From fab6d011c36976cb7b92a861143d851d2f0c53d5 Mon Sep 17 00:00:00 2001 From: Matt Romanelli Date: Wed, 16 Sep 2026 16:42:17 -0500 Subject: [PATCH] Updated the READMEs for cross-account discovery --- README.md | 2 ++ plugin/service/host/README.md | 18 ++++++++++++++---- 2 files changed, 16 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index dabe13c..1764cdd 100644 --- a/README.md +++ b/README.md @@ -25,6 +25,8 @@ Credential rotation can be turned off by setting the This plugin will attempt to assume a role when a `role_arn` is supplied through the `attributes` object. More information about assume an AWS role can be found [here](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html). This feature only works when the plugin is running on a self managed Boundary [worker](https://developer.hashicorp.com/boundary/tutorials/hcp-administration/hcp-manage-workers). +To discover hosts across multiple AWS accounts, supply a `target_role_arn` in addition to `role_arn`. The plugin uses the principal credentials to assume the target role via a two-hop `AssumeRole` chain, enabling cross-account host discovery from a single worker. See [Attributes and Secrets](plugin/service/host/README.md#attributes-and-secrets) for the full list of `target_*` attributes. + ### Environment Credentials This plugin will attempt to retrieve credentials from environment variables. More diff --git a/plugin/service/host/README.md b/plugin/service/host/README.md index 6c18f3d..779bfc4 100644 --- a/plugin/service/host/README.md +++ b/plugin/service/host/README.md @@ -109,13 +109,23 @@ The following `attributes` are valid on an AWS host catalog resource: - `region` (string): The region to configure the host catalog for. All host sets in this catalog will be configured for this region. - `role_arn` (string): The AWS Role ARN used for `AssumeRole` authentication. If - provided, `disable_credential_rotation` must be also set to `true. -- `role_external_id` (string): The external id configured for the `AssumeRole` + provided, `disable_credential_rotation` must be also set to `true`. +- `role_external_id` (string): The external ID configured for the principal `AssumeRole` provider. -- `role_session_name` (string): The session name configured for the `AssumeRole` +- `role_session_name` (string): The session name configured for the principal `AssumeRole` provider. -- `role_tags` (object): The key-value pair tags configured for the `AssumeRole` +- `role_tags` (object): The key-value pair tags configured for the principal `AssumeRole` provider. +- `target_role_arn` (string): The AWS role ARN of the target IAM role to assume for + cross-account discovery. Required if any other `target_*` attributes are configured. +- `target_region` (string): The region where the target hosts reside. Defaults to the + principal account `region` if omitted. +- `target_role_external_id` (string): The external ID configured for the target + `AssumeRole` provider. +- `target_role_session_name` (string): The session name configured for the target + `AssumeRole` provider. +- `target_role_tags` (object): The key-value pair tags configured for the target + `AssumeRole` provider. The following `secrets` are required on an AWS host catalog resource: