doc(module): document assume role policy behavior

README.md

@@ -13,7 +13,7 @@ continuous integration tasks on AWS.
 module "aws_iam_role" {
   source = "git::ssh://git@git.adyxax.org/adyxax/tofu-module-aws-iam-role?depth=1&ref=1.1.0"
 
-  name            = local.name
+  name              = local.name
   policy_statements = jsonencode([
     {
       Action   = "acm:*"
@@ -24,6 +24,11 @@ module "aws_iam_role" {
 }
 ```
 
+## Assume role policy
+
+This role is designed to be used with AWS Identity Center and provisions a trust
+relationship to the root organization account.
+
 ## Policies
 
 The IAM role is granted the following permissions on the AWS account:

infrastructure/tofu/main.tf

@@ -8,12 +8,12 @@ module "aws_iam_ci_user" {
     aws.root  = aws.all["root"]
     aws.tests = aws.all["tests"]
   }
-  source = "git::ssh://git@git.adyxax.org/adyxax/tofu-module-aws-iam-ci-user?depth=1&ref=1.0.0"
+  source = "git::ssh://git@git.adyxax.org/adyxax/tofu-module-aws-iam-ci-user?depth=1&ref=1.0.1"
 
   name = local.name
   tests_policy_statements = jsonencode([{
     Action   = "iam:*"
     Effect   = "Allow"
-    Resource = "arn:aws:iam::*:role/tftest",
+    Resource = "arn:aws:iam::*:role/tftest-role",
   }])
 }

main.tftest.hcl

@@ -11,5 +11,5 @@ run "main" {
 }
 
 variables {
-  name = "tftest"
+  name = "tftest-role"
 }