AWS Provider に aws_devopsagent_agent_space が追加されたので、AWS DevOps Agent の Agent Space を Terraform で作ってみた

data "aws_caller_identity" "current" {}
data "aws_region" "current" {}

# IAM ロールの反映を待ってから Agent Space と Association を作る
resource "time_sleep" "wait_for_iam_propagation" {
  depends_on      = [aws_iam_role.agent_space, aws_iam_role_policy_attachment.agent_space]
  create_duration = "30s"
}

resource "aws_devopsagent_agent_space" "this" {
  name        = "tf-aws-provider-space-sample"
  description = "Agent Space created by the aws provider"

  depends_on = [time_sleep.wait_for_iam_propagation]
}

data "aws_iam_policy_document" "agent_space_trust" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["aidevops.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values   = [data.aws_caller_identity.current.account_id]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = ["arn:aws:aidevops:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:agentspace/*"]
    }
  }
}

resource "aws_iam_role" "agent_space" {
  name               = "DevOpsAgentRole-AgentSpace-tfsample"
  assume_role_policy = data.aws_iam_policy_document.agent_space_trust.json
}

resource "aws_iam_role_policy_attachment" "agent_space" {
  role       = aws_iam_role.agent_space.name
  policy_arn = "arn:aws:iam::aws:policy/AIDevOpsAgentAccessPolicy"
}

resource "awscc_devopsagent_association" "monitor" {
  agent_space_id = aws_devopsagent_agent_space.this.agent_space_id
  service_id     = "aws"

  configuration = {
    aws = {
      account_id         = data.aws_caller_identity.current.account_id
      account_type       = "monitor"
      assumable_role_arn = aws_iam_role.agent_space.arn
    }
  }

  depends_on = [aws_devopsagent_agent_space.this]
}

terraform {
  required_version = "~> 1.16"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.69"
    }
    time = {
      source  = "hashicorp/time"
      version = "~> 0.13"
    }
    awscc = {
      source  = "hashicorp/awscc"
      version = "~> 1.0"
    }
  }
}

provider "aws" {
  region = "ap-northeast-1"
}

provider "awscc" {
  region = "ap-northeast-1"
}

╷
│ Error: AWS SDK Go Service Operation Incomplete
│
│   with awscc_devopsagent_association.monitor,
│   ...
│
│ Waiting for Cloud Control API service CreateResource operation completion returned: waiter state transitioned to FAILED. StatusMessage: Error occurred during operation 'AWS::DevOpsAgent::Association: Invalid STS role configuration for session monitorVerificationAssociationRoleSession. Verify the role's trust policy. (Service: DevOpsAgent, Status Code: 400,
│ Request ID: <REQUEST_ID>) (SDK Attempt Count: 1)'.. ErrorCode: GeneralServiceException

オペレーターアクセスの起動に失敗しました
Operator app does not contain IAM configuration for AgentSpace with agentSpaceId <AGENT_SPACE_ID>

# Operator App 用の IAM ロール（aws_iam_role.operator）の定義は省略
resource "awscc_devopsagent_agent_space" "this" {
  name        = "tf-awscc-provider-space"
  description = "Agent Space created by the awscc provider"

  operator_app = {
    iam = {
      operator_app_role_arn = aws_iam_role.operator.arn
    }
  }

  depends_on = [aws_iam_role_policy_attachment.operator]
}