Terraform cross account additions of AWS organizational root account

10-acme.tf

data "aws_iam_policy_document" "acme_crossaccount_administrator" {
  statement {
    sid = "acme"
    actions = ["sts:AssumeRole"]
    resources = [
      "${aws_iam_role.acme_operations_administrator.arn}",
    ]
  }

  provider = "aws.acme"
}

resource "aws_iam_policy" "acme_crossaccount_administrator" {
  name = "AdministratorCrossAccountAccess"
  policy = "${data.aws_iam_policy_document.acme_crossaccount_administrator.json}"
  provider = "aws.acme"
}

resource "aws_iam_role_policy_attachment" "acme_crossaccount_administrator" {
  role = "${aws_iam_role.acme_administrator.name}"
  policy_arn = "${aws_iam_policy.acme_crossaccount_administrator.arn}"
  provider = "aws.acme"
}

data "aws_iam_policy_document" "acme_crossaccount_developer" {
  statement {
    sid = "acme"
    actions = ["sts:AssumeRole"]
    resources = [
      "${aws_iam_role.acme_operations_developer.arn}",
    ]
  }

  provider = "aws.acme"
}

resource "aws_iam_policy" "acme_crossaccount_developer" {
  name = "DeveloperCrossAccountAccess"
  policy = "${data.aws_iam_policy_document.acme_crossaccount_developer.json}"
  provider = "aws.acme"
}

resource "aws_iam_role_policy_attachment" "acme_crossaccount_developer" {
  role = "${aws_iam_role.acme_developer.name}"
  policy_arn = "${aws_iam_policy.acme_crossaccount_developer.arn}"
  provider = "aws.acme"
}

data "aws_iam_policy_document" "acme_crossaccount_billing" {
  statement {
    sid = "acme"
    actions = ["sts:AssumeRole"]
    resources = [
      "${aws_iam_role.acme_operations_billing.arn}",
    ]
  }

  provider = "aws.acme"
}

resource "aws_iam_policy" "acme_crossaccount_billing" {
  name = "BillingCrossAccountAccess"
  policy = "${data.aws_iam_policy_document.acme_crossaccount_billing.json}"
  provider = "aws.acme"
}

resource "aws_iam_role_policy_attachment" "acme_crossaccount_billing" {
  role = "${aws_iam_role.acme_billing.name}"
  policy_arn = "${aws_iam_policy.acme_crossaccount_billing.arn}"
  provider = "aws.acme"
}