Update for Log Delivery

aws-gov/tf/modules/sra/databricks_account/logging_configuration/logging_configuration.tf

@@ -84,17 +84,27 @@ resource "aws_s3_bucket_policy" "log_delivery" {
 // IAM Role
 
 // Assume Role Policy Log Delivery
-data "databricks_aws_assume_role_policy" "log_delivery" {
-  external_id      = var.databricks_account_id
-  for_log_delivery = true
+data "aws_iam_policy_document" "passrole_for_log_delivery" {
+  statement {
+    effect  = "Allow"
+    actions = ["sts:AssumeRole"]
+    principals {
+      identifiers = ["arn:aws-us-gov:iam::${var.databricks_prod_aws_account_id[var.databricks_gov_shard]}:${var.log_delivery_role_name[var.databricks_gov_shard]}"]
+      type        = "AWS"
+    }
+    condition {
+      test     = "StringEquals"
+      variable = "sts:ExternalId"
+      values   = [var.databricks_account_id]
+    }
+  }
 }
 
-
 // Log Delivery IAM Role
 resource "aws_iam_role" "log_delivery" {
   name               = "${var.resource_prefix}-log-delivery"
   description        = "(${var.resource_prefix}) Log Delivery Role"
-  assume_role_policy = data.databricks_aws_assume_role_policy.log_delivery.json
+  assume_role_policy = data.aws_iam_policy_document.passrole_for_log_delivery.json
   tags = {
     Name = "${var.resource_prefix}-log-delivery-role"
   }

aws-gov/tf/modules/sra/databricks_account/logging_configuration/variables.tf

@@ -4,4 +4,16 @@ variable "resource_prefix" {
 
 variable "databricks_account_id" {
   type = string
+}
+
+variable "databricks_gov_shard" {
+  type = string
+}
+
+variable "log_delivery_role_name" {
+  type = map(string)
+}
+
+variable "databricks_prod_aws_account_id" {
+  type = map(string)
 }

aws-gov/tf/modules/sra/variables.tf

@@ -285,4 +285,9 @@ variable "databricks_prod_aws_account_id" {
 variable "uc_master_role_id" {
   description = "UC Master Role ID"
   type = map(string)
-}
+}
+
+variable "log_delivery_role_name" {
+  description = "Log Delivery Role Name"
+  type = map(string)
+}

aws-gov/tf/variables.tf

@@ -54,6 +54,14 @@ variable "uc_master_role_id" {
   }
 }
 
+variable "log_delivery_role_name" {
+  type = map(string)
+  default = {
+    "civilian" = "SaasUsageDeliveryRole-prod-aws-gov-IAMRole-L4QM0RCHYQ1G"
+    "dod"      = "SaasUsageDeliveryRole-prod-aws-gov-dod-IAMRole-1DMEHBYR8VC5P"
+  }
+}
+
 variable "databricks_gov_shard" {
   description = "pick shard: civilian, dod"
   validation {