Terraform role to deploy the Steamhaus role to allow Steamhaus to assume the role

assume_role.json

+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "arn:aws:iam::${source_account_id}:root"
+      },
+      "Action": "sts:AssumeRole",
+      "Condition": {
+        "StringEquals": {
+          "sts:ExternalId": "${external_id}"
+        },
+        "Bool": {
+          "aws:MultiFactorAuthPresent": "true"
+        }
+      }
+    }
+  ]
+}
\ No newline at end of file

main.tf

+#############################################################################################################
+# Variables
+#############################################################################################################
+variable "source_account_id" {
+  description = "ID of the source AWS account to be allowed accesss"
+  default = "153730384924"
+}
+
+variable "external_id" {
+  description = "The External ID of the destination account, this is provided by Steamhaus"
+}
+
+
+
+#############################################################################################################
+# IAM Role, Policy and Attachment
+#############################################################################################################
+data "template_file" "assume_role" {
+  template = "${file("${path.module}/assume_role.json")}"
+  vars {
+    source_account_id    = "${var.source_account_id}"
+    external_id          = "${var.external_id}"
+  }
+}
+
+resource "aws_iam_role" "steamhaus" {
+  name = "Steamhaus"
+  assume_role_policy =  "${data.template_file.assume_role.rendered}"
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_iam_role_policy_attachment" "test-attach" {
+    role = "${aws_iam_role.steamhaus.name}"
+    policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
+}
+
+#############################################################################################################
+# Outputs
+#############################################################################################################
+output "role_name" {value = "${aws_iam_role.steamhaus.name}"}
+output "role_arn" {value = "${aws_iam_role.steamhaus.arn}"}
\ No newline at end of file