Dynamically set AWS account ID in iam script

defenseunicorns · Oct 4, 2023 · 9ca9e8b · 9ca9e8b
1 parent 7b0f9f8
commit 9ca9e8b
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 3 deletions.
diff --git a/bootstrap/iam/ecr-credential-helper-role.json b/bootstrap/iam/ecr-credential-helper-role.json
@@ -4,7 +4,7 @@
         {
             "Effect": "Allow",
             "Principal": {
-                "Federated": "arn:aws:iam::331924599099:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/{{EKS_CLUSTER_ID}}"
+                "Federated": "arn:aws:iam::{{AWS_ACCOUNT_ID}}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/{{EKS_CLUSTER_ID}}"
             },
             "Action": "sts:AssumeRoleWithWebIdentity",
             "Condition": {

diff --git a/bootstrap/iam/ecr-webhook-role.json b/bootstrap/iam/ecr-webhook-role.json
@@ -4,7 +4,7 @@
         {
             "Effect": "Allow",
             "Principal": {
-                "Federated": "arn:aws:iam::331924599099:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/{{EKS_CLUSTER_ID}}"
+                "Federated": "arn:aws:iam::{{AWS_ACCOUNT_ID}}:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/{{EKS_CLUSTER_ID}}"
             },
             "Action": "sts:AssumeRoleWithWebIdentity",
             "Condition": {

diff --git a/bootstrap/iam/iam.sh b/bootstrap/iam/iam.sh
@@ -7,18 +7,24 @@ create() {
         exit 1
     fi
 
+    # Fetch AWS account ID
+    AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query 'Account' --output text)
+
     # Fetch the EKS Cluster ID
     EKS_CLUSTER_ID=$(aws eks describe-cluster --name "$2" --query "cluster.identity.oidc.issuer" --output text | cut -d '/' -f 5)
     if [ -z "$EKS_CLUSTER_ID" ]; then
         echo "Failed to fetch EKS cluster OIDC provider ID. Please ensure you provided the correct cluster name"
         exit 1
     fi
 
-    # Replace the placeholder in the JSON files with the EKS Cluster ID
+    # Replace the placeholder in the JSON files with the AWS account ID and EKS cluster ID
     SED_CMD="sed"
     if [ "$(uname -s)" = "Darwin" ]; then
         SED_CMD="gsed"
     fi
+    "$SED_CMD" -i "s/{{AWS_ACCOUNT_ID}}/$AWS_ACCOUNT_ID/g" ecr-webhook-role.json
+    "$SED_CMD" -i "s/{{AWS_ACCOUNT_ID}}/$AWS_ACCOUNT_ID/g" ecr-credential-helper-role.json
+
     "$SED_CMD" -i "s/{{EKS_CLUSTER_ID}}/$EKS_CLUSTER_ID/g" ecr-webhook-role.json
     "$SED_CMD" -i "s/{{EKS_CLUSTER_ID}}/$EKS_CLUSTER_ID/g" ecr-credential-helper-role.json