mcp-nextcloud/infra/terraform/nextcloud-mcp-deployer-role

nextcloud-mcp-deployer-role

IAM role and least-privilege policy scoped to deploy the nextcloud-mcp-server Terraform module.

Use cases

• Client account: a client creates this role in their AWS account with trusted_principal_arns = ["arn:aws:iam::<your-account-id>:root"] so you can assume it cross-account and deploy/maintain the MCP server on their behalf.
• Your own testing: instantiated in your account with your IAM user / admin role as the trusted principal, lets you run terraform apply for the nextcloud-mcp-server module under the same permission boundary the client will use — so any "works for me, breaks for them" gap surfaces in testing rather than at the client.

Modes

The role's permissions are mode-aware via inputs:

Mode	Inputs	What gets granted
CloudFront default cert (recommended)	(defaults)	ECS, ALB, EFS, CloudFront, scoped IAM/logs/secrets, EC2 SG + describe
Custom domain	route53_zone_ids = [...]	+ Route53 (scoped to listed zones) and ACM
Secret managed in same TF	allow_secret_create = true	+ Secrets Manager create/update/delete (scoped to secret_name_prefix)

Cross-account assume from your account

Once the client has applied this module in their account and given you the output role_arn, configure the AWS provider in your client-deployment TF project:

provider "aws" {
  assume_role {
    role_arn = "arn:aws:iam::<client-account-id>:role/clients/nextcloud-mcp-deployer"
    # external_id = "..." # optional, recommended for cross-account
  }
}

Requirements

Name	Version
aws	~> 6.0

Providers

Name	Version
aws	6.43.0

Modules

No modules.

Resources

Name	Type
aws_iam_policy.deployer	resource
aws_iam_role.this	resource
aws_iam_role_policy_attachment.deployer	resource
aws_caller_identity.current	data source
aws_iam_policy_document.deployer	data source
aws_iam_policy_document.trust	data source
aws_partition.current	data source

Inputs

Name	Description	Type	Default	Required
allow_secret_create	When true, the deployer can create/update/delete Secrets Manager secrets matching secret_name_prefix. Set true if the secret is managed alongside the module in the same Terraform run; leave false if the secret is provisioned out of band (console / separate root TF) and only the ARN is passed in.	bool	false	no
module_name_prefix	The var.name value passed to the nextcloud-mcp-server module. Used to scope IAM/logs/secrets ARNs. Defaults match the module default; change only if the module is instantiated with a non-default name.	string	"nextcloud-mcp-server"	no
role_name	Name of the deployer IAM role.	string	"nextcloud-mcp-deployer"	no
role_path	IAM path for the deployer role and its policy.	string	"/clients/"	no
route53_zone_ids	Route53 hosted zone IDs the deployer is allowed to mutate. Only needed in the module's custom-domain mode. Leave empty (the default) for the CloudFront-default-cert path, which requires no DNS or ACM permissions.	list(string)	[]	no
secret_name_prefix	Secrets Manager name prefix the deployer can read (and optionally create, see allow_secret_create). The module accepts a secret ARN as input; this prefix scopes the deployer's access to secrets matching that name pattern.	string	"nextcloud-mcp"	no
trusted_principal_arns	Principal ARNs allowed to assume this role. For testing in your own account: the user/role you want to assume from. For client deployments: typically a single root-account ARN of the deploying party (e.g. "arn:aws:iam:::root"), with MFA or external-id conditions added at the trust-policy level if required.	list(string)	n/a	yes

Outputs

Name	Description
policy_arn	ARN of the inline-style managed policy attached to the role.
role_arn	ARN of the deployer role; pass to STS AssumeRole or use as the assume_role target in a provider block.
role_name	Name of the deployer role.