Separate out iam:PassRole statements

[dms1981]

A reference to the issue / Description of it

#7907

How does this PR fix the problem?

Prior to implementing any controls or conditions, this PR separates out the iam:PassRole permission into separate statements in line with AWS documented practice.

How has this been tested?

Tested through CI pipelines; no practical impact from this PR.

Deployment Plan / Instructions

Deploy through CI

Checklist (check x in [ ] of list items)

• I have performed a self-review of my own code
• All checks have passed
• I have made corresponding changes to the documentation
• Plan and discussed how it should be deployed to PROD (If needed)

Additional comments (if any)

{Please write here}

[github-actions]

Trivy Scan Success

Show Output

```hcl

---

Trivy will check the following folders:
terraform/environments/bootstrap/member-bootstrap
terraform/environments/bootstrap/single-sign-on

---

Running Trivy in terraform/environments/bootstrap/member-bootstrap
2024-11-01T15:47:50Z INFO [vulndb] Need to update DB
2024-11-01T15:47:50Z INFO [vulndb] Downloading vulnerability DB...
2024-11-01T15:47:50Z INFO [vulndb] Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-01T15:47:52Z INFO [vulndb] Artifact successfully downloaded repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-01T15:47:52Z INFO [vuln] Vulnerability scanning is enabled
2024-11-01T15:47:52Z INFO [misconfig] Misconfiguration scanning is enabled
2024-11-01T15:47:52Z INFO [misconfig] Need to update the built-in checks
2024-11-01T15:47:52Z INFO [misconfig] Downloading the built-in checks...
160.60 KiB / 160.60 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-11-01T15:47:53Z INFO [secret] Secret scanning is enabled
2024-11-01T15:47:53Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-01T15:47:53Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-11-01T15:47:53Z INFO [terraform scanner] Scanning root module file_path="."
2024-11-01T15:47:55Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-01T15:47:55Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-01T15:47:55Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-01T15:47:55Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-01T15:47:55Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-01T15:47:55Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-01T15:47:55Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-roles: no such file or directory"
2024-11-01T15:47:55Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-01T15:47:55Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-01T15:47:55Z ERROR [terraform evaluator] Failed to load module. Maybe try 'terraform init'? err="open modules/iam-assumable-role: no such file or directory"
2024-11-01T15:47:57Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="module.pagerduty_core_alerts[0].data.aws_sns_topic.alarm_topics" value="cty.NilVal"
2024-11-01T15:47:58Z INFO Number of language-specific files num=0
2024-11-01T15:47:58Z INFO Detected config files num=3
trivy_exitcode=0

---

Running Trivy in terraform/environments/bootstrap/single-sign-on
2024-11-01T15:47:58Z INFO [vuln] Vulnerability scanning is enabled
2024-11-01T15:47:58Z INFO [misconfig] Misconfiguration scanning is enabled
2024-11-01T15:47:58Z INFO [secret] Secret scanning is enabled
2024-11-01T15:47:58Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-01T15:47:58Z INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-11-01T15:47:59Z INFO [terraform scanner] Scanning root module file_path="."
2024-11-01T15:47:59Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.administator" value="cty.NilVal"
2024-11-01T15:47:59Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.data_engineer" value="cty.NilVal"
2024-11-01T15:47:59Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.developer" value="cty.NilVal"
2024-11-01T15:47:59Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.fleet_manager" value="cty.NilVal"
2024-11-01T15:47:59Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.instance-access" value="cty.NilVal"
2024-11-01T15:47:59Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.instance-management" value="cty.NilVal"
2024-11-01T15:47:59Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.migration" value="cty.NilVal"
2024-11-01T15:47:59Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.mwaa_user" value="cty.NilVal"
2024-11-01T15:47:59Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.powerbi_user" value="cty.NilVal"
2024-11-01T15:47:59Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.quicksight_admin" value="cty.NilVal"
2024-11-01T15:47:59Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.read_only" value="cty.NilVal"
2024-11-01T15:47:59Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.reporting-operations" value="cty.NilVal"
2024-11-01T15:47:59Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.sandbox" value="cty.NilVal"
2024-11-01T15:47:59Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.security_audit" value="cty.NilVal"
2024-11-01T15:47:59Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="aws_ssoadmin_account_assignment.view_only" value="cty.NilVal"
2024-11-01T15:47:59Z ERROR [terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable. block="data.aws_identitystore_group.member" value="cty.NilVal"
2024-11-01T15:47:59Z INFO Number of language-specific files num=0
2024-11-01T15:47:59Z INFO Detected config files num=2
trivy_exitcode=0

</details> #### `Checkov Scan` Success
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/bootstrap/member-bootstrap
terraform/environments/bootstrap/single-sign-on

*****************************

Running Checkov in terraform/environments/bootstrap/member-bootstrap
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-11-01 15:48:02,325 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-cross-account-access?ref=6819b090bce6d3068d55c7c7b9b3fd18c9dca648:None (for external modules, the --download-external-modules flag is required)
2024-11-01 15:48:02,325 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-pagerduty-integration?ref=0179859e6fafc567843cd55c0b05d325d5012dc4:None (for external modules, the --download-external-modules flag is required)
2024-11-01 15:48:02,325 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-github-oidc-role?ref=62b8a16c73d8e4422cd81923e46948e8f4b5cf48:None (for external modules, the --download-external-modules flag is required)
2024-11-01 15:48:02,325 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-github-oidc-provider?ref=82f546bd5f002674138a2ccdade7d7618c6758b3:None (for external modules, the --download-external-modules flag is required)
2024-11-01 15:48:02,325 [MainThread  ] [WARNI]  Failed to download module github.com/terraform-aws-modules/terraform-aws-iam//modules/iam-assumable-role?ref=de95e21a3bc51cd3a44b3b95a4c2f61000649ebb:None (for external modules, the --download-external-modules flag is required)
2024-11-01 15:48:02,326 [MainThread  ] [WARNI]  Failed to download module github.com/terraform-aws-modules/terraform-aws-iam//modules/iam-assumable-roles?ref=de95e21a3bc51cd3a44b3b95a4c2f61000649ebb:None (for external modules, the --download-external-modules flag is required)
2024-11-01 15:48:02,337 [MainThread  ] [WARNI]  [ArmLocalGraph] created 0 vertices
2024-11-01 15:48:02,337 [MainThread  ] [WARNI]  [ArmLocalGraph] created 0 edges
terraform scan results:

Passed checks: 151, Failed checks: 0, Skipped checks: 52


checkov_exitcode=0

*****************************

Running Checkov in terraform/environments/bootstrap/single-sign-on
Excluding the following checks: CKV_GIT_1,CKV_AWS_126,CKV2_AWS_38,CKV2_AWS_39
2024-11-01 15:48:06,130 [MainThread  ] [WARNI]  [ArmLocalGraph] created 0 vertices
2024-11-01 15:48:06,130 [MainThread  ] [WARNI]  [ArmLocalGraph] created 0 edges
terraform scan results:

Passed checks: 118, Failed checks: 0, Skipped checks: 55


checkov_exitcode=0

CTFLint Scan Success

Show Output

*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.9.1)
tflint will check the following folders:
terraform/environments/bootstrap/member-bootstrap
terraform/environments/bootstrap/single-sign-on

*****************************

Running tflint in terraform/environments/bootstrap/member-bootstrap
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

*****************************

Running tflint in terraform/environments/bootstrap/single-sign-on
Excluding the following checks: terraform_unused_declarations
tflint_exitcode=0

Trivy Scan Success

Show Output

*****************************

Trivy will check the following folders:
terraform/environments/bootstrap/member-bootstrap
terraform/environments/bootstrap/single-sign-on

*****************************

Running Trivy in terraform/environments/bootstrap/member-bootstrap
2024-11-01T15:47:50Z	INFO	[vulndb] Need to update DB
2024-11-01T15:47:50Z	INFO	[vulndb] Downloading vulnerability DB...
2024-11-01T15:47:50Z	INFO	[vulndb] Downloading artifact...	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-01T15:47:52Z	INFO	[vulndb] Artifact successfully downloaded	repo="public.ecr.aws/aquasecurity/trivy-db:2"
2024-11-01T15:47:52Z	INFO	[vuln] Vulnerability scanning is enabled
2024-11-01T15:47:52Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-11-01T15:47:52Z	INFO	[misconfig] Need to update the built-in checks
2024-11-01T15:47:52Z	INFO	[misconfig] Downloading the built-in checks...
160.60 KiB / 160.60 KiB [---------------------------------------------------------] 100.00% ? p/s 0s2024-11-01T15:47:53Z	INFO	[secret] Secret scanning is enabled
2024-11-01T15:47:53Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-01T15:47:53Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-11-01T15:47:53Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-11-01T15:47:55Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-01T15:47:55Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-01T15:47:55Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-01T15:47:55Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-01T15:47:55Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-01T15:47:55Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-01T15:47:55Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-roles: no such file or directory"
2024-11-01T15:47:55Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-01T15:47:55Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-01T15:47:55Z	ERROR	[terraform evaluator] Failed to load module. Maybe try 'terraform init'?	err="open modules/iam-assumable-role: no such file or directory"
2024-11-01T15:47:57Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="module.pagerduty_core_alerts[0].data.aws_sns_topic.alarm_topics" value="cty.NilVal"
2024-11-01T15:47:58Z	INFO	Number of language-specific files	num=0
2024-11-01T15:47:58Z	INFO	Detected config files	num=3
trivy_exitcode=0

*****************************

Running Trivy in terraform/environments/bootstrap/single-sign-on
2024-11-01T15:47:58Z	INFO	[vuln] Vulnerability scanning is enabled
2024-11-01T15:47:58Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-11-01T15:47:58Z	INFO	[secret] Secret scanning is enabled
2024-11-01T15:47:58Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-11-01T15:47:58Z	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-11-01T15:47:59Z	INFO	[terraform scanner] Scanning root module	file_path="."
2024-11-01T15:47:59Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.administator" value="cty.NilVal"
2024-11-01T15:47:59Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.data_engineer" value="cty.NilVal"
2024-11-01T15:47:59Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.developer" value="cty.NilVal"
2024-11-01T15:47:59Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.fleet_manager" value="cty.NilVal"
2024-11-01T15:47:59Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.instance-access" value="cty.NilVal"
2024-11-01T15:47:59Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.instance-management" value="cty.NilVal"
2024-11-01T15:47:59Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.migration" value="cty.NilVal"
2024-11-01T15:47:59Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.mwaa_user" value="cty.NilVal"
2024-11-01T15:47:59Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.powerbi_user" value="cty.NilVal"
2024-11-01T15:47:59Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.quicksight_admin" value="cty.NilVal"
2024-11-01T15:47:59Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.read_only" value="cty.NilVal"
2024-11-01T15:47:59Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.reporting-operations" value="cty.NilVal"
2024-11-01T15:47:59Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.sandbox" value="cty.NilVal"
2024-11-01T15:47:59Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.security_audit" value="cty.NilVal"
2024-11-01T15:47:59Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="aws_ssoadmin_account_assignment.view_only" value="cty.NilVal"
2024-11-01T15:47:59Z	ERROR	[terraform evaluator] Failed to expand block. Invalid "for-each" argument. Must be known and iterable.	block="data.aws_identitystore_group.member" value="cty.NilVal"
2024-11-01T15:47:59Z	INFO	Number of language-specific files	num=0
2024-11-01T15:47:59Z	INFO	Detected config files	num=2
trivy_exitcode=0