working on workspace cleanup

Author: arnol377

main.tf

@@ -29,17 +29,11 @@ module "s3_artifacts_bucket" {
   }
 }
 
-# call build_user module
-module "build_user" {
-  count                 = local.build_user_iam_policy == null ? 0 : 1
-  source                = "./modules/build_user"
-  project_name          = var.project_name
-  account_id            = local.account_id
-  region                = local.region
-  build_user_iam_policy = local.build_user_iam_policy
+# Move away from conditional build_user module to use static IAM role
+locals {
+  build_user_role_arn = aws_iam_role.build_user_role.arn
 }
 
-
 module "codepipeline_kms" {
   source                = "./modules/kms"
   codepipeline_role_arn = module.codepipeline_iam_role.role_arn
@@ -107,7 +101,15 @@ module "codepipeline_iam_role" {
   }
 }
 
-
+module "build_user" {
+  source                = "./modules/build_user"
+  count                 = var.create_build_user ? 1 : 0
+  project_name          = var.project_name
+  region                = local.region
+  account_id            = local.account_id
+  build_user_iam_policy = local.build_user_iam_policy
+  secret_arns           = var.secret_arns
+}
 
 # Module for Infrastructure Validate, Plan, Apply and Destroy - CodePipeline
 module "codepipeline_terraform" {
@@ -152,7 +154,7 @@ resource "aws_iam_role" "build_user_role" {
         Action = "sts:AssumeRole"
         Effect = "Allow"
         Principal = {
-          Service = "ec2.amazonaws.com"
+          Service = ["ec2.amazonaws.com", "codebuild.amazonaws.com"]
         }
       }
     ]

modules/build_user/variables.tf

@@ -19,3 +19,9 @@ variable "build_user_iam_policy" {
   description = "The IAM policy for the build user."
   type        = string
 }
+
+variable "secret_arns" {
+  description = "List of secret ARNs that the build user needs access to"
+  type        = list(string)
+  default     = null
+}

modules/iam-role/main.tf

@@ -3,14 +3,6 @@
 #This AWS Content is provided subject to the terms of the AWS Customer Agreement available at
 #http://aws.amazon.com/agreement or other written agreement between Customer and either
 #Amazon Web Services, Inc. or Amazon Web Services EMEA SARL or both.
-data "aws_s3_bucket" "assets" {
-  for_each = toset(concat(
-    var.goss_bucket == null ? [] : [var.goss_bucket.name],
-    var.ansible_bucket == null ? [] : [var.ansible_bucket.name],
-    var.packer_bucket == null ? [] : [var.packer_bucket.name]
-  ))
-  bucket = each.value
-}
 
 data "aws_iam_policy_document" "codepipeline_assume_role" {
   # iam:GetInstanceProfile
@@ -51,6 +43,9 @@ locals {
     var.goss_repo == null ? [] : [var.goss_repo.arn]
   )
   codecommit_repo_count = length(local.codecommit_repos)
+  
+  # Construct bucket ARNs directly since we know the bucket name
+  assets_bucket_arn = "arn:${data.aws_partition.current.partition}:s3:::${var.goss_bucket.name}"
 }
 
 data "aws_iam_policy_document" "codepipeline_policy" {
@@ -73,13 +68,13 @@ data "aws_iam_policy_document" "codepipeline_policy" {
       "arn:${data.aws_partition.current.partition}:s3:::${var.state.bucket}/*"
       ],
       var.goss_bucket == null ? [] : [
-        "${lookup(data.aws_s3_bucket.assets, var.goss_bucket.name).arn}/*"
+        "${local.assets_bucket_arn}/*"
       ],
       var.ansible_bucket == null ? [] : [
-        "${lookup(data.aws_s3_bucket.assets, var.ansible_bucket.name).arn}/*"
+        "${local.assets_bucket_arn}/*"
       ],
       var.packer_bucket == null ? [] : [
-        "${lookup(data.aws_s3_bucket.assets, var.packer_bucket.name).arn}/*"
+        "${local.assets_bucket_arn}/*"
     ]))
   }
   statement {

outputs.tf

@@ -31,7 +31,7 @@ output "iam_arn" {
 
 output "kms_arn" {
   value       = module.codepipeline_kms.arn
-  description = "The ARN of the KMS key used in the codepipeline"
+  description = "The KMS key ARN used in the codepipeline"
 }
 
 output "s3_arn" {
@@ -44,10 +44,6 @@ output "s3_bucket" {
   description = "The Name of the S3 Bucket"
 }
 
-output "user" {
-  value = one(module.build_user).user
-}
-
 output "sec_group" {
   value = aws_security_group.packer
 }
@@ -60,3 +56,8 @@ output "secrets" {
   value = aws_secretsmanager_secret.secrets
 }
 
+output "role_name" {
+  value       = aws_iam_role.build_user_role.name
+  description = "The name of the IAM role used for build and pipeline operations"
+}
+

variables.tf

@@ -394,3 +394,9 @@ variable "image_volume_mapping" {
   }))
   default = []
 }
+
+variable "create_build_user" {
+  description = "Whether to create a build user. Set to false if you want to use an existing user."
+  type        = bool
+  default     = true
+}