ -59,4 +59,9 @@ variable "aws_account_id" {
 
 variable "storage_integration_external_id" {
   type = string
-}
\ No newline at end of file
+}
+
+
+variable "cross_account_target_account_id" {
+  type = string
+}
diff --git a/devops-pipeline/other-resources/vars-dev.tfvars b/devops-pipeline/other-resources/vars-dev.tfvars
index 920db87..4de60b8 100644
--- a/devops-pipeline/other-resources/vars-dev.tfvars
+++ b/devops-pipeline/other-resources/vars-dev.tfvars
@@ -1,2 +1,3 @@
 aws_account_id                  = 660131068782
-storage_integration_external_id = "OQ11564_SFCRole=2_lNKzpyFn/e/xQgvGGpusVbEZA0A="
\ No newline at end of file
+storage_integration_external_id = "OQ11564_SFCRole=2_lNKzpyFn/e/xQgvGGpusVbEZA0A="
+cross_account_target_account_id = ""
\ No newline at end of file
diff --git a/devops-pipeline/other-resources/vars-uat.tfvars b/devops-pipeline/other-resources/vars-uat.tfvars
index c211281..1d307e6 100644
--- a/devops-pipeline/other-resources/vars-uat.tfvars
+++ b/devops-pipeline/other-resources/vars-uat.tfvars
@@ -1,2 +1,3 @@
 aws_account_id                  = 975049960860
-storage_integration_external_id = "OQ11564_SFCRole=2_L4NUsKqd3NIBmrATa1djc/T3ECQ="
\ No newline at end of file
+storage_integration_external_id = "OQ11564_SFCRole=2_L4NUsKqd3NIBmrATa1djc/T3ECQ="
+cross_account_target_account_id = 660131068782
\ No newline at end of file