CCM-22816: Additional Lambda Role Trust

infrastructure/terraform/modules/lambda/README.md

@@ -30,6 +30,7 @@ output "processor_lambda_error_rate_alarm_arn" {
 
 | Name | Description | Type | Default | Required |
 | ---- | ----------- | ---- | ------- | :------: |
+| <a name="input_additional_assume_role_policy_statements"></a> [additional\_assume\_role\_policy\_statements](#input\_additional\_assume\_role\_policy\_statements) | Additional IAM policy statements to attach to the Lambda execution role | <pre>list(object({<br/>    sid    = string<br/>    effect = string<br/>    principal = object({<br/>      type        = string<br/>      identifiers = list(string)<br/>    })<br/>    condition = optional(list(object({<br/>      test     = string<br/>      variable = string<br/>      values   = list(string)<br/>    })))<br/>  }))</pre> | `[]` | no |
 | <a name="input_application_log_level"></a> [application\_log\_level](#input\_application\_log\_level) | The detail level of the logs the application sends to CloudWatch | `string` | `"INFO"` | no |
 | <a name="input_aws_account_id"></a> [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes |
 | <a name="input_component"></a> [component](#input\_component) | The name of the tfscaffold component | `string` | n/a | yes |

infrastructure/terraform/modules/lambda/data_iam_policy_document_lambda_assumerole.tf

@@ -16,4 +16,31 @@ data "aws_iam_policy_document" "lambda_assumerole" {
       "sts:AssumeRole",
     ]
   }
+
+  dynamic "statement" {
+    for_each = var.additional_assume_role_policy_statements
+
+    content {
+      sid    = statement.value.sid
+      effect = statement.value.effect
+
+      principals {
+        type        = statement.value.principal.type
+        identifiers = statement.value.principal.identifiers
+      }
+
+      actions = [
+        "sts:AssumeRole",
+      ]
+      dynamic "condition" {
+        for_each = statement.value.condition
+
+        content {
+          test     = condition.value.test
+          variable = condition.value.variable
+          values   = condition.value.values
+        }
+      }
+    }
+  }
 }

infrastructure/terraform/modules/lambda/variables.tf

@@ -400,3 +400,21 @@ variable "reserved_concurrent_executions" {
   description = "The reserved concurrency for the Lambda function. Set to -1 to remove the concurrency limit, or 0 to prevent the Lambda from being invoked."
   default     = -1
 }
+
+variable "additional_assume_role_policy_statements" {
+  type = list(object({
+    sid    = string
+    effect = string
+    principal = object({
+      type        = string
+      identifiers = list(string)
+    })
+    condition = optional(list(object({
+      test     = string
+      variable = string
+      values   = list(string)
+    })))
+  }))
+  description = "Additional IAM policy statements to attach to the Lambda execution role"
+  default     = []
+}