fix: create irsa without iam_role_arns or iam_authorizing_role_arns

msvticket · web-flow · commit 3647c58e10a7 · 2025-10-21T16:23:31.000+02:00
diff --git a/main.tf b/main.tf
@@ -95,7 +95,7 @@ resource "aws_iam_role" "elasticsearch_user" {
 }
 
 data "aws_iam_policy_document" "assume_role" {
-  count = module.this.enabled && var.create_elasticsearch_user_role && (length(var.iam_authorizing_role_arns) > 0 || length(var.iam_role_arns) > 0) ? 1 : 0
+  count = module.this.enabled && var.create_elasticsearch_user_role && (length(var.iam_authorizing_role_arns) > 0 || length(var.iam_role_arns) > 0 || var.iam_irsa_openid_connect_provider_arn != "") ? 1 : 0
 
   statement {
     actions = [

Original file line number	Diff line number	Diff line change
`@@ -95,7 +95,7 @@ resource "aws_iam_role" "elasticsearch_user" {`
`95`	`95`	`}`
`96`	`96`
`97`	`97`	`data "aws_iam_policy_document" "assume_role" {`
`98`		`- count = module.this.enabled && var.create_elasticsearch_user_role && (length(var.iam_authorizing_role_arns) > 0 \|\| length(var.iam_role_arns) > 0) ? 1 : 0`
	`98`	`+ count = module.this.enabled && var.create_elasticsearch_user_role && (length(var.iam_authorizing_role_arns) > 0 \|\| length(var.iam_role_arns) > 0 \|\| var.iam_irsa_openid_connect_provider_arn != "") ? 1 : 0`
`99`	`99`
`100`	`100`	`statement {`
`101`	`101`	`actions = [`