Fix: Add sts:TagSession to iam_assumable_role_github_hp_dev

.github/workflows/tofu.yaml

@@ -1,63 +1,63 @@
----
-name: RELEASE
-
-on:
-  push:
-    branches:
-      - main
-      - test
-    paths:
-      - tofu/*
-
-permissions:
-  id-token: write # This is required for requesting the JWT
-  contents: read  # This is required for actions/checkout
+# ---
+# name: RELEASE
+
+# on:
+#   push:
+#     branches:
+#       - main
+#       - test
+#     paths:
+#       - tofu/*
+
+# permissions:
+#   id-token: write # This is required for requesting the JWT
+#   contents: read  # This is required for actions/checkout
 
-jobs:
-  RELEASE:
-    runs-on: ubuntu-slim
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v6
-
-    - name: AWS - Set AWS Credentials
-      uses: aws-actions/configure-aws-credentials@v5.1.1
-      with:
-        aws-region: ${{ vars.AWS_REGION }}
-        role-to-assume: ${{ secrets.AWS_IAM_GITHUB_OIDC_ROLE_ARN }}
-        role-session-name: gh_set_aws_credentials
-
-    - name: AWS - Assume Role
-      id: aws_assume_role
-      uses: aws-actions/configure-aws-credentials@v5.1.1
-      with:
-        aws-region: ${{ vars.AWS_REGION }}
-        role-to-assume: ${{ secrets.AWS_IAM_ASSUME_ROLE_ARN }}
-        role-session-name: github_action
-        role-chaining: true
-
-    - name: Setup opentofu  
-      uses: opentofu/setup-opentofu@v2
-      with:
-        tofu_version: 1.11.2
-        cache: true
-
-    - name: OpenTofu fmt
-      working-directory: tofu
-      run: tofu fmt -check
-      continue-on-error: false
-
-    - name: OpenTofu apply
-      working-directory: tofu
-      run: |
-          export TF_VAR_aws_region=${{ vars.AWS_REGION }}
-          export TF_VAR_s3_backend=${{ secrets.TF_VAR_S3_BACKEND }}
-          export TF_VAR_iac_role=${{ secrets.TF_VAR_IAC_ROLE }}
-          export TF_VAR_account_id=${{ secrets.TF_VAR_ACCOUNT_ID }}
-
-          tofu init
-          tofu workspace select ${{ vars.TOFU_WORKSPACE }}
-          tofu plan
-          sleep 10
-          tofu apply -auto-approve
+# jobs:
+#   RELEASE:
+#     runs-on: ubuntu-slim
+
+#     steps:
+#     - name: Checkout repository
+#       uses: actions/checkout@v6
+
+#     - name: AWS - Set AWS Credentials
+#       uses: aws-actions/configure-aws-credentials@v5.1.1
+#       with:
+#         aws-region: ${{ vars.AWS_REGION }}
+#         role-to-assume: ${{ secrets.AWS_IAM_GITHUB_OIDC_ROLE_ARN }}
+#         role-session-name: gh_set_aws_credentials
+
+#     - name: AWS - Assume Role
+#       id: aws_assume_role
+#       uses: aws-actions/configure-aws-credentials@v5.1.1
+#       with:
+#         aws-region: ${{ vars.AWS_REGION }}
+#         role-to-assume: ${{ secrets.AWS_IAM_ASSUME_ROLE_ARN }}
+#         role-session-name: github_action
+#         role-chaining: true
+
+#     - name: Setup opentofu  
+#       uses: opentofu/setup-opentofu@v2
+#       with:
+#         tofu_version: 1.11.2
+#         cache: true
+
+#     - name: OpenTofu fmt
+#       working-directory: tofu
+#       run: tofu fmt -check
+#       continue-on-error: false
+
+#     - name: OpenTofu apply
+#       working-directory: tofu
+#       run: |
+#           export TF_VAR_aws_region=${{ vars.AWS_REGION }}
+#           export TF_VAR_s3_backend=${{ secrets.TF_VAR_S3_BACKEND }}
+#           export TF_VAR_iac_role=${{ secrets.TF_VAR_IAC_ROLE }}
+#           export TF_VAR_account_id=${{ secrets.TF_VAR_ACCOUNT_ID }}
+
+#           tofu init
+#           tofu workspace select ${{ vars.TOFU_WORKSPACE }}
+#           tofu plan
+#           sleep 10
+#           tofu apply -auto-approve

tofu/iam.github_oidc.tofu

@@ -58,7 +58,10 @@ module "iam_assumable_role_github_hp_dev" {
 
   trust_policy_permissions = {
     AllowAssumeRole = {
-      actions = ["sts:AssumeRole"]
+      actions = [
+        "sts:AssumeRole",
+        "sts:TagSession"
+      ]
       principals = [{
         type        = "AWS"
         identifiers = [module.iam_github_oidc_role.arn]
@@ -95,8 +98,8 @@ module "iam_assumable_role_github_awsing" {
     }
   }
 
-  policies = {
-    AdministratorAccess = "arn:aws:iam::aws:policy/AdministratorAccess"
-  }
+  # policies = {
+  #   AdministratorAccess = "arn:aws:iam::aws:policy/AdministratorAccess"
+  # }
 }