Add an additional role arn config of "plan" to aws_role_to_assume

[ben-of-codecraft]

Add an additional role arn config of "plan" to aws_role_to_assume

[motatoes]

I think it should be straightforward to bake this into digger since we already have the oidc spec implemented. Had a question on the api for it because I'm already not liking the fact that we have state and command. Just don't think its super understandable from the yml alone without docs. But maybe its just me.

Adding "plan" to the mix I think will make it even more confusing. Another thing I dislike about the current implementation is the fact that you have to specify 2 roles per project always "state and "command".

Wondering if there's a better spec here. Perhaps something like

    - name: "{{github.org}}-{{github.repo}}-prod"
      dir: prod
      workflow: default
      include_patterns: [
        "./modules/**",
        "./config/prod/**",
      ]
      workflow_file: digger_workflow.yml
      aws_role_to_assume: {{output.stsStateRole.always_role}}

For when you have the same role for all. Or having them split out on demand:

    - name: "{{github.org}}-{{github.repo}}-prod"
      dir: prod
      workflow: default
      include_patterns: [
        "./modules/**",
        "./config/prod/**",
      ]
      workflow_file: digger_workflow.yml
      aws_role_to_assume: 
          state: {{output.stsStateRole.state_role}}
          plan: {{output.stsStateRole.plan_role}}
          apply: {{output.stsStateRole.apply_role}}

thoughts? I know its not related to the problem at hand but I thought I'd bring it up while we discuss this as well

[ben-of-codecraft]

I agree with your suggestion about having either 1 role like in the first example or splitting it into the 3 like you show. Those are more clear in what are used for where the command/state one was not as clear.

That is the direction I would like to see.