feat: allow policy customization

.gitignore

@@ -32,3 +32,5 @@ override.tf.json
 # Ignore CLI configuration files
 .terraformrc
 terraform.rc
+
+.envrc

README.md

@@ -73,13 +73,13 @@ module "aws_dynamic_provider_credentials" {
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | ~> 1.6 |
-| <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 5.32 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 5.59 |
 
 ## Providers
 
 | Name | Version |
 |------|---------|
-| <a name="provider_tfe"></a> [tfe](#provider\_tfe) | 0.51.1 |
+| <a name="provider_tfe"></a> [tfe](#provider\_tfe) | 0.57.0 |
 
 ## Modules
 
@@ -102,18 +102,20 @@ module "aws_dynamic_provider_credentials" {
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
+| <a name="input_dynamic_credentials_role_name_override"></a> [dynamic\_credentials\_role\_name\_override](#input\_dynamic\_credentials\_role\_name\_override) | The name of the IAM role to create. If not set, the name will be generated automatically. | `string` | `"terraform-cloud-dynamic-credentials"` | no |
+| <a name="input_policies"></a> [policies](#input\_policies) | A list of custom policies to attach to the IAM role. By default the provider will be allowed to perform all actions on all ec2 resources. | <pre>set(object({<br>    Effect   = string<br>    Action   = set(string)<br>    Resource = string<br>  }))</pre> | `[]` | no |
+| <a name="input_statements"></a> [statements](#input\_statements) | The list of statements to use for the trust relationship | <pre>set(object({<br>    org_name     = string<br>    project_name = string<br>    workspace    = string<br>    run_phase    = optional(string, "*")<br>  }))</pre> | n/a | yes |
 | <a name="input_tfc_aws_audience"></a> [tfc\_aws\_audience](#input\_tfc\_aws\_audience) | AWS audience | `string` | `"aws.workload.identity"` | no |
 | <a name="input_tfc_hostname"></a> [tfc\_hostname](#input\_tfc\_hostname) | The hostname of the TFC or TFE instance you'd like to use with AWS | `string` | `"app.terraform.io"` | no |
 | <a name="input_tfc_organization"></a> [tfc\_organization](#input\_tfc\_organization) | Name of the organization | `string` | n/a | yes |
 | <a name="input_tfc_project"></a> [tfc\_project](#input\_tfc\_project) | Name of the terraform cloud/enterprise project | `string` | n/a | yes |
-| <a name="input_tfc_workspaces"></a> [tfc\_workspaces](#input\_tfc\_workspaces) | List of workspaces to create IAM roles for | <pre>list(object({<br>    name_override = string<br>    workspace     = string<br>    run_phase     = string<br>    policies = list(object({<br>      Effect   = string<br>      Action   = list(string)<br>      Resource = string<br>    }))<br>  }))</pre> | n/a | yes |
 
 ## Outputs
 
 | Name | Description |
 |------|-------------|
 | <a name="output_aws_tfc_audience"></a> [aws\_tfc\_audience](#output\_aws\_tfc\_audience) | n/a |
-| <a name="output_full_names"></a> [full\_names](#output\_full\_names) | A list of all 'full\_name' values |
-| <a name="output_oidc_claims"></a> [oidc\_claims](#output\_oidc\_claims) | A map of 'full\_name' as key and 'openid\_claims' as value |
-| <a name="output_role_arns"></a> [role\_arns](#output\_role\_arns) | A map of 'full\_name' as key and 'role\_arn' as value |
+| <a name="output_full_name"></a> [full\_name](#output\_full\_name) | A list of all 'full\_name' values |
+| <a name="output_oidc_claims"></a> [oidc\_claims](#output\_oidc\_claims) | OpenID Claims for trust relationship |
+| <a name="output_role_arns"></a> [role\_arns](#output\_role\_arns) | ARN for trust relationship role |
 <!-- END_TF_DOCS -->

examples/README.md

@@ -0,0 +1,39 @@
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+No requirements.
+
+## Providers
+
+No providers.
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_tfc_aws_dynamic_credentials"></a> [tfc\_aws\_dynamic\_credentials](#module\_tfc\_aws\_dynamic\_credentials) | ../ | n/a |
+
+## Resources
+
+No resources.
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_AWS_ACCESS_KEY_ID"></a> [AWS\_ACCESS\_KEY\_ID](#input\_AWS\_ACCESS\_KEY\_ID) | The AWS access key | `any` | n/a | yes |
+| <a name="input_AWS_REGION"></a> [AWS\_REGION](#input\_AWS\_REGION) | The AWS zone to use for the resources | `string` | `"eu-central-1"` | no |
+| <a name="input_AWS_SECRET_ACCESS_KEY"></a> [AWS\_SECRET\_ACCESS\_KEY](#input\_AWS\_SECRET\_ACCESS\_KEY) | The AWS secret key | `any` | n/a | yes |
+| <a name="input_AWS_SESSION_TOKEN"></a> [AWS\_SESSION\_TOKEN](#input\_AWS\_SESSION\_TOKEN) | The AWS session token | `any` | n/a | yes |
+| <a name="input_TFC_ORGANIZATION"></a> [TFC\_ORGANIZATION](#input\_TFC\_ORGANIZATION) | The name of the Terraform Cloud organization | `string` | `"my-organization"` | no |
+| <a name="input_TFC_PROJECT_NAME"></a> [TFC\_PROJECT\_NAME](#input\_TFC\_PROJECT\_NAME) | The name of the Terraform Cloud project | `string` | `"my-project"` | no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_aws_tfc_audience"></a> [aws\_tfc\_audience](#output\_aws\_tfc\_audience) | n/a |
+| <a name="output_full_name"></a> [full\_name](#output\_full\_name) | n/a |
+| <a name="output_oidc_claims"></a> [oidc\_claims](#output\_oidc\_claims) | n/a |
+| <a name="output_role_arns"></a> [role\_arns](#output\_role\_arns) | n/a |
+<!-- END_TF_DOCS -->

examples/main.tf

@@ -0,0 +1,51 @@
+provider "aws" {
+  region     = var.AWS_REGION
+  access_key = var.AWS_ACCESS_KEY_ID
+  secret_key = var.AWS_SECRET_ACCESS_KEY
+  token      = var.AWS_SESSION_TOKEN
+}
+
+module "tfc_aws_dynamic_credentials" {
+  source           = "../"
+  tfc_hostname     = "app.terraform.io"
+  tfc_aws_audience = "app.terraform.io"
+  tfc_organization = var.TFC_ORGANIZATION
+  tfc_project      = var.TFC_PROJECT_NAME
+  statements = [
+    {
+      org_name     = var.TFC_ORGANIZATION
+      project_name = var.TFC_PROJECT_NAME
+      run_phase    = "*"
+      workspace    = "*"
+    },
+    {
+      org_name     = var.TFC_ORGANIZATION
+      project_name = var.TFC_PROJECT_NAME
+      run_phase    = "*"
+      workspace    = "hello-world"
+    },
+  ]
+  policies = [
+    {
+      Effect = "Allow"
+      Action = [
+        "ec2:*"
+      ]
+      Resource = "*"
+    },
+    {
+      Effect = "Allow"
+      Action = [
+        "s3:*"
+      ]
+      Resource = "*"
+    },
+    {
+      Effect = "Allow"
+      Action = [
+        "iam:*"
+      ]
+      Resource = "*"
+    }
+  ]
+}

examples/outputs.tf

@@ -0,0 +1,16 @@
+output "full_name" {
+  value = module.tfc_aws_dynamic_credentials.full_name
+}
+
+output "oidc_claims" {
+  value = module.tfc_aws_dynamic_credentials.oidc_claims
+}
+
+output "role_arns" {
+  value = module.tfc_aws_dynamic_credentials.role_arns
+}
+
+output "aws_tfc_audience" {
+  value     = module.tfc_aws_dynamic_credentials.aws_tfc_audience
+  sensitive = true
+}

examples/variables.tf

@@ -0,0 +1,28 @@
+variable "TFC_ORGANIZATION" {
+  description = "The name of the Terraform Cloud organization"
+  default     = "my-organization"
+}
+
+variable "TFC_PROJECT_NAME" {
+  description = "The name of the Terraform Cloud project"
+  default     = "my-project"
+}
+
+variable "AWS_REGION" {
+  description = "The AWS zone to use for the resources"
+  default     = "eu-central-1"
+}
+
+variable "AWS_ACCESS_KEY_ID" {
+  description = "The AWS access key"
+}
+
+variable "AWS_SECRET_ACCESS_KEY" {
+  description = "The AWS secret key"
+  sensitive   = true
+}
+
+variable "AWS_SESSION_TOKEN" {
+  description = "The AWS session token"
+  sensitive   = true
+}