Add more options for generating trust policy

[enver-multibank]

Description

Trust role policy generated for IAM role does not have controls for conditionals like aws:SourceArn, aws:SourceAccount, aws:SourceOrgID, or aws:SourceOrgPaths used for confused deputy problem prevention. Workaround for the problem is to provide custom trust policy with appropriate conditions for role assumption, however I think we should promote good security practices and have some of these controls added to role modules and perhaps enabled by default at some point in the future.

If approved I'm willing to submit PR (for start maybe just one conditional, like aws:SourceAccount) with backward compatible changes to test it out.

• ✋ I have searched the open/closed issues and my issue is not listed.

Versions

• Module version [Required]:
  5.28.0
• Terraform version:
  Terraform v1.7.5
  registry.terraform.io/hashicorp/aws v5.58.0

Steps to reproduce the behavior:

module "test_role" {
  source  = "terraform-aws-modules/iam/aws//modules/iam-assumable-role"
  version = "5.28.0"

  trusted_role_services = [
    "ec2.amazonaws.com"
  ]

  create_role             = true
  create_instance_profile = true

  role_name         = "test_role"
  role_description  = "Test role"
  role_requires_mfa = false

  custom_role_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
  ]
}

Generated trust policy looks like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "Service": "ec2.amazonaws.com"
            },
            "Action": [
                "sts:TagSession",
                "sts:AssumeRole"
            ]
        }
    ]
}

Expected behavior

We should be able to generate policy like this

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "Service": "ec2.amazonaws.com"
            },
            "Action": [
                "sts:TagSession",
                "sts:AssumeRole"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "<account id>"
                }
            }
        }
    ]
}

Actual behavior

There is no option to add conditions except for: aws:PrincipalArn

Terminal Output Screenshot(s)

---

Additional context

---

[enver-multibank]

@tbalzer Do you plan to submit PR?

[tbalzer]

Hi @enver-multibank , thanks for creating a PR here. I got sidetracked and couldn't find the time recently to push this over the line with proper examples and local testing.

[github-actions]

This issue has been automatically marked as stale because it has been open 30 days
with no activity. Remove stale label or comment or this issue will be closed in 10 days