Skip to content

Commit beea51d

Browse files
Kqirkkirkchongkayman-mk
authored
fix: remove leading / from SSM parameter names in policy ARNs (#1146)
## Description Using SSM parameter hierarchies (as described in https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-hierarchies.html) results in an error. See #1128 Several workarounds exist, but using `trimprefix` makes them superfluous. Having a `/` as first character results in the above mentioned error. ## Verification Checked the ARN of parameter `/test/test`. It showed up as `arn:aws:ssm:eu-central-1:123456789012:parameter/test/test` in the console. So no `//` at first place. --------- Co-authored-by: kirkchong <[email protected]> Co-authored-by: Matthias Kay <[email protected]> Co-authored-by: Matthias Kay <[email protected]>
1 parent 13276ac commit beea51d

File tree

2 files changed

+3
-2
lines changed

2 files changed

+3
-2
lines changed

.cspell.json

+1
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@
5555
"tfvars",
5656
"tmpfs",
5757
"tonumber",
58+
"trimprefix",
5859
"trivy",
5960
"userns",
6061
"xanzy",

main.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -615,14 +615,14 @@ data "aws_iam_policy_document" "ssm" {
615615
var.runner_gitlab.preregistered_runner_token_ssm_parameter_name,
616616
aws_ssm_parameter.runner_registration_token.name
617617
]
618-
) : "arn:${data.aws_partition.current.partition}:ssm:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:parameter/${name}"
618+
) : "arn:${data.aws_partition.current.partition}:ssm:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:parameter/${trimprefix(name, "/")}"
619619
]
620620
}
621621

622622
statement {
623623
actions = ["ssm:PutParameter"]
624624
resources = [
625-
"arn:${data.aws_partition.current.partition}:ssm:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:parameter/${aws_ssm_parameter.runner_registration_token.name}"
625+
"arn:${data.aws_partition.current.partition}:ssm:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:parameter/${trimprefix(aws_ssm_parameter.runner_registration_token.name, "/")}"
626626
]
627627
}
628628
}

0 commit comments

Comments
 (0)