From 84151b818fc0e4a2e4b3528618b6506d913a0e3b Mon Sep 17 00:00:00 2001 From: Dave Arnold Date: Thu, 9 Jul 2026 16:06:47 -0400 Subject: [PATCH 1/3] fix(roles): use HTTPS source URLs for aws-iam-role modules Replace SSH-style git@ source with git::https:// for all three aws-iam-role module references (patch_role, patch_execution_role, patch_execproxy_role). HTTPS is required in environments where SSH agent forwarding is unavailable or not configured. --- roles.tf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/roles.tf b/roles.tf index aeccc9d..ed2f6c5 100644 --- a/roles.tf +++ b/roles.tf @@ -1,6 +1,6 @@ # patch_role — assumed by patch_execution_role to perform EC2 operations in target accounts module "patch_role" { - source = "git@github.e.it.census.gov:terraform-modules/aws-iam-role.git?ref=tf-upgrade" + source = "git::https://github.e.it.census.gov/terraform-modules/aws-iam-role.git?ref=tf-upgrade" role_name = local.patch_role_name role_description = format("Assumed by %v to execute patching operations on EC2 instances in target accounts", local.patch_execution_role_name) @@ -12,7 +12,7 @@ module "patch_role" { # patch_execution_role — assumed by Lambda functions to orchestrate patching module "patch_execution_role" { - source = "git@github.e.it.census.gov:terraform-modules/aws-iam-role.git?ref=tf-upgrade" + source = "git::https://github.e.it.census.gov/terraform-modules/aws-iam-role.git?ref=tf-upgrade" role_name = local.patch_execution_role_name role_description = format("Assumed by Lambda functions to invoke patch operations, access SQS/RDS, and assume %v in target accounts", local.patch_role_name) @@ -26,7 +26,7 @@ module "patch_execution_role" { # This instance profile is used by the EC2 host running p4proxy to authenticate # to RDS via IAM and to assume patch_execution_role for orchestration tasks. module "patch_execproxy_role" { - source = "git@github.e.it.census.gov:terraform-modules/aws-iam-role.git?ref=tf-upgrade" + source = "git::https://github.e.it.census.gov/terraform-modules/aws-iam-role.git?ref=tf-upgrade" role_name = local.patch_execproxy_role_name role_description = format("Applied to the EC2 host running p4proxy; allows RDS IAM auth and assumption of %v", local.patch_execution_role_name) From d1c161a23b040de4a0ef6679efe99dd000d61f5e Mon Sep 17 00:00:00 2001 From: Dave Arnold Date: Thu, 23 Jul 2026 13:20:31 -0400 Subject: [PATCH 2/3] fix: use static ARNs in attached_policies to avoid for_each unknown value error Terraform cannot use compute-time resource ARNs (aws_iam_policy.*.arn) as for_each set keys since they are unknown at plan time. Replace with statically constructed ARNs using locals that are always known at plan time: format("arn:%v:iam::%v:policy/%v", local.partition, local.account_id, local.) Fixes 'Invalid for_each argument' errors on all three role modules. --- roles.tf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/roles.tf b/roles.tf index ed2f6c5..836cebd 100644 --- a/roles.tf +++ b/roles.tf @@ -5,7 +5,7 @@ module "patch_role" { role_name = local.patch_role_name role_description = format("Assumed by %v to execute patching operations on EC2 instances in target accounts", local.patch_execution_role_name) assume_policy_document = data.aws_iam_policy_document.patch_role_assume.json - attached_policies = [aws_iam_policy.patch_role.arn] + attached_policies = [format("arn:%v:iam::%v:policy/%v", local.partition, local.account_id, local.patch_policy_name)] tags = local.tags_iam } @@ -17,7 +17,7 @@ module "patch_execution_role" { role_name = local.patch_execution_role_name role_description = format("Assumed by Lambda functions to invoke patch operations, access SQS/RDS, and assume %v in target accounts", local.patch_role_name) assume_policy_document = data.aws_iam_policy_document.patch_execution_role_assume.json - attached_policies = [aws_iam_policy.patch_execution_role.arn] + attached_policies = [format("arn:%v:iam::%v:policy/%v", local.partition, local.account_id, local.patch_execution_policy_name)] tags = local.tags_iam } @@ -31,7 +31,7 @@ module "patch_execproxy_role" { role_name = local.patch_execproxy_role_name role_description = format("Applied to the EC2 host running p4proxy; allows RDS IAM auth and assumption of %v", local.patch_execution_role_name) assume_policy_document = data.aws_iam_policy_document.patch_execproxy_role_assume.json - attached_policies = [aws_iam_policy.patch_execproxy_role.arn] + attached_policies = [format("arn:%v:iam::%v:policy/%v", local.partition, local.account_id, local.patch_execproxy_policy_name)] enable_instance_profile = true tags = local.tags_iam From 3a1030fca721bb2e03815e85fdf14ce6f445200f Mon Sep 17 00:00:00 2001 From: Dave Arnold Date: Thu, 23 Jul 2026 13:25:46 -0400 Subject: [PATCH 3/3] fix: convert module sources from git::https:// to git@ format per Census standards --- roles.tf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/roles.tf b/roles.tf index 836cebd..c279235 100644 --- a/roles.tf +++ b/roles.tf @@ -1,6 +1,6 @@ # patch_role — assumed by patch_execution_role to perform EC2 operations in target accounts module "patch_role" { - source = "git::https://github.e.it.census.gov/terraform-modules/aws-iam-role.git?ref=tf-upgrade" + source = "git@github.e.it.census.gov:terraform-modules/aws-iam-role.git?ref=tf-upgrade" role_name = local.patch_role_name role_description = format("Assumed by %v to execute patching operations on EC2 instances in target accounts", local.patch_execution_role_name) @@ -12,7 +12,7 @@ module "patch_role" { # patch_execution_role — assumed by Lambda functions to orchestrate patching module "patch_execution_role" { - source = "git::https://github.e.it.census.gov/terraform-modules/aws-iam-role.git?ref=tf-upgrade" + source = "git@github.e.it.census.gov:terraform-modules/aws-iam-role.git?ref=tf-upgrade" role_name = local.patch_execution_role_name role_description = format("Assumed by Lambda functions to invoke patch operations, access SQS/RDS, and assume %v in target accounts", local.patch_role_name) @@ -26,7 +26,7 @@ module "patch_execution_role" { # This instance profile is used by the EC2 host running p4proxy to authenticate # to RDS via IAM and to assume patch_execution_role for orchestration tasks. module "patch_execproxy_role" { - source = "git::https://github.e.it.census.gov/terraform-modules/aws-iam-role.git?ref=tf-upgrade" + source = "git@github.e.it.census.gov:terraform-modules/aws-iam-role.git?ref=tf-upgrade" role_name = local.patch_execproxy_role_name role_description = format("Applied to the EC2 host running p4proxy; allows RDS IAM auth and assumption of %v", local.patch_execution_role_name)