Add IAM policy to allow Brainstore to assume export roles with bt:* ExternalId

main.tf

@@ -310,6 +310,7 @@ module "services_common" {
   lambda_responses_s3_bucket_arn            = module.storage.lambda_responses_bucket_arn
   service_additional_policy_arns            = var.service_additional_policy_arns
   brainstore_additional_policy_arns         = var.brainstore_additional_policy_arns
+  brainstore_enable_export                  = var.brainstore_enable_export
   permissions_boundary_arn                  = var.permissions_boundary_arn
   eks_cluster_arn                           = var.existing_eks_cluster_arn
   eks_namespace                             = var.eks_namespace

modules/services-common/iam-api.tf

@@ -66,6 +66,10 @@ resource "aws_iam_role" "api_handler_role" {
   permissions_boundary = var.permissions_boundary_arn
 
   tags = local.common_tags
+
+  lifecycle {
+    ignore_changes = [name]
+  }
 }
 
 resource "aws_iam_role_policy_attachment" "api_handler_policy" {

modules/services-common/iam-brainstore.tf

@@ -69,6 +69,10 @@ resource "aws_iam_role" "brainstore_role" {
   tags = merge({
     Name = "${var.deployment_name}-brainstore-ec2-role"
   }, local.common_tags)
+
+  lifecycle {
+    ignore_changes = [name]
+  }
 }
 
 resource "aws_iam_role_policy" "brainstore_s3_access" {
@@ -125,6 +129,29 @@ resource "aws_iam_role_policy" "brainstore_secrets_access" {
   })
 }
 
+resource "aws_iam_role_policy" "brainstore_export_assume_role" {
+  count = var.brainstore_enable_export ? 1 : 0
+
+  name = "export-assume-role"
+  role = aws_iam_role.brainstore_role.id
+
+  policy = jsonencode({ # nosemgrep
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action   = "sts:AssumeRole"
+        Effect   = "Allow"
+        Resource = "*"
+        Condition = {
+          StringLike = {
+            "sts:ExternalId" = "bt:*"
+          }
+        }
+      }
+    ]
+  })
+}
+
 resource "aws_iam_role_policy" "brainstore_cloudwatch_metrics" {
   name = "cloudwatch-agent-metrics"
   role = aws_iam_role.brainstore_role.id

modules/services-common/variables.tf

@@ -75,6 +75,12 @@ variable "brainstore_additional_policy_arns" {
   default     = []
 }
 
+variable "brainstore_enable_export" {
+  type        = bool
+  description = "Enable Brainstore-based export IAM permissions."
+  default     = false
+}
+
 variable "enable_brainstore_ec2_ssm" {
   description = "Optional. true will enable ssm (session manager) for the brainstore EC2s. Helpful for debugging without changing firewall rules"
   type        = bool