🩻 Add AWS X-Ray (#5)

Signed-off-by: Jacob Woffenden <jacob.woffenden@digital.justice.gov.uk>
ministryofjustice · Dec 19, 2023 · 0ec3ddc · 0ec3ddc
1 parent 48c76c5
commit 0ec3ddc
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 1 deletion.
diff --git a/main.tf b/main.tf
@@ -20,3 +20,10 @@ resource "aws_iam_role_policy_attachment" "cloudwatch_readonly_access" {
   role       = aws_iam_role.this.name
   policy_arn = "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess"
 }
+
+resource "aws_iam_role_policy_attachment" "xray_readonly_access" {
+  count = var.enable_xray ? 1 : 0
+
+  role       = aws_iam_role.this.name
+  policy_arn = "arn:aws:iam::aws:policy/AWSXrayReadOnlyAccess"
+}
diff --git a/variables.tf b/variables.tf
@@ -9,8 +9,14 @@ variable "observability_platform_account_id" {
   description = "Account ID of the Observability Platform environment. If you are running on Modernisation Platform you can use 'local.environment_management.account_ids[\"observability-platform-production\"]"
 }
 
+variable "enable_xray" {
+  type        = bool
+  description = "Enable AWS X-Ray's read only managed policy"
+  default     = false
+}
+
 variable "tags" {
   type        = map(string)
-  default     = {}
   description = "Tags to apply to resources"
+  default     = {}
 }