Update AWS Discovery Terraform module

[GavinFrazar]

• fix role trust policy when trust_role is set
• fix for expressions that range over a null value, which is not
  supported in terraform v1.5.7
• fix broken validation block condition to catch
  use_oidc_integration=false when trust_role is not set
• fix nonsensitive(null) warning when create=false
• set nullable=false for match_aws_* variables
• add a precondition to enforce use_oidc_integration=true when using
  teleport_discovery_group_name="cloud-discovery-group", because cloud
  cluster discovery services must use OIDC credentials
• describe the allowed values for var.aws_matchers.types

No changelog for the unsupported for expressions fix because we didn't release that yet.

Changelog: Fixed teleport/discovery/aws Terraform module to support IAM role assumption as the discovery service credential source.

Manual Test Plan

Test environment

• Configured Terraform provider for discover-5 cloud staging tenant running 19.0.0-dev.alexh.15 and our teleport-dev-2 AWS account

Test Cases

• Run terraform apply with an invalid configuration and verify that a helpful error message is displayed
  • invalid config: set use_oidc_integration=true and trust_role != null
  • invalid config: set use_oidc_integration=false and trust_role = null
  • invalid config: set use_oidc_integration=false and teleport_discovery_group_name = "cloud-discovery-group"
  • invalid config: set trust_role.role_arn = null
  • invalid config: set trust_role.role_arn = ""
• Set use_oidc_integration = true
  • verify that the discovery config assume_role is null and integration is set
  • verify that the role's trust policy trusts the AWS OIDC provider
• Set trust_role != null
  • verify that the discovery config assume_role is set and integration is null
  • verify that the trust policy of the discovery service IAM role allows that role as a trusted principal
  • set trust_role.external_id != "" and verify that the external id condition is added to the discovery service iam role's trust policy
• terraform apply with the module using legacy match_aws_* inputs
  • Change module inputs to use aws_matchers input instead of the legacy inputs and verify that nothing changed after re-applying
• terraform apply the module using aws_matchers input with legacy inputs unset

[github-actions]

Amplify deployment status

Branch	Commit	Job ID	Status	Preview	Updated (UTC)
gavinfrazar/update-aws-discovery-tf-module	HEAD	1	✅SUCCEED	gavinfrazar-update-aws-discovery-tf-module	2026-04-11 00:35:17