This message was deleted.
# atlantis-communitys
Slackbot
11/14/2023, 8:54 PMThis message was deleted.
j
Justin S
11/15/2023, 12:43 PMwe did ours in a few minutes.
Deployed a new atlantis instance, moved dns, destroyed old one
c
Chastity Blackwell
11/15/2023, 2:27 PMJust seems like there's a lot of moving parts there. And the new module doesn't look like it has a way to add additional trusted entities to the Atlantis role? (We have the prod instance assume the nonprod role to make some cross-account root changes)
j
Justin S
11/15/2023, 2:28 PMwe assume roles as well
Justin S
11/15/2023, 2:29 PM Copy code
service = {
cpu = 2048
memory = 4096
enable_ephemeral_storage = false
tasks_iam_role_policies = {
assume = aws_iam_policy.assume_policy.arn
}
}Justin S
11/15/2023, 2:29 PM Copy code
resource "aws_iam_policy" "assume_policy" {
name = "atlantis_assume"
policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Action = "sts:AssumeRole"
Effect = "Allow"
Sid = "DNS"
Resource = [
"arn:aws:iam::xxx:role/terraform_infra"
]
},
{
Action = "sts:AssumeRole"
Effect = "Allow"
Sid = "PROD"
Resource = [
"arn:aws:iam::xxx:role/terraform_infra"
]
},
{
Action = "sts:AssumeRole"
Effect = "Allow"
Sid = "DEV"
Resource = [
"arn:aws:iam::xxx:role/terraform_infra"
]
},
]
})
}c
Chastity Blackwell
11/15/2023, 2:30 PMAh...hrm. When I was looking at the ECS service module it looked like the task role had a hardcoded assume policy, I'll have to take another look. Thanks!