ssm_designated_aws_account.tf

gistfile1.txt

provider "aws" {
  region = "your_aws_region"
}

data "aws_caller_identity" "current" {}

resource "aws_iam_policy" "ssm_access_policy" {
  name        = "SSMAccessPolicy"
  description = "Policy for AWS SSO role to access AWS Systems Manager"

  policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Effect = "Allow",
        Action = [
          "ssm:DescribeAssociation",
          "ssm:DescribeDocument",
          "ssm:GetParameter",
          "ssm:ListAssociations",
          "ssm:ListCommandInvocations",
          "ssm:ListCommands",
          "ssm:SendCommand",
          "ssm:ListDocuments",
          "ssm:ListTagsForResource",
          "ssm:StartAutomationExecution",
        ],
        Resource = "*",
        Condition = {
          StringEquals = {
            "aws:PrincipalAccount" : "designated_account_id"
          }
        },
      },
    ],
  })
}

resource "aws_iam_role" "aws_sso_role" {
  name = "AWSSSORole"

  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Effect = "Allow",
        Principal = {
          Service = "sso.amazonaws.com",
        },
        Action = "sts:AssumeRole",
      },
    ],
  })
}

resource "aws_iam_role_policy_attachment" "ssm_access_attachment" {
  policy_arn = aws_iam_policy.ssm_access_policy.arn
  role       = aws_iam_role.aws_sso_role.name
}

output "role_arn" {
  value = aws_iam_role.aws_sso_role.arn
}