feat: changing the boundary parameter to a name rather than full arn

Author: gambol99

Diff for: examples/role/main.tf

@@ -13,7 +13,7 @@ module "common_provider_example" {
   repository = "appvia/something"
 
   // Set the permission boundary for both the read-only and read-write role
-  permission_boundary_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
+  permission_boundary = "AdministratorAccess"
 
   // List of policy ARNs to attach to the read-only role
   read_only_policy_arns = [

Diff for: modules/role/data.tf

@@ -1,2 +1,5 @@
+
+## Retrieve the current AWS account identity 
 data "aws_caller_identity" "current" {}
+## Retrieve the current AWS region
 data "aws_region" "current" {}

Diff for: modules/role/locals.tf

@@ -24,6 +24,8 @@ locals {
       subject_tag_mapping    = "project_path:{repo}:ref_type:{type}:ref:{ref}"
     }
   }
+  # The full ARN of the permission boundary to attach to the role
+  permission_boundary_arn = format("arn:aws:iam::%s:policy/%s", data.aws_caller_identity.current.account_id, var.permission_boundary)
 }
 
 locals {

Diff for: modules/role/main.tf

@@ -44,7 +44,7 @@ resource "aws_iam_role" "ro" {
 
   force_detach_policies = var.force_detach_policies
   max_session_duration  = var.read_only_max_session_duration
-  permissions_boundary  = var.permission_boundary_arn
+  permissions_boundary  = local.permission_boundary_arn
 
   dynamic "inline_policy" {
     for_each = var.read_only_inline_policies
@@ -119,7 +119,7 @@ resource "aws_iam_role" "rw" {
 
   force_detach_policies = var.force_detach_policies
   max_session_duration  = var.read_write_max_session_duration
-  permissions_boundary  = var.permission_boundary_arn
+  permissions_boundary  = local.permission_boundary_arn
 
   dynamic "inline_policy" {
     for_each = var.read_write_inline_policies

Diff for: modules/role/variables.tf

@@ -104,14 +104,12 @@ variable "force_detach_policies" {
   description = "Flag to force detachment of policies attached to the IAM role."
 }
 
-variable "permission_boundary_arn" {
+variable "permission_boundary" {
   type        = string
-  default     = null
-  description = "The ARN of the policy that is used to set the permissions boundary for the IAM role"
+  description = "The name of the policy that is used to set the permissions boundary for the IAM role"
 }
 
 variable "tags" {
   type        = map(string)
-  default     = {}
   description = "Tags to apply resoures created by this module"
 }