qontract-reconcile 0.10.2.dev86__py3-none-any.whl → 0.10.2.dev88__py3-none-any.whl

{qontract_reconcile-0.10.2.dev86.dist-info → qontract_reconcile-0.10.2.dev88.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: qontract-reconcile
-Version: 0.10.2.dev86
+Version: 0.10.2.dev88
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Project-URL: homepage, https://github.com/app-sre/qontract-reconcile
 Project-URL: repository, https://github.com/app-sre/qontract-reconcile

{qontract_reconcile-0.10.2.dev86.dist-info → qontract_reconcile-0.10.2.dev88.dist-info}/RECORD

@@ -199,10 +199,10 @@ reconcile/external_resources/aws.py,sha256=wzN3GHxyqVa4Lqqg5HdogqNW2RM532t0ZiKaQ
 reconcile/external_resources/factories.py,sha256=C0QHT0soEv6z99-ELAAE19S5MaMHhV0t1fSiQn0Coc4,5970
 reconcile/external_resources/integration.py,sha256=JF38M7R0Z4ADUTx57TZqSZH9k_xpPlbAxQAcGyIISuM,6925
 reconcile/external_resources/integration_secrets_sync.py,sha256=dX09O3r6KURziUYYfiki10orNjOGVma-XojhVqd0ww4,1667
-reconcile/external_resources/manager.py,sha256=ZagwLn6YQ1XmgmMN3qpuDzQsQxa4VOYl-IQPZBwCDqM,17103
+reconcile/external_resources/manager.py,sha256=mvFfcXPzvNqDWDgKTK8eiSe6C_FUvBtben3bSqrqSoc,18246
 reconcile/external_resources/meta.py,sha256=noaytFzmShpzLA_ebGh7wuP45mOfHIOnnoUxivjDa1I,672
 reconcile/external_resources/metrics.py,sha256=KiBjMUaN_z0cSkF_7Ar_a8RiuiwVqjyMcVdISlxhzXE,3898
-reconcile/external_resources/model.py,sha256=dxwiyI3J9xyLeue8_W9NJoap-CkKLMAoY0S0ml5-NbU,13450
+reconcile/external_resources/model.py,sha256=HrSkmAjOqw0aT3CsZKXKMLyocM__8XO5qHb-dXcoagw,13747
 reconcile/external_resources/reconciler.py,sha256=-0trp1K-iUgOQn3mm1ZUSmfaReRrUT0eHzPkUhNPolQ,9583
 reconcile/external_resources/secrets_sync.py,sha256=ZDxzGZ6wC4zxLhA7-L39xDRH6rzUM285gytuzmRQdlw,16208
 reconcile/external_resources/state.py,sha256=gF3ACdl7YiUlbQ4uEGrD6i_Txxqr6mT9f8IFlTQ-8dY,13176
@@ -224,7 +224,7 @@ reconcile/glitchtip_project_alerts/integration.py,sha256=BgMx-NyV9mTuv7Sotb2OioC
 reconcile/glitchtip_project_dsn/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/glitchtip_project_dsn/integration.py,sha256=2iugub-kHYkHNK33n0v9_TeWonuxCPah_VkoTPvaajE,8077
 reconcile/gql_definitions/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-reconcile/gql_definitions/introspection.json,sha256=EtGe57eM0V8WCKw-tzPwCo3EVlhM7EM-qhTlLDu_SzQ,2238029
+reconcile/gql_definitions/introspection.json,sha256=fhnOfg-0gFKOL6yrnI5JJE0w9khgA8ivmEzH_gmDajw,2238549
 reconcile/gql_definitions/acs/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/acs/acs_instances.py,sha256=L91WW9LbhJbBSrECqShQpFtjoBOsmNIYLRpMbx1io5o,2181
 reconcile/gql_definitions/acs/acs_policies.py,sha256=bN5i4mks10Z23KJSj7jqp966Osq2dps4d-sPH9gjxEA,7008
@@ -309,7 +309,7 @@ reconcile/gql_definitions/endpoints_discovery/apps.py,sha256=aBWRAwDUJQ32ghJS4cP
 reconcile/gql_definitions/external_resources/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/external_resources/aws_accounts.py,sha256=XR69j9dpTQ0gv8y-AZN7AJ0dPvO-wbHscyCDgrax6Bk,2046
 reconcile/gql_definitions/external_resources/external_resources_modules.py,sha256=JViHtDWEBwjStBUo_bUdm_sxdpjCHcoATeFvwFRLQpU,3009
-reconcile/gql_definitions/external_resources/external_resources_namespaces.py,sha256=-0Q48lfH-fxAvwqYfXbLQ1aP7bFFh1BRQIYPnF7W9ZI,43067
+reconcile/gql_definitions/external_resources/external_resources_namespaces.py,sha256=GLkKeODZ4_wJ2WxuYXitfq3TTcISv5XF9w5JOKSzNjg,43187
 reconcile/gql_definitions/external_resources/external_resources_settings.py,sha256=WBkJqnoyYCe1Vimwbp_Pa0RdyTdmWNf6oEWyA749QzA,3589
 reconcile/gql_definitions/external_resources/fragments/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/external_resources/fragments/external_resources_module_overrides.py,sha256=T_qWCRtzU8F9frebBXG9TkeQdrKGt3R9YinSngPoFqM,1262
@@ -421,7 +421,7 @@ reconcile/gql_definitions/terraform_repo/__init__.py,sha256=47DEQpj8HBSa-_TImW-5
 reconcile/gql_definitions/terraform_repo/terraform_repo.py,sha256=9cDKdP9ziBh9J_mw2Gi6GUOP4mFxMABY_D62qSeMtJI,3881
 reconcile/gql_definitions/terraform_resources/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/terraform_resources/database_access_manager.py,sha256=yv0_YC-LmhaKD_gyGG3le1w5BtypBjlsO894-Zgdg4U,4813
-reconcile/gql_definitions/terraform_resources/terraform_resources_namespaces.py,sha256=_man82NXH9Jw7OvgDiQCKiLDG6Q7aV_ktOAi12QCXbI,42793
+reconcile/gql_definitions/terraform_resources/terraform_resources_namespaces.py,sha256=ERCdAEulqNfKtXHDYlEnrDAIaovkwcs0kAj-MTv6bH8,42913
 reconcile/gql_definitions/terraform_tgw_attachments/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/terraform_tgw_attachments/aws_accounts.py,sha256=FPyPEikpkZ_kvHfXqnkzSUDNmxMMTiUwhI-eLQtuIHM,2616
 reconcile/gql_definitions/unleash_feature_toggles/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -646,7 +646,7 @@ reconcile/utils/state.py,sha256=az4tBmZ0EdbFcAGiBVUxs3cr2-BVWsuDQiNTvjjQq8s,1637
 reconcile/utils/structs.py,sha256=LcbLEg8WxfRqM6nW7NhcWN0YeqF7SQzxOgntmLs1SgY,352
 reconcile/utils/template.py,sha256=wTvRU4AnAV_o042tD4Mwls2dwWMuk7MKnde3MaCjaYg,331
 reconcile/utils/terraform_client.py,sha256=H8frsS370y8xfivKLNBD1dwlBLHvfuR6JSN_syBL5Qc,36033
-reconcile/utils/terrascript_aws_client.py,sha256=-l2a8Sa5FIzFwVDgHEHcqQeqBGTMn7nacb1p5B8junI,286242
+reconcile/utils/terrascript_aws_client.py,sha256=Xn5STCd0Ge8oSa-ugl3e0A5VYpGziTAdIuPscRaOJxs,286415
 reconcile/utils/three_way_diff_strategy.py,sha256=oQcHXd9LVhirJfoaOBoHUYuZVGfyL2voKr6KVI34zZE,4833
 reconcile/utils/throughput.py,sha256=iP4UWAe2LVhDo69mPPmgo9nQ7RxHD6_GS8MZe-aSiuM,344
 reconcile/utils/vault.py,sha256=aSA8l9cJlPUHpChFGl27nSY-Mpq9FMjBo7Dcgb1BVfM,15036
@@ -786,7 +786,7 @@ tools/saas_promotion_state/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJ
 tools/saas_promotion_state/saas_promotion_state.py,sha256=UfwwRLS5Ya4_Nh1w5n1dvoYtchQvYE9yj1VANt2IKqI,3925
 tools/sre_checkpoints/__init__.py,sha256=CDaDaywJnmRCLyl_NCcvxi-Zc0hTi_3OdwKiFOyS39I,145
 tools/sre_checkpoints/util.py,sha256=zEDbGr18ZeHNQwW8pUsr2JRjuXIPz--WAGJxZo9sv_Y,894
-qontract_reconcile-0.10.2.dev86.dist-info/METADATA,sha256=cajktJ7yRKHgFkrRRzNfruYA4M_gcRFOEF9RO_MH01w,24565
-qontract_reconcile-0.10.2.dev86.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
-qontract_reconcile-0.10.2.dev86.dist-info/entry_points.txt,sha256=5i9l54La3vQrDLAdwDKQWC0iG4sV9RRfOb1BpvzOWLc,698
-qontract_reconcile-0.10.2.dev86.dist-info/RECORD,,
+qontract_reconcile-0.10.2.dev88.dist-info/METADATA,sha256=4n5vQregAp6JSzC4Vf3G7tXclpo0M-GHu_k5hbidAcY,24565
+qontract_reconcile-0.10.2.dev88.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+qontract_reconcile-0.10.2.dev88.dist-info/entry_points.txt,sha256=5i9l54La3vQrDLAdwDKQWC0iG4sV9RRfOb1BpvzOWLc,698
+qontract_reconcile-0.10.2.dev88.dist-info/RECORD,,

reconcile/external_resources/manager.py

@@ -133,6 +133,40 @@ class ExternalResourcesManager:
         self.thread_pool_size = thread_pool_size
         self.dry_runs_validator = dry_runs_validator
 
+    def _resource_spec_changed(
+        self, reconciliation: Reconciliation, state: ExternalResourceState
+    ) -> bool:
+        return reconciliation.resource_hash != state.reconciliation.resource_hash
+
+    def _resource_drift_detection_ttl_expired(
+        self, reconciliation: Reconciliation, state: ExternalResourceState
+    ) -> bool:
+        return (datetime.now(state.ts.tzinfo) - state.ts).total_seconds() > (
+            reconciliation.module_configuration.reconcile_drift_interval_minutes * 60
+        )
+
+    def _reconciliation_module_config_overridden(
+        self, reconciliation: Reconciliation, state: ExternalResourceState
+    ) -> bool:
+        return reconciliation.module_configuration.overridden and (
+            reconciliation.module_configuration.image_version
+            != state.reconciliation.module_configuration.image_version
+        )
+
+    def _reconciliation_needs_dry_run_run(
+        self, reconciliation: Reconciliation, state: ExternalResourceState
+    ) -> bool:
+        return (
+            reconciliation.action == Action.APPLY
+            and (
+                self._resource_spec_changed(reconciliation, state)
+                or self._reconciliation_module_config_overridden(reconciliation, state)
+            )
+        ) or (
+            reconciliation.action == Action.DESTROY
+            and not state.resource_status.is_in_progress
+        )
+
     def _get_reconcile_action(
         self, reconciliation: Reconciliation, state: ExternalResourceState
     ) -> ReconcileAction:
@@ -145,17 +179,16 @@ class ExternalResourcesManager:
                 case ResourceStatus.ERROR:
                     return ReconcileAction.APPLY_ERROR
                 case ResourceStatus.CREATED | ResourceStatus.PENDING_SECRET_SYNC:
-                    if (
-                        reconciliation.resource_hash
-                        != state.reconciliation.resource_hash
-                    ):
+                    if self._resource_spec_changed(reconciliation, state):
                         return ReconcileAction.APPLY_SPEC_CHANGED
-                    elif (
-                        (datetime.now(state.ts.tzinfo) - state.ts).total_seconds()
-                        > reconciliation.module_configuration.reconcile_drift_interval_minutes
-                        * 60
+                    elif self._resource_drift_detection_ttl_expired(
+                        reconciliation, state
                     ):
                         return ReconcileAction.APPLY_DRIFT_DETECTION
+                    elif self._reconciliation_module_config_overridden(
+                        reconciliation, state
+                    ):
+                        return ReconcileAction.APPLY_MODULE_CONFIG_OVERRIDDEN
         elif reconciliation.action == Action.DESTROY:
             match state.resource_status:
                 case ResourceStatus.CREATED:
@@ -411,18 +444,13 @@ class ExternalResourcesManager:
         self.dry_runs_validator.validate()
         desired_r = self._get_desired_objects_reconciliations()
         deleted_r = self._get_deleted_objects_reconciliations()
-        reconciliations = desired_r.union(deleted_r)
-        triggered: set[Reconciliation] = set()
-
-        for r in reconciliations:
-            state = self.state_mgr.get_external_resource_state(key=r.key)
-            if (
-                r.action == Action.APPLY
-                and state.reconciliation.resource_hash != r.resource_hash
-            ) or (
-                r.action == Action.DESTROY and not state.resource_status.is_in_progress
-            ):
-                triggered.add(r)
+        triggered = {
+            r
+            for r in desired_r.union(deleted_r)
+            if self._reconciliation_needs_dry_run_run(
+                r, self.state_mgr.get_external_resource_state(key=r.key)
+            )
+        }
 
         threaded.run(
             self.reconciler.reconcile_resource,

reconcile/external_resources/model.py

@@ -7,7 +7,7 @@ from collections.abc import ItemsView, Iterable, Iterator, MutableMapping
 from enum import StrEnum
 from typing import Any
 
-from pydantic import BaseModel
+from pydantic import BaseModel, Field
 
 from reconcile.external_resources.meta import (
     FLAG_DELETE_RESOURCE,
@@ -263,6 +263,7 @@ class ExternalResourceModuleConfiguration(BaseModel, frozen=True):
     outputs_secret_image: str = ""
     outputs_secret_version: str = ""
     resources: Resources = Resources()
+    overridden: bool = Field(default=False, exclude=True)
 
     @property
     def image_version(self) -> str:
@@ -278,17 +279,19 @@ class ExternalResourceModuleConfiguration(BaseModel, frozen=True):
         spec: ExternalResourceSpec,
         settings: ExternalResourcesSettingsV1,
     ) -> "ExternalResourceModuleConfiguration":
-        module_overrides = spec.metadata.get(
-            "module_overrides"
-        ) or ExternalResourcesModuleOverrides(
-            module_type=None,
-            image=None,
-            version=None,
-            reconcile_timeout_minutes=None,
-            outputs_secret_image=None,
-            outputs_secret_version=None,
-            resources=None,
-        )
+        module_overrides = spec.metadata.get("module_overrides")
+        overridden = module_overrides is not None
+
+        if module_overrides is None:
+            module_overrides = ExternalResourcesModuleOverrides(
+                module_type=None,
+                image=None,
+                version=None,
+                reconcile_timeout_minutes=None,
+                outputs_secret_image=None,
+                outputs_secret_version=None,
+                resources=None,
+            )
 
         return ExternalResourceModuleConfiguration(
             image=module_overrides.image or module.image,
@@ -307,6 +310,7 @@ class ExternalResourceModuleConfiguration(BaseModel, frozen=True):
                 or module.resources
                 or settings.module_default_resources
             ),
+            overridden=overridden,
         )
 
 
@@ -358,6 +362,7 @@ class ReconcileAction(StrEnum):
     APPLY_SPEC_CHANGED = "Resource spec has changed"
     APPLY_DRIFT_DETECTION = "Resource drift detection run"
     APPLY_USER_REQUESTED = "Resource reconciliation requested"
+    APPLY_MODULE_CONFIG_OVERRIDDEN = "Module configuration overridden"
     DESTROY_CREATED = "Resource no longer exists in the configuration"
     DESTROY_ERROR = "Resource status in ERROR state"
 

reconcile/gql_definitions/external_resources/external_resources_namespaces.py

@@ -205,6 +205,7 @@ query ExternalResourcesNamespaces {
                 output_resource_name
                 annotations
                 managed_by_erv2
+                max_session_duration
             }
             ... on NamespaceTerraformResourceSQS_v1 {
                 region
@@ -679,6 +680,7 @@ class NamespaceTerraformResourceRoleV1(NamespaceTerraformResourceAWSV1):
     output_resource_name: Optional[str] = Field(..., alias="output_resource_name")
     annotations: Optional[str] = Field(..., alias="annotations")
     managed_by_erv2: Optional[bool] = Field(..., alias="managed_by_erv2")
+    max_session_duration: Optional[int] = Field(..., alias="max_session_duration")
 
 
 class KeyValueV1(ConfiguredBaseModel):
@@ -1035,7 +1037,7 @@ class NamespaceTerraformResourceMskV1(NamespaceTerraformResourceAWSV1):
 
 class NamespaceTerraformProviderResourceAWSV1(NamespaceExternalResourceV1):
     provisioner: AWSAccountV1 = Field(..., alias="provisioner")
-    resources: list[Union[NamespaceTerraformResourceRDSV1, NamespaceTerraformResourceRosaAuthenticatorV1, NamespaceTerraformResourceALBV1, NamespaceTerraformResourceS3V1, NamespaceTerraformResourceElastiCacheV1, NamespaceTerraformResourceASGV1, NamespaceTerraformResourceKMSV1, NamespaceTerraformResourceMskV1, NamespaceTerraformResourceRoleV1, NamespaceTerraformResourceSNSTopicV1, NamespaceTerraformResourceServiceAccountV1, NamespaceTerraformResourceS3SQSV1, NamespaceTerraformResourceCloudWatchV1, NamespaceTerraformResourceRosaAuthenticatorVPCEV1, NamespaceTerraformResourceS3CloudFrontV1, NamespaceTerraformResourceElasticSearchV1, NamespaceTerraformResourceACMV1, NamespaceTerraformResourceKinesisV1, NamespaceTerraformResourceRoute53ZoneV1, NamespaceTerraformResourceSQSV1, NamespaceTerraformResourceDynamoDBV1, NamespaceTerraformResourceECRV1, NamespaceTerraformResourceS3CloudFrontPublicKeyV1, NamespaceTerraformResourceSecretsManagerV1, NamespaceTerraformResourceSecretsManagerServiceAccountV1, NamespaceTerraformResourceAWSV1]] = Field(..., alias="resources")
+    resources: list[Union[NamespaceTerraformResourceRDSV1, NamespaceTerraformResourceRosaAuthenticatorV1, NamespaceTerraformResourceALBV1, NamespaceTerraformResourceS3V1, NamespaceTerraformResourceElastiCacheV1, NamespaceTerraformResourceASGV1, NamespaceTerraformResourceRoleV1, NamespaceTerraformResourceKMSV1, NamespaceTerraformResourceMskV1, NamespaceTerraformResourceSNSTopicV1, NamespaceTerraformResourceServiceAccountV1, NamespaceTerraformResourceS3SQSV1, NamespaceTerraformResourceCloudWatchV1, NamespaceTerraformResourceRosaAuthenticatorVPCEV1, NamespaceTerraformResourceS3CloudFrontV1, NamespaceTerraformResourceElasticSearchV1, NamespaceTerraformResourceACMV1, NamespaceTerraformResourceKinesisV1, NamespaceTerraformResourceRoute53ZoneV1, NamespaceTerraformResourceSQSV1, NamespaceTerraformResourceDynamoDBV1, NamespaceTerraformResourceECRV1, NamespaceTerraformResourceS3CloudFrontPublicKeyV1, NamespaceTerraformResourceSecretsManagerV1, NamespaceTerraformResourceSecretsManagerServiceAccountV1, NamespaceTerraformResourceAWSV1]] = Field(..., alias="resources")
 
 
 class EnvironmentV1(ConfiguredBaseModel):

reconcile/gql_definitions/introspection.json

@@ -44468,6 +44468,18 @@
                             },
                             "isDeprecated": false,
                             "deprecationReason": null
+                        },
+                        {
+                            "name": "max_session_duration",
+                            "description": null,
+                            "args": [],
+                            "type": {
+                                "kind": "SCALAR",
+                                "name": "Int",
+                                "ofType": null
+                            },
+                            "isDeprecated": false,
+                            "deprecationReason": null
                         }
                     ],
                     "inputFields": null,

reconcile/gql_definitions/terraform_resources/terraform_resources_namespaces.py

@@ -177,6 +177,7 @@ query TerraformResourcesNamespaces {
                   ignore_changes
                 }
                 managed_by_erv2
+                max_session_duration
             }
             ... on NamespaceTerraformResourceSQS_v1 {
                 region
@@ -655,6 +656,7 @@ class NamespaceTerraformResourceRoleV1(NamespaceTerraformResourceAWSV1):
     annotations: Optional[str] = Field(..., alias="annotations")
     lifecycle: Optional[NamespaceTerraformResourceLifecycleV1] = Field(..., alias="lifecycle")
     managed_by_erv2: Optional[bool] = Field(..., alias="managed_by_erv2")
+    max_session_duration: Optional[int] = Field(..., alias="max_session_duration")
 
 
 class KeyValueV1(ConfiguredBaseModel):
@@ -1019,7 +1021,7 @@ class NamespaceTerraformResourceMskV1(NamespaceTerraformResourceAWSV1):
 
 
 class NamespaceTerraformProviderResourceAWSV1(NamespaceExternalResourceV1):
-    resources: list[Union[NamespaceTerraformResourceRDSV1, NamespaceTerraformResourceRosaAuthenticatorV1, NamespaceTerraformResourceALBV1, NamespaceTerraformResourceS3V1, NamespaceTerraformResourceRoleV1, NamespaceTerraformResourceASGV1, NamespaceTerraformResourceElastiCacheV1, NamespaceTerraformResourceSNSTopicV1, NamespaceTerraformResourceServiceAccountV1, NamespaceTerraformResourceS3SQSV1, NamespaceTerraformResourceCloudWatchV1, NamespaceTerraformResourceRosaAuthenticatorVPCEV1, NamespaceTerraformResourceMskV1, NamespaceTerraformResourceS3CloudFrontV1, NamespaceTerraformResourceKMSV1, NamespaceTerraformResourceElasticSearchV1, NamespaceTerraformResourceACMV1, NamespaceTerraformResourceKinesisV1, NamespaceTerraformResourceRoute53ZoneV1, NamespaceTerraformResourceSQSV1, NamespaceTerraformResourceDynamoDBV1, NamespaceTerraformResourceECRV1, NamespaceTerraformResourceS3CloudFrontPublicKeyV1, NamespaceTerraformResourceSecretsManagerV1, NamespaceTerraformResourceSecretsManagerServiceAccountV1, NamespaceTerraformResourceAWSV1]] = Field(..., alias="resources")
+    resources: list[Union[NamespaceTerraformResourceRDSV1, NamespaceTerraformResourceRosaAuthenticatorV1, NamespaceTerraformResourceALBV1, NamespaceTerraformResourceRoleV1, NamespaceTerraformResourceS3V1, NamespaceTerraformResourceASGV1, NamespaceTerraformResourceElastiCacheV1, NamespaceTerraformResourceSNSTopicV1, NamespaceTerraformResourceServiceAccountV1, NamespaceTerraformResourceS3SQSV1, NamespaceTerraformResourceCloudWatchV1, NamespaceTerraformResourceRosaAuthenticatorVPCEV1, NamespaceTerraformResourceMskV1, NamespaceTerraformResourceS3CloudFrontV1, NamespaceTerraformResourceKMSV1, NamespaceTerraformResourceElasticSearchV1, NamespaceTerraformResourceACMV1, NamespaceTerraformResourceKinesisV1, NamespaceTerraformResourceRoute53ZoneV1, NamespaceTerraformResourceSQSV1, NamespaceTerraformResourceDynamoDBV1, NamespaceTerraformResourceECRV1, NamespaceTerraformResourceS3CloudFrontPublicKeyV1, NamespaceTerraformResourceSecretsManagerV1, NamespaceTerraformResourceSecretsManagerServiceAccountV1, NamespaceTerraformResourceAWSV1]] = Field(..., alias="resources")
 
 
 class EnvironmentV1(ConfiguredBaseModel):

reconcile/utils/terrascript_aws_client.py

@@ -246,6 +246,7 @@ VARIABLE_KEYS = [
     "records",
     "extra_tags",
     "lifecycle",
+    "max_session_duration",
 ]
 
 EMAIL_REGEX = re.compile(r"^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$")
@@ -2786,6 +2787,9 @@ class TerrascriptClient:  # pylint: disable=too-many-public-methods
         if lifecycle := self.get_resource_lifecycle(common_values):
             values["lifecycle"] = lifecycle
 
+        if max_session_duration := common_values.get("max_session_duration"):
+            values["max_session_duration"] = max_session_duration
+
         role_tf_resource = aws_iam_role(identifier, **values)
         tf_resources.append(role_tf_resource)