Reference for the teleportmwi_aws_roles_anywhere Terraform ephemeral resource

Report an Issue

Is this page helpful?

How can we improve this page?

View as Markdown

This page describes the supported values of the teleportmwi_aws_roles_anywhere ephemeral resource of the Teleport MWI Terraform provider.

The AWS Roles Anywhere Ephemeral Resource exchanges a Teleport Workload Identity X.509 SVID for short-lived AWS session credentials that other providers can use. A Workload Identity resource must be configured in Teleport to define the SPIFFE identity used in the X.509 SVID. The identity that the teleportmwi provider assumes must have permission to use the Workload Identity resource. The IAM role, Roles Anywhere profile, and Trust Anchor must already be configured in AWS. Credentials cannot be renewed during an operation, so configure a session duration that covers the entire operation. AWS profile settings may shorten the requested duration, and the resulting duration must not exceed the IAM role's maximum session duration.

Example Usage

// https://goteleport.com/docs/machine-workload-identity/workload-identity/aws-roles-anywhere/
// Configure the Workload Identity and AWS Roles Anywhere trust relationship
// before using this resource. The identity that the teleportmwi provider assumes must have permission to use the Workload Identity resource. 
ephemeral "teleportmwi_aws_roles_anywhere" "aws_role" {
  selector = {
    name = "my-workload-identity"
  }
  role_arn         = "arn:aws:iam::123456789012:role/my-role"
  profile_arn      = "arn:aws:rolesanywhere:us-east-1:123456789012:profile/00000000-0000-0000-0000-000000000000"
  trust_anchor_arn = "arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/00000000-0000-0000-0000-000000000000"

  // Defaults to 1 hour. Credentials must remain valid for the entire operation;
  // AWS profile and IAM role settings also constrain the session duration.
  session_duration = "1h"
}

// https://registry.terraform.io/providers/hashicorp/aws/latest/docs
provider "aws" {
  region     = "us-west-2"
  access_key = ephemeral.teleportmwi_aws_roles_anywhere.aws_role.output.access_key
  secret_key = ephemeral.teleportmwi_aws_roles_anywhere.aws_role.output.secret_key
  token      = ephemeral.teleportmwi_aws_roles_anywhere.aws_role.output.token
}

data "aws_caller_identity" "current" {}

Schema

Required

• profile_arn (String) The ARN of the AWS IAM Roles Anywhere profile to use.
• role_arn (String) The ARN of the IAM role to assume.
• selector (Attributes) Selects the Workload Identity to use when issuing the X.509 SVID. (see below for nested schema)
• trust_anchor_arn (String) The ARN of the AWS IAM Roles Anywhere trust anchor to use.

Optional

• region (String) The AWS region of the Roles Anywhere endpoint. Defaults to the region in the trust anchor ARN. This is independent of the region where the AWS provider manages resources.
• session_duration (String) How long the AWS session credentials should be valid for, using Go duration syntax (for example, 30m or 1h). Defaults to 1 hour. Must be between 15 minutes and 12 hours. The AWS profile and IAM role settings also constrain the session duration.

Read-Only

• output (Attributes) (see below for nested schema)

Nested Schema for selector

Required:

• name (String) The name of the Workload Identity resource.

Nested Schema for output

Read-Only:

• access_key (String, Sensitive) Compatible with the access_key argument of the aws provider.
• secret_key (String, Sensitive) Compatible with the secret_key argument of the aws provider.
• token (String, Sensitive) Compatible with the token argument of the aws provider. Also known as the session token.