Code cleanup

`terraform fmt` and updated README.  Also added tags to roles
and policies.

base/s3_bucket_writer_role/README.md

@@ -1,9 +1,22 @@
-This role is created separate from account standards even though it is required in all accounts. The role must be created after the salt master instance or the trust policy can't be applied.
+# s3_bucket_writer_role
 
-PREREQUISITES:
+A role to enable read/write access to a specific S3 bucket via `sts:AssumeRole`.
+It's primarily intended for cross-account scenarios. This is a little odd perhaps
+compared to S3 bucket policies and things allowing for native cross-account
+access via `Principal` in the bucket policy itself.
 
-Order gets very important in this module, unfortunately. The following sequence is required:
-* The salt-master instances must be created in C2 test and C2 prod (in govcloud).
-* This module must be run in commercial C2 prod (The user is created, which is trusted by all others)
-* This module must be run in commercial C2 test (The user is created, which is trusted by the rest of test)
-* Then the module can be run in all the other accounts
+I went this way so that scripts running on EC2 nodes with instance roles would
+have the ablility to (when needed) use an AssumeRole in order to gain
+read-write access to a bucket that 99.99% of the time they don't need the
+read-write access.
+
+## inputs
+
+| Argument      | type           | value / description |
+|---------------|----------------|---------------------|
+| name          | string         | The name of the role we're making.  It will be in the /service/ path in IAM
+| trusted_arns  | list(string)   | The ARNs that should be able to assume this role |
+| description   | string         | Description tied to the role |
+| bucket        | string         | The bucket that this policy should allow write access to |
+| tags          | map            | (optional) Tags to be applied
+| standard_tags | map            | (optional) Other tags to be applied from terragrunt

base/s3_bucket_writer_role/main.tf

@@ -1,8 +1,10 @@
 resource "aws_iam_role" "this" {
-  name = var.name
-  path  = "/service/"
+  name                  = var.name
+  path                  = "/service/"
   force_detach_policies = true # causes "DeleteConflict" if not present
 
+  tags = merge(var.standard_tags, var.tags)
+
   assume_role_policy = <<EOF
 {
   "Version": "2012-10-17",
@@ -20,21 +22,22 @@ EOF
 }
 
 resource "aws_iam_role_policy_attachment" "this" {
-  role = aws_iam_role.this.name
+  role       = aws_iam_role.this.name
   policy_arn = aws_iam_policy.this.arn
 }
 
 resource "aws_iam_policy" "this" {
-  name  = var.name
-  path  = "/service/"
+  name        = var.name
+  path        = "/service/"
   description = var.description
-  policy = data.aws_iam_policy_document.policy.json
+  policy      = data.aws_iam_policy_document.policy.json
+  tags        = merge(var.standard_tags, var.tags)
 }
 
 data "aws_iam_policy_document" "policy" {
   statement {
-    sid       = "ReadTheBucket"
-    effect    = "Allow"
+    sid    = "ReadTheBucket"
+    effect = "Allow"
     resources = [
       var.bucket
     ]
@@ -48,8 +51,8 @@ data "aws_iam_policy_document" "policy" {
   }
 
   statement {
-    sid       = "ModifyBucketObjects"
-    effect    = "Allow"
+    sid    = "ModifyBucketObjects"
+    effect = "Allow"
     resources = [
       "${var.bucket}/*"
     ]
@@ -63,13 +66,13 @@ data "aws_iam_policy_document" "policy" {
   }
 
   statement {
-    sid       = "RequireWritesToGiveBucketOwnerControl"
-    effect    = "Allow"
+    sid    = "RequireWritesToGiveBucketOwnerControl"
+    effect = "Allow"
     resources = [
       "${var.bucket}/*"
     ]
 
-    actions   = [
+    actions = [
       "s3:PutObject"
     ]
 

base/s3_bucket_writer_role/vars.tf

@@ -1,13 +1,17 @@
 variable "tags" {
   description = "Tags to add to the resource (in addition to global standard tags)"
   type        = map
-  default     = { }
+  default     = {}
 }
-variable "standard_tags" { type = map }
-variable "environment" { type = string }
-variable "aws_partition" { type = string }
-variable "aws_partition_alias" { type = string }
-variable "aws_account_id" { type = string }
+
+variable "standard_tags" {
+  type    = map
+  default = {}
+}
+#variable "environment" { type = string }
+#variable "aws_partition" { type = string }
+#variable "aws_partition_alias" { type = string }
+#variable "aws_account_id" { type = string }
 
 variable "name" { type = string }
 variable "trusted_arns" { type = list(string) }