add conditon for local external_id

SPHTech-Platform · Feb 28, 2023 · af38748 · af38748
1 parent 0aeae64
commit af38748
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 5 deletions.
diff --git a/data.tf b/data.tf
@@ -235,7 +235,7 @@ data "aws_iam_policy_document" "aqua_cspm_custom_trust" {
       test     = "StringEquals"
       variable = "sts:ExternalId"
       values = [
-        jsondecode(aws_lambda_invocation.external_id.result)["ExternalId"],
+        local.external_id,
       ]
     }
 
@@ -264,7 +264,7 @@ data "aws_iam_policy_document" "aqua_cspm_custom_trust" {
       test     = "StringEquals"
       variable = "sts:ExternalId"
       values = [
-        jsondecode(aws_lambda_invocation.external_id.result)["ExternalId"],
+        local.external_id,
       ]
     }
 
@@ -293,7 +293,7 @@ data "aws_iam_policy_document" "aqua_cspm_custom_trust" {
       test     = "StringEquals"
       variable = "sts:ExternalId"
       values = [
-        jsondecode(aws_lambda_invocation.external_id.result)["ExternalId"],
+        local.external_id,
       ]
     }
 
@@ -322,7 +322,7 @@ data "aws_iam_policy_document" "aqua_cspm_custom_trust" {
       test     = "StringEquals"
       variable = "sts:ExternalId"
       values = [
-        jsondecode(aws_lambda_invocation.external_id.result)["ExternalId"],
+        local.external_id,
       ]
     }
 

diff --git a/lambda.tf b/lambda.tf
@@ -38,7 +38,7 @@ resource "aws_lambda_invocation" "onboarding" {
   input = jsonencode({
     ResourceProperties = {
       Secret  = local.secret_name,
-      ExtId   = jsondecode(aws_lambda_invocation.external_id.result)["ExternalId"],
+      ExtId   = local.external_id,
       Group   = var.aqua_group_name,
       RoleArn = aws_iam_role.aqua_cspm.arn,
       AccId   = data.aws_caller_identity.current.account_id

diff --git a/locals.tf b/locals.tf
@@ -3,6 +3,7 @@ locals {
 
   secret_name = "/aquacspm/secret-cspm"
 
+  external_id = jsondecode(aws_lambda_invocation.external_id.result)["status"] == "FAILED" ? jsondecode(aws_lambda_invocation.external_id.result)["message"] : jsondecode(aws_lambda_invocation.external_id.result)["ExternalId"]
   # public_ip   = "13.215.18.141/32"
 
   aqua_cspm_role_policy_arns = [