Enable max session duration adjustment on tasks role

Author: savagete2860

README.md

@@ -226,8 +226,10 @@ module "ecs" {
  }
  }
 
- tasks_iam_role_name = "${local.name}-tasks"
- tasks_iam_role_description = "Example tasks IAM role for ${local.name}"
+ tasks_iam_role_name = "${local.name}-tasks"
+ tasks_iam_role_description = "Example tasks IAM role for ${local.name}"
+ tasks_iam_role_max_session_duration = 7200
+
  tasks_iam_role_policies = {
  ReadOnlyAccess = "arn:aws:iam::aws:policy/ReadOnlyAccess"
  }

examples/complete/main.tf

@@ -158,6 +158,7 @@ module "service" {
  tasks_iam_role_tags = each.value.tasks_iam_role_tags
  tasks_iam_role_policies = each.value.tasks_iam_role_policies
  tasks_iam_role_statements = each.value.tasks_iam_role_statements
+ tasks_iam_role_max_session_duration = each.value.tasks_iam_role_max_session_duration
 
  # Task set
  external_id = each.value.external_id

main.tf

@@ -331,6 +331,7 @@ module "ecs_service" {
 | <a name="input_task_tags"></a> [task\_tags](#input\_task\_tags) | A map of additional tags to add to the task definition/set created | `map(string)` | `{}` | no |
 | <a name="input_tasks_iam_role_arn"></a> [tasks\_iam\_role\_arn](#input\_tasks\_iam\_role\_arn) | Existing IAM role ARN | `string` | `null` | no |
 | <a name="input_tasks_iam_role_description"></a> [tasks\_iam\_role\_description](#input\_tasks\_iam\_role\_description) | Description of the role | `string` | `null` | no |
+| <a name="input_tasks_iam_role_max_session_duration"></a> [tasks\_iam\_role\_max\_session\_duration](#input\_tasks\_iam\_role\_max\_session\_duration) | Maximum session duration (in seconds) for ECS tasks role. Default is 3600. | `number` | `null` | no |
 | <a name="input_tasks_iam_role_name"></a> [tasks\_iam\_role\_name](#input\_tasks\_iam\_role\_name) | Name to use on IAM role created | `string` | `null` | no |
 | <a name="input_tasks_iam_role_path"></a> [tasks\_iam\_role\_path](#input\_tasks\_iam\_role\_path) | IAM role path | `string` | `null` | no |
 | <a name="input_tasks_iam_role_permissions_boundary"></a> [tasks\_iam\_role\_permissions\_boundary](#input\_tasks\_iam\_role\_permissions\_boundary) | ARN of the policy that is used to set the permissions boundary for the IAM role | `string` | `null` | no |

modules/service/README.md

@@ -1247,6 +1247,7 @@ resource "aws_iam_role" "tasks" {
  description = var.tasks_iam_role_description
 
  assume_role_policy = data.aws_iam_policy_document.tasks_assume[0].json
+ max_session_duration = var.tasks_iam_role_max_session_duration
  permissions_boundary = var.tasks_iam_role_permissions_boundary
  force_detach_policies = true
 

modules/service/main.tf

@@ -977,6 +977,12 @@ variable "tasks_iam_role_statements" {
  default = null
 }
 
+variable "tasks_iam_role_max_session_duration" {
+ description = "Maximum session duration (in seconds) for ECS tasks role. Default is 3600."
+ type = number
+ default = null
+}
+
 ################################################################################
 # Task Set
 ################################################################################

modules/service/variables.tf

@@ -690,6 +690,7 @@ variable "services" {
  tasks_iam_role_permissions_boundary = optional(string)
  tasks_iam_role_tags = optional(map(string))
  tasks_iam_role_policies = optional(map(string))
+ tasks_iam_role_max_session_duration = optional(number)
  tasks_iam_role_statements = optional(list(object({
  sid = optional(string)
  actions = optional(list(string))

variables.tf

@@ -127,6 +127,7 @@ module "wrapper" {
  task_tags = try(each.value.task_tags, var.defaults.task_tags, {})
  tasks_iam_role_arn = try(each.value.tasks_iam_role_arn, var.defaults.tasks_iam_role_arn, null)
  tasks_iam_role_description = try(each.value.tasks_iam_role_description, var.defaults.tasks_iam_role_description, null)
+ tasks_iam_role_max_session_duration = try(each.value.tasks_iam_role_max_session_duration, var.defaults.tasks_iam_role_max_session_duration, null)
  tasks_iam_role_name = try(each.value.tasks_iam_role_name, var.defaults.tasks_iam_role_name, null)
  tasks_iam_role_path = try(each.value.tasks_iam_role_path, var.defaults.tasks_iam_role_path, null)
  tasks_iam_role_permissions_boundary = try(each.value.tasks_iam_role_permissions_boundary, var.defaults.tasks_iam_role_permissions_boundary, null)