From fe00fb2b30d0477739a6c75141a1ef70c349e597 Mon Sep 17 00:00:00 2001 From: badra001 Date: Wed, 12 May 2021 11:49:16 -0400 Subject: [PATCH] v2.5.0: add attached_policies --- CHANGES.md => CHANGELOG.md | 3 +++ README.md | 6 ++++++ main.tf | 19 ++++++++++++++++++- variables.tf | 6 ++++++ version.tf | 2 +- 5 files changed, 34 insertions(+), 2 deletions(-) rename CHANGES.md => CHANGELOG.md (83%) diff --git a/CHANGES.md b/CHANGELOG.md similarity index 83% rename from CHANGES.md rename to CHANGELOG.md index 806180a..4368dbb 100644 --- a/CHANGES.md +++ b/CHANGELOG.md @@ -27,3 +27,6 @@ * v2.4.0 -- 20210405 - use `ldap-get-attribute` to get email address + +* v2.5.0 -- 20210512 + - add `attached_policies` to enable adding policies for an IAM account (generally, just services) diff --git a/README.md b/README.md index 22d4e1b..fedc8b7 100644 --- a/README.md +++ b/README.md @@ -12,6 +12,9 @@ version. `roles`, `saml_role` and `create_access_keys` do not at this point do anything, though some effort is in progress to make access keys operational. +You can only attach a policy if the `service_account` is true. This example below will not fail, +but it will not attach a policy to the user account. + # Usage ```hcl @@ -27,6 +30,7 @@ module "admin_user_bond0007" { pgp_key = file("init/tf-gpg-key.b64") service_account = false enable_sending_mail = false + attached_policies = [ aws_iam_policy.mypolicy.arn ] # roles = [ ] # saml_role = [ "role-name" ] @@ -54,6 +58,7 @@ No requirements. | Name | Type | |------|------| +| [aws_iam_policy_attachment.user_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy_attachment) | resource | | [aws_iam_user.user](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user) | resource | | [aws_iam_user_group_membership.user_groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_group_membership) | resource | | [aws_iam_user_login_profile.user](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_login_profile) | resource | @@ -66,6 +71,7 @@ No requirements. | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| +| [attached\_policies](#input\_attached\_policies) | List of IAM Policy ARNs to attach to this user (only for service accounts) | `list(string)` | `[]` | no | | [create\_access\_keys](#input\_create\_access\_keys) | Set to 1 or true to create access keys (not implemented) | `bool` | `false` | no | | [email\_address](#input\_email\_address) | Email address for the user | `string` | n/a | yes | | [enable\_sending\_mail](#input\_enable\_sending\_mail) | Enable using email address for the user from SES | `bool` | `false` | no | diff --git a/main.tf b/main.tf index 7333f2c..3494da1 100644 --- a/main.tf +++ b/main.tf @@ -13,8 +13,10 @@ * `roles`, `saml_role` and `create_access_keys` do not at this point do anything, * though some effort is in progress to make access keys operational. * +* You can only attach a policy if the `service_account` is true. This example below will not fail, +* but it will not attach a policy to the user account. +* * # Usage -* * * ```hcl * module "admin_user_bond0007" { @@ -29,6 +31,7 @@ * pgp_key = file("init/tf-gpg-key.b64") * service_account = false * enable_sending_mail = false +* attached_policies = [ aws_iam_policy.mypolicy.arn ] * * # roles = [ ] * # saml_role = [ "role-name" ] @@ -44,6 +47,12 @@ locals { email_address = var.email_address != "" ? lower(var.email_address) : module.user_email.search_result["attribute_value"][0] pgp_key_exists = var.pgp_key != "" ? 1 : 0 generate_password = var.generate_password ? local.pgp_key_exists : 0 + ap1 = var.service_account ? var.attached_policies : [] + ap2 = [for arn in local.ap1 : { + "policy" = arn + "parts" = split("/", arn) + }] + attached_policies = { for v in local.ap2 : element(v.parts, length(v.parts) - 1) => v.policy } tags_username = var.service_account ? map("boc:id:contact", local.username) : map("boc:id:username", local.username) tags_email = { "exists" = { @@ -120,3 +129,11 @@ module "user_email" { filter = "cn=${local.username}" attribute = "mail" } + +resource "aws_iam_policy_attachment" "user_policy" { + for_each = local.attached_policies + name = format("%v-attachment", each.key) + users = aws_iam_user.user.user_name + policy_arn = each.value +} + diff --git a/variables.tf b/variables.tf index 1baefba..08775a9 100644 --- a/variables.tf +++ b/variables.tf @@ -76,3 +76,9 @@ variable "service_account" { type = bool default = false } + +variable "attached_policies" { + description = "List of IAM Policy ARNs to attach to this user (only for service accounts)" + type = list(string) + default = [] +} diff --git a/version.tf b/version.tf index f403a49..fca0743 100644 --- a/version.tf +++ b/version.tf @@ -1,3 +1,3 @@ locals { - _module_version = "2.4.0" + _module_version = "2.5.0" }