feat: added the ability to add custom conditions on the role

[gambol99]

No description provided.

[github-actions]

Pull Request Review Status

• 🖌 Terraform Format and Style: success
• 🔍 Terraform Linting: success
• 👮 Terraform Security Check: success
• 👮 Terraform Security Checkov: success
• 🔘 Terraform Tests: success
• 🔧 Terraform Initialisation: success
• 🤖 Terraform Validation: success
• 🤖 Terraform Example Validation: success
• 📖 Terraform Documentation: success
• 🔖 Commitlint: failure

Working Directory: modules/remote_state
Pusher: @gambol99, Action: pull_request
Workflow Run Link: https://github.com/appvia/terraform-aws-oidc/actions/runs/30474655161

[github-actions]

Pull Request Review Status

• 🖌 Terraform Format and Style: success
• 🔍 Terraform Linting: success
• 👮 Terraform Security Check: success
• 👮 Terraform Security Checkov: success
• 🔘 Terraform Tests: success
• 🔧 Terraform Initialisation: success
• 🤖 Terraform Validation: success
• 🤖 Terraform Example Validation: success
• 📖 Terraform Documentation: success
• 🔖 Commitlint: failure

Working Directory: modules/provider
Pusher: @gambol99, Action: pull_request
Workflow Run Link: https://github.com/appvia/terraform-aws-oidc/actions/runs/30474655161

[github-actions]

Pull Request Review Status

• 🖌 Terraform Format and Style: success
• 🔍 Terraform Linting: success
• 👮 Terraform Security Check: success
• 👮 Terraform Security Checkov: success
• 🔘 Terraform Tests: success
• 🔧 Terraform Initialisation: success
• 🤖 Terraform Validation: success
• 🤖 Terraform Example Validation: success
• 📖 Terraform Documentation: success
• 🔖 Commitlint: failure

Working Directory: modules/role
Pusher: @gambol99, Action: pull_request
Workflow Run Link: https://github.com/appvia/terraform-aws-oidc/actions/runs/30474655161

[Copilot]

Pull request overview

This PR adds a new trust_policy_conditions input to the modules/role Terraform module, allowing callers to append custom IAM trust policy conditions to all assume-role statements generated by the module (OIDC sts:AssumeRoleWithWebIdentity and Azure DevOps hub-to-spoke sts:AssumeRole).

Changes:

• Introduces trust_policy_conditions variable (with validations) to accept additional aws_iam_policy_document condition blocks.
• Applies these conditions across read-write, read-only, and state-reader trust policy documents (including hub-to-spoke assume role statements).
• Adds a dedicated Terraform test file plus updates docs and an example to demonstrate and verify behavior.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/role.trust_conditions.tftest.hcl	Adds end-to-end Terraform tests asserting custom conditions are rendered (and validated) across all roles/statements.
modules/role/variables.tf	Adds the new trust_policy_conditions input and validation rules.
modules/role/shared.tf	Appends trust_policy_conditions to state-reader trust policy statements.
modules/role/readonly.tf	Appends trust_policy_conditions to read-only trust policy statements.
modules/role/main.tf	Appends trust_policy_conditions to read-write trust policy statements.
modules/role/README.md	Documents how to use trust_policy_conditions and updates the input table.
examples/role/main.tf	Demonstrates usage of trust_policy_conditions in the example configuration.

Comments suppressed due to low confidence (1)

tests/role.trust_conditions.tftest.hcl:203

• The overridden Azure DevOps OIDC provider ARN uses arn:aws:iam::aws:oidc-provider/..., but IAM OIDC provider ARNs are account-scoped (arn:aws:iam::<account_id>:oidc-provider/...). Using a realistic ARN avoids brittle tests if future validation is added.

    values = {
      url = "https://vstoken.dev.azure.com/00000000-0000-0000-0000-000000000000"
      arn = "arn:aws:iam::aws:oidc-provider/vstoken.dev.azure.com/00000000-0000-0000-0000-000000000000"
    }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.