Merge pull request #8 from egarbi/master

Enhance retrieving of elb_account in s3_logs module

Author: webyneter

main.tf

@@ -235,7 +235,6 @@ module "s3_logs" {
   source                  = "./s3-logs"
   name                    = "${var.name}"
   environment             = "${var.environment}"
-  account_id              = "${module.defaults.s3_logs_account_id}"
   logs_expiration_enabled = "${var.logs_expiration_enabled}"
   logs_expiration_days    = "${var.logs_expiration_days}"
 }

s3-logs/main.tf

@@ -4,9 +4,6 @@ variable "name" {
 variable "environment" {
 }
 
-variable "account_id" {
-}
-
 variable "logs_expiration_enabled" {
   default = false
 }
@@ -15,12 +12,14 @@ variable "logs_expiration_days" {
   default = 30
 }
 
+data "aws_elb_service_account" "main" {}
+
 data "template_file" "policy" {
   template = "${file("${path.module}/policy.json")}"
 
   vars = {
     bucket     = "${var.name}-${var.environment}-logs"
-    account_id = "${var.account_id}"
+    elb_account_id = "${data.aws_elb_service_account.main.arn}"
   }
 }
 

s3-logs/policy.json

@@ -5,7 +5,7 @@
       "Action": "s3:PutObject",
       "Effect": "Allow",
       "Principal": {
-        "AWS": "arn:aws:iam::${account_id}:root"
+        "AWS": "${elb_account_id}"
       },
       "Resource": "arn:aws:s3:::${bucket}/*",
       "Sid": "log-bucket-policy"