gruntwork-io/terragrunt-infrastructure-live-example

[Question] How do I set different iam_role for prod and non-prod folders ?

Opened this issue · 3 comments

robertomoutinho commented

How do I set different iam_role for prod and non-prod folders?

considering this PR from 2018 => https://github.com/gruntwork-io/terragrunt/pull/599/files#diff-04c6e90faac2675aa89e2176d2eec7d8 it seems that I can configure a specific iam_role to be used by terragrunt (and terraform).

My goal is to have a CI/CD (Atlantis) to assume roles when executing the terragrunt command.

How can I set up one role for non-prod folder and a different one for the prod folder?

brikis98 commented

There are a number of options, including:

  1. Have a different root prod/terragrunt.hcl and non-prod/terragrunt.hcl, each with different iam_role setting, that all the child modules include.
  2. Have a single root terragrunt.hcl that uses generate to generate a provider block with an assume_role block within. The assume_role block can set role_arn to a variable, which in prod envs you set to a different value than non-prod envs.
  • 👍1
nilsdebruin commented

To add another option:

I am making use of direnv (https://direnv.net) for which I create .envrc files in the different account folders. This is what I include:
export TERRAGRUNT_IAM_ROLE=arn:aws:iam::ACCOUNTID:role/ROLE and other env variables as needed.

I am then able to go into the directory with the right role assumed and then being able to run Terragrunt.

  • 👍1
nilsdebruin commented

Based on the input of @brikis98, I have created an example for option 2, see:

https://github.com/nilsdebruin/terragrunt-infrastructure-live-example/tree/assumed-role-example

If it is interesting enough, I could create a pull request for it.

  • 👍5