Skip to content
GantryCD Provider

gantrycd_aws_cloud_integration (Resource)

A GantryCD stack’s AWS access: the IAM roles the runner assumes for it, each selected in OpenTofu by profile name. Non-exclusive by default so multiple resources can manage disjoint roles on the same stack; set exclusive = true to own the whole set.

Example Usage

resource "gantrycd_stack" "payments" {
  name              = "payments-production"
  repository_url    = "https://github.com/example/infrastructure"
  working_directory = "/payments"
  branch            = "main"
  opentofu_version  = "1.11.0"
}

# Each role's name is the AWS profile the stack's OpenTofu selects it by; a
# role named "default" backs a bare `provider "aws" {}`.
resource "gantrycd_aws_cloud_integration" "payments" {
  stack_id = gantrycd_stack.payments.id

  # Authoritative over the stack's whole role set. Leave it false (the default)
  # to let another resource contribute roles to the same stack.
  exclusive = true

  role {
    name     = "default"
    role_arn = "arn:aws:iam::123456789012:role/gantrycd-stack-payments"
  }

  # Selected with `provider "aws" { profile = "network" }`. The inline policy
  # narrows the role to its intersection with the policy.
  role {
    name     = "network"
    role_arn = "arn:aws:iam::444455556666:role/gantrycd-network-reader"

    aws_inline_policy = jsonencode({
      Version = "2012-10-17"
      Statement = [{
        Effect   = "Allow"
        Action   = ["ec2:Describe*"]
        Resource = "*"
      }]
    })
  }
}

Schema

Required

  • stack_id (String) Stack whose AWS roles this resource manages.

Optional

  • exclusive (Boolean) When true this resource owns the stack’s whole AWS role list: any role it does not declare is removed on apply. When false (default) it manages only the roles it declares and merges them with the rest.
  • role (Block List) One IAM role the runner assumes for this stack — typically one per AWS account the stack reaches. Order carries no meaning to GantryCD; it is a list only so that editing a role shows as an in-place change to that block rather than as one role removed and another added. (see below for nested schema)

Read-Only

  • id (String) Equals stack_id. Used as the Terraform import id.
  • identity_realm (String) Identity realm inherited from the configured provider.

Nested Schema for role

Required:

  • name (String) Handle the stack’s OpenTofu selects this role by — it becomes the AWS profile name, so provider “aws” { profile = “network” } picks up the role named “network”. A role named “default” is what a bare provider “aws” {} block uses. Must be unique within the stack’s AWS integration.
  • role_arn (String) IAM role ARN the runner will sts:AssumeRole into.

Optional:

  • aws_inline_policy (String) Optional inline IAM session policy (raw JSON) applied when the runner assumes role_arn. It can only narrow the role to the intersection of the two, never expand it, so a broad role can be shared across stacks and scoped per role. Must be a valid IAM policy document and at most 2048 characters when minified. JSON is compared semantically, so whitespace/key-order changes don’t produce a diff.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

# Import by stack id. The imported resource is marked exclusive = true so the
# first plan shows every role currently on the stack.
terraform import gantrycd_aws_cloud_integration.payments stk_01HXXXXXXXXXXXXXXXXXXXXXXX