About aws-iam-role

This module will create an IAM role. Its primary purpose is for a SAML-enbled role, and to create the necessary LDAP object in eBOCAS, provided credentials and the provider exists (it checks for this). The ldap-provider binary is expected to be in your $PATH.

There are some quirks to the ldap-provider (we use this one), where if any details change in the DN or the DN cannot be constructed due to missing data, a tcp connection closed message occurs.

Because of this quirk, this is a two-step apply. The first step creates the IAM role and creates an LDIF file in setup/{role-name}.ldif. It uses the presence of this file to create the LDAP object in the second step. Example:

Step 1, creates role and null resource

% terraform apply -target=module.myrole

Step 2, creates ldap object

% terraform apply -target=module.myrole

Notes

On 2023-10-11, TCO changed the LDAP servers to (1) require authentication, and (2) update the TLS certificate. Because of #1, the provider calls to the LDAP provider must provide credentials. This module requires you to pass a proper ldap profile that includes credentials, even if you are not going to create an LDAP role.

The server replacements are as folows:

ldap.e.tco.census.gov => ldap2.e.tco.census.gov
ldap.tco.census.gov => nldap2.tco.census.gov
nldap.tco.census.gov => nldap2.tco.census.gov

Policies

When using attached_policies, it is important those policy ARNs exist before attempting to use the module with plan or apply. The module is called with an unknown value and it fails if not. You'll need to target your first apply with that of the policy like:

tf-apply -target=aws_iam_policy.mypolicy

and then you can continue with the rest of the operation. In Terraform 0.12, modules do not support depends_on.

LDAP Settings

You will get a very weird error about the LDAP provider having an invalid DN format if you pass anything to ldap_user variable that does not look like a DN (cn=something,...). Be sure you've got a valid username and password for LDAP. It's less important if you do not have enable_ldap_creation set to true (not sure if it will fail though).

Usage

Creating a SAML role with two attached policies

module "myrole1" {
  source = "git@github.e.it.census.gov:terraform-modules/aws-iam-role.git"
  providers = {
    ldap = ldap.ebocas
  }

  role_name                  = "my-role1"
  role_description           = "Role to do some super cool stuff"
  saml_provider_arn          = "arn:aws:iam::079788916859:saml-provider/Census_TCO_IDMS"
  enable_ldap_creation       = true
  assume_policy_document     = data.terraform_remote_state.common.outputs.saml_assume_json
  attached_policies          = [ data.aws_iam_policy.aws-managed-administratoraccess.arn,
                                 aws_iam_policy.role_assume.arn ]
  ldap_user                  = "cn=myuser,ou=Application,o=U.S. Census Bureau,c=US"
  ldap_password              = "password1234$$"

  # optional
  max_session_duration       = 14400 # 4h
  ldap_host                  = "ldap2.e.tco.census.gov"
  ldap_port                  = 389
}

Creating a non-SAML role

module "myrole2" {
  source = "git@github.e.it.census.gov:terraform-modules/aws-iam-role.git"
  providers = {
    ldap = ldap
  }

  role_name                  = "my-role2"
  attached_policies          = [ data.aws_iam_policy.aws-managed-readonlyaccess.arn ]

  # optional
  enable_instance_profile    = false
}

Creating a non-SAML role with inline policies

data "aws_iam_document_policy" "my-policy-1" {
  statement {
    sid = "NameOfPermissiosn"
    # rest of stuff
  }
}

module "myrole3" {
  source = "git@github.e.it.census.gov:terraform-modules/aws-iam-role.git"
  providers = {
    ldap = ldap
  }

  role_name                  = "my-role3"
  attached_policies          = [ data.aws_iam_policy.aws-managed-readonlyaccess.arn ]
  inline_policies            = [
    {
      name = "my-policy-1"
      policy = data.aws_iam_policy_document.my-policy-1.json
    }
  ]
}

Requirements

Name	Version
aws	>= 3.66.0
external	~> 1.1

Providers

Name	Version
aws	>= 3.66.0
external	~> 1.1
ldap	n/a
null	n/a
template	n/a

Modules

No modules.

Resources

Name	Type
aws_iam_instance_profile.role	resource
aws_iam_role.role	resource
aws_iam_role_policy_attachment.role	resource
ldap_object.role	resource
null_resource.role_ldif	resource
aws_arn.current	data source
aws_caller_identity.current	data source
aws_iam_policy_document.ec2_assume	data source
aws_region.current	data source
external_external.ldap_provider_bin	data source
template_file.role	data source

Inputs

Name	Description	Type	Default	Required
account_alias	AWS Account Alias	`string`	`""`	no
account_id	AWS Account ID (default will pull from current user)	`string`	`""`	no
assume_policy_document	JSON policy document for role to assume (i.e., the SAML assume document)	`string`	`""`	no
attached_policies	List of IAM Policy ARNs to attach to this role	`list(string)`	`[]`	no
component_tags	Additional tags for Components (role, policy)	`map(map(string))`	{ "policy": {}, "role": {} }	no
create	Flag to indicate whether to create the resources or not (default: true)	`bool`	`true`	no
enable_instance_profile	Flag to enable/disable instance profile on role	`bool`	`false`	no
enable_ldap_creation	Flag to enable/disable LDAP object creation for role group (for SAML only). Also requires LDAP credentials.	`bool`	`false`	no
inline_policies	List of IAM Policy Document objects to include in this role. Format is {name=name,policy=policy-json}	`list(object({ name = string, policy = string }))`	`[]`	no
instance_profile_path	Instance profile path	`string`	`"/"`	no
ldap_host	LDAP Hostname (default is for eBOCAS)	`string`	`"ldap2.e.tco.census.gov"`	no
ldap_password	LDAP password for ldap_user for writing data into eDirectory or Active Directory	`string`	`""`	no
ldap_port	LDAP port (default is 389 but also using STARTTLS)	`number`	`389`	no
ldap_user	LDAP user for writing data into eDirectory or Active Directory	`string`	`""`	no
max_session_duration	Override the maximum session duration from the default (3600)	`number`	`3600`	no
override_prefixes	Override built-in prefixes by component (role, policy). This should be used primarily for common infrastructure things	`map(string)`	`{}`	no
role_description	Role/application description	`string`	`""`	no
role_name	Role/application name without prefix	`string`	n/a	yes
saml_provider_arn	ARN of SAML Provider	`string`	`""`	no
tags	AWS Tags to apply to appropriate resources (S3, KMS). Do not include safeguard tags here, use the data_safeguard field for such things.	`map(string)`	`{}`	no

Outputs

Name	Description
instance_profile_arn	Created instance profile ARN, if enabled
instance_profile_name	Created instance profile name, if enabled
ldap_dn	Created LDAP DN for role (empty if ldap is not enabled)
role_arn	Created role ARN
role_name	Created role name

morga471/aws-iam-role

About

Resources

Stars

Watchers

Forks

Releases

Languages