diff --git a/internal/activities/aws.go b/internal/activities/aws.go index 393b470..d8fb13c 100644 --- a/internal/activities/aws.go +++ b/internal/activities/aws.go @@ -504,6 +504,21 @@ func (a *AWSActivities) CreateIAMRole( } } + for _, p := range input.InlinePolicies { + if _, err = client.PutRolePolicy(ctx, &iam.PutRolePolicyInput{ + RoleName: aws.String(input.RoleName), + PolicyName: aws.String(p.Name), + PolicyDocument: aws.String(p.Document), + }); err != nil { + return "", fmt.Errorf( + "put inline policy %s on role %s: %w", + p.Name, + input.RoleName, + err, + ) + } + } + return *out.Role.Arn, nil } @@ -513,6 +528,22 @@ func (a *AWSActivities) DeleteIAMRole(ctx context.Context, input DeleteIAMRoleIn return err } + inlinePolicies, err := client.ListRolePolicies( + ctx, + &iam.ListRolePoliciesInput{RoleName: aws.String(input.RoleName)}, + ) + if err != nil { + return fmt.Errorf("list inline policies for role %s: %w", input.RoleName, err) + } + for _, name := range inlinePolicies.PolicyNames { + if _, err = client.DeleteRolePolicy(ctx, &iam.DeleteRolePolicyInput{ + RoleName: aws.String(input.RoleName), + PolicyName: aws.String(name), + }); err != nil { + return fmt.Errorf("delete inline policy %s from role %s: %w", name, input.RoleName, err) + } + } + policies, err := client.ListAttachedRolePolicies( ctx, &iam.ListAttachedRolePoliciesInput{RoleName: aws.String(input.RoleName)}, diff --git a/internal/activities/inputs.go b/internal/activities/inputs.go index 041ea47..4f90ebe 100644 --- a/internal/activities/inputs.go +++ b/internal/activities/inputs.go @@ -88,13 +88,19 @@ type DeleteVPCInput struct { VpcID string } +type InlinePolicy struct { + Name string + Document string // JSON policy document +} + type CreateIAMRoleInput struct { - RoleName string - Description string - TrustPolicy string - PolicyARNs []string - Environment string - Team string + RoleName string + Description string + TrustPolicy string + PolicyARNs []string + InlinePolicies []InlinePolicy + Environment string + Team string } type DeleteIAMRoleInput struct {