getprobo/audit-role/aws

Grants Probo read-only audit access to one AWS account through OIDC web identity federation. Probo holds no credential for the account: it presents a short-lived signed assertion that STS verifies against a public key set, and you revoke access by deleting the role.

Parity with ../../cloudformation/aws-audit-role/aws-audit-role.yaml, for teams that would rather not run a stack they did not write.

Usage

Copy the issuer URL and the subject out of the connector setup screen. AWS compares the issuer URL case-sensitively and its last path segment is a mixed-case identifier, so paste it rather than retyping it.

module "probo_audit" {
  source = "getprobo/audit-role/aws"

  probo_issuer_url = "https://proboidentity.com/e5IaD7ibAAEAAAAAAZZ9aR_Oq_Npymhg"
  probo_subject    = "e5IaD7ibAAEAAAAAAZZ9aR_Oq_Npymhg"
  role_name        = "ProboAudit"
}

output "probo_role_arn" {
  value = module.probo_audit.role_arn
}

Give Probo the role_arn output when you create the connector.

Verifying an install

Probo probes the install by assuming the role. Isolation is the per-organization issuer: a foreign token fails at the provider-match step before STS evaluates any trust-policy condition. The sub and aud conditions in this module are IAM hygiene; Probo does not read them back.

Covering a whole organization

This module covers one account. Organization-wide rollout is the caller's responsibility, because how you reach your member accounts is yours to decide and the module cannot guess it.

Probo currently reviews only the connected account. Apply the module in other accounts now if you want those roles ready when org-wide coverage ships.

Use one provider alias per account with a role you already have there:

module "probo_audit_member" {
  for_each = toset(var.member_account_ids)
  source   = "getprobo/audit-role/aws"

  providers = { aws = aws.member[each.key] }

  probo_issuer_url = var.probo_issuer_url
  probo_subject    = var.probo_subject
  role_name        = "ProboAudit"

  grant_organizations_read = false
}

for_each covers the accounts that exist when you apply. If you want accounts added later to be onboarded without a second apply, use a service-managed aws_cloudformation_stack_set with auto-deployment — which is what the CloudFormation template does — or accept re-applying.

What it creates

Resource	Notes
aws_iam_openid_connect_provider	Skipped when create_oidc_provider = false. AWS allows one per issuer URL per account.
aws_iam_role	ProboAudit by default, max_session_duration = 3600.
SecurityAudit, job-function/ViewOnlyAccess	AWS-managed, read-only.
ProboAuditIdentityRead	IAM Identity Center reads the two managed policies miss.
ProboAuditOrganizationsRead	Only with grant_organizations_read = true.

The trust policy pins both aud and sub with StringEquals. Isolation is the per-organization issuer: a foreign token fails at the provider-match step before STS evaluates any condition. Those pins are IAM hygiene; Probo does not read them back.

Inputs and outputs

Run terraform-docs markdown . for the generated table; the variable and output descriptions in variables.tf and outputs.tf are the source of truth.

Notes

• The role must have the same name in every account. Probo stores one role ARN per connector and reviews only that account today. Use the same name so the roles stay ready when org-wide coverage ships.
• thumbprint_list is deliberately unset, unlike the CloudFormation template which must supply a placeholder. AWS ignores it for publicly trusted certificates, so pinning one only produces a perpetual diff.
• Requires the aws provider at 5.0 or later, where thumbprint_list became optional.