example_2.tf

resource "aws_iam_role" "example_2_role" {
  assume_role_policy = jsonencode(
    {
      Statement = [
        {
          Effect = "Allow"
          Action = "sts:AssumeRole"
          Principal = {
            AWS = "arn:aws:iam::111222333444:root" # SNYK-CC-TF-118 violation due to "arn:aws:iam::111222333444:root"
          }
        },
        {
          Effect = "Allow"
          Action = "sts:AssumeRoleWithWebIdentity"
          Principal = {
            Federated = "arn:aws:iam::111222333444:oidc-provider/oidc.eks.us-west-2.amazonaws.com/id/FOO"
          }
          Condition = {
            StringLike = {
              "oidc.eks.us-west-2.amazonaws.com/id/FOO:aud" = "sts.amazonaws.com"
              "oidc.eks.us-west-2.amazonaws.com/id/FOO:sub" = "system:serviceaccount:*:*" # This allows any Kubernetes Service Account in any Kubernetes Namespace in EKS Cluster ID `FOO` to assume `example_role`
            }
          }

        }
      ]
      Version = "2012-10-17"
    }
  )
  managed_policy_arns = []
}