[マルチアカウント]HCP Terraformのdynamic credentials用のAWS IAM RoleをAWS CloudFormation StackSetで作成してみた

TFC_AWS_PROVIDER_AUTH=true
TFC_AWS_RUN_ROLE_ARN=<IAM Role ARN>

Name: auth-aws-<AWSアカウントID>
Description: AWS credentials for <AWSアカウント名>

Name: auth-hcp-tf-<HCP Terraform Team名>
Description: AWS credentials for <HCP Terraform Team名>

AWSTemplateFormatVersion: '2010-09-09'
Description: 'HCP Terraform OIDC Provider and IAM Role'

Parameters:
  HCPTerraformOrgName:
    Type: String
    Description: 'HCP Terraform Organization Name'
  HCPTerraformIAMRoleName:
    Type: String
    Description: 'HCP Terraform IAM Role Name'

Resources:
  HCPTerraformOIDCProvider:
    Type: 'AWS::IAM::OIDCProvider'
    Properties:
      Url: 'https://app.terraform.io'
      ClientIdList:
        - 'aws.workload.identity'

  HCPTerraformRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Ref HCPTerraformIAMRoleName
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Federated: !GetAtt HCPTerraformOIDCProvider.Arn
            Action: 'sts:AssumeRoleWithWebIdentity'
            Condition:
              StringEquals:
                'app.terraform.io:aud': 'aws.workload.identity'
              StringLike:
                'app.terraform.io:sub': !Sub 'organization:${HCPTerraformOrgName}:project:*:workspace:*:run_phase:*'

  HCPTerraformRolePolicyAttachment:
    Type: 'AWS::IAM::RolePolicy'
    Properties:
      PolicyName: 'AdministratorAccess'
      RoleName: !Ref HCPTerraformRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: '*'
            Resource: '*'

Outputs:
  RoleArn:
    Description: 'ARN of the created IAM Role'
    Value: !GetAtt HCPTerraformRole.Arn

terraform {
  required_version = ">= 1.11.1"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.82.2"
    }
    tfe = {
      source  = "hashicorp/tfe"
      version = ">= 0.62.0"
    }
  }
}

provider "aws" {
  region = var.aws_region
}

provider "tfe" {
  organization = var.hcp_tf_organization_name
}

resource "aws_cloudformation_stack_set" "this" {
  name             = "hcp-tf-role"
  permission_model = "SERVICE_MANAGED"

  auto_deployment {
    enabled                          = true
    retain_stacks_on_account_removal = false
  }

  parameters = {
    HCPTerraformOrgName     = var.hcp_tf_organization_name
    HCPTerraformIAMRoleName = var.hcp_tf_iam_role_name
  }
  template_body = file("${path.module}/files/cfn.yaml")
  capabilities  = ["CAPABILITY_NAMED_IAM"]
}

resource "aws_cloudformation_stack_set_instance" "this" {
  stack_set_name = aws_cloudformation_stack_set.this.name
  deployment_targets {
    organizational_unit_ids = [var.aws_ou_id]
  }
  region = var.aws_region
}

data "aws_organizations_organization" "org" {}

data "aws_organizations_organizational_unit_child_accounts" "accounts" {
  parent_id = var.aws_ou_id
}

locals {
  accounts_map = { for account in data.aws_organizations_organizational_unit_child_accounts.accounts.accounts : account.id => account }
}

resource "tfe_variable_set" "this" {
  for_each    = local.accounts_map
  name        = "auth-aws-${each.key}"
  description = "AWS credentials for ${each.value.name}"
}

resource "tfe_variable" "aws_provider_auth" {
  for_each = tfe_variable_set.this

  key             = "TFC_AWS_PROVIDER_AUTH"
  value           = "true"
  category        = "env"
  variable_set_id = each.value.id
}

resource "tfe_variable" "aws_run_role_arn" {
  for_each = tfe_variable_set.this

  key = "TFC_AWS_RUN_ROLE_ARN"
  # StackインスタンスのOutputをStackSet実行アカウントでは取得できないため、IAMロールのARNを直接指定する
  value           = "arn:aws:iam::${each.key}:role/${var.hcp_tf_iam_role_name}"
  category        = "env"
  variable_set_id = each.value.id
}

variable "aws_region" {
  description = "The AWS region to deploy the IAM role to"
  type        = string
  default     = "ap-northeast-1"
}

variable "aws_ou_id" {
  description = "The id of the OU to deploy the IAM role to"
  type        = string
}

variable "hcp_tf_organization_name" {
  description = "The name of the HCP Terraform organization"
  type        = string
}

variable "hcp_tf_iam_role_name" {
  description = "The name of the IAM role to create"
  type        = string
  default     = "hcp-tf-role"
}

mkdir hcp-tf-iam-role-stack-set  && cd "$_"
vi variables.tf
vi main.tf
touch files/cfn.yaml
git add .
git commit -m "HCP Terraform IAM Role and OIDC ProviderのCloudFormationスタックセットを追加"
git push origin HEAD

sato-org-hcp-tf-iam-role