breaking: Update all execution role related variables

README.md

@@ -66,7 +66,7 @@ IMPORTANT: We do not pin modules to versions in our examples. We highly recommen
 | <a name="input_publish"></a> [publish](#input\_publish) | Whether to publish creation/change as new lambda function version | `bool` | `false` | no |
 | <a name="input_reserved_concurrency"></a> [reserved\_concurrency](#input\_reserved\_concurrency) | The amount of reserved concurrent executions for this lambda function | `number` | `null` | no |
 | <a name="input_retries"></a> [retries](#input\_retries) | Maximum number of retries for the Lambda invocation | `number` | `null` | no |
-| <a name="input_role_arn"></a> [role\_arn](#input\_role\_arn) | An optional lambda execution role | `string` | `null` | no |
+| <a name="input_role"></a> [role](#input\_role) | An optional lambda execution role | <pre>object({<br>    role_arn = string<br>  })</pre> | `null` | no |
 | <a name="input_role_prefix"></a> [role\_prefix](#input\_role\_prefix) | Default prefix for the role | `string` | `null` | no |
 | <a name="input_runtime"></a> [runtime](#input\_runtime) | The function runtime to use | `string` | `"python3.10"` | no |
 | <a name="input_s3_bucket"></a> [s3\_bucket](#input\_s3\_bucket) | The S3 bucket location containing the function's deployment package | `string` | `null` | no |

main.tf

@@ -11,7 +11,7 @@ locals {
 }
 
 module "lambda_role" {
-  count = length(compact([var.role_arn])) == 0 ? 1 : 0
+  count = var.role == null ? 1 : 0
 
   source                = "github.com/schubergphilis/terraform-aws-mcaf-role?ref=v0.3.3"
   name                  = join("-", compact([var.role_prefix, "LambdaRole", var.name]))
@@ -140,7 +140,7 @@ resource "aws_lambda_function" "default" {
   memory_size                    = var.memory_size
   publish                        = var.publish
   reserved_concurrent_executions = var.reserved_concurrency
-  role                           = length(compact([var.role_arn])) > 0 ? var.role_arn : module.lambda_role[0].arn
+  role                           = var.role != null ? var.role.role_arn : module.lambda_role[0].arn
   runtime                        = var.runtime
   s3_bucket                      = var.s3_bucket
   s3_key                         = var.s3_key

outputs.tf

@@ -19,7 +19,7 @@ output "qualified_arn" {
 }
 
 output "role_arn" {
-  value       = length(compact([var.role_arn])) > 0 ? var.role_arn : module.lambda_role[0].arn
+  value       = var.role != null ? var.role.role_arn : module.lambda_role[0].arn
   description = "ARN of the lambda execution role"
 }
 

variables.tf

@@ -140,10 +140,17 @@ variable "retries" {
   description = "Maximum number of retries for the Lambda invocation"
 }
 
-variable "role_arn" {
-  type        = string
+variable "role" {
+  type = object({
+    role_arn = string
+  })
   default     = null
   description = "An optional lambda execution role"
+
+  validation {
+    condition     = var.role == null || can(regex("^arn:aws:iam::[0-9]{12}:(role)/.+$", var.role.role_arn))
+    error_message = "If provided, role_arn must match an AWS Principal ARN"
+  }
 }
 
 variable "role_prefix" {