add inline_policies, path, code for access keys

CHANGELOG.md

@@ -40,3 +40,8 @@
 
 * 2.6.0 -- 2022-05-20
   - update bin/show-user-info.sh to accept TFCOMMAND for an alternate terraform binary, or to pull from the git root file
+
+* 2.7.0 -- 2022-06-17
+  - add inline_policies
+  - add path
+  - enable code for creating access keys

README.md

@@ -35,6 +35,7 @@ module "admin_user_bond0007" {
   # roles               = [ ]
   # saml_role          = [ "role-name" ]
   # create_access_keys = true
+  # inline_policies    = [ { name = "my-policy", policy = data.aws_iam_policy_document.my-policy.json } ]
 }
 ```
 
@@ -47,6 +48,9 @@ No requirements.
 | Name | Version |
 |------|---------|
 | <a name="provider_aws"></a> [aws](#provider\_aws) | n/a |
+| <a name="provider_local"></a> [local](#provider\_local) | n/a |
+| <a name="provider_null"></a> [null](#provider\_null) | n/a |
+| <a name="provider_time"></a> [time](#provider\_time) | n/a |
 
 ## Modules
 
@@ -58,11 +62,16 @@ No requirements.
 
 | Name | Type |
 |------|------|
+| [aws_iam_access_key.iam_access_key_v1](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_access_key) | resource |
 | [aws_iam_user.user](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user) | resource |
 | [aws_iam_user_group_membership.user_groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_group_membership) | resource |
 | [aws_iam_user_login_profile.user](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_login_profile) | resource |
+| [aws_iam_user_policy.user_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_policy) | resource |
 | [aws_iam_user_policy_attachment.user_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_policy_attachment) | resource |
 | [aws_ses_email_identity.user_send_mail](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ses_email_identity) | resource |
+| [local_file.rotate_keys_tfvars](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file) | resource |
+| [null_resource.rotate_keys_tfvars](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
+| [time_sleep.wait_iam_access_key_v1](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
 | [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source |
 | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
 | [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
@@ -72,13 +81,17 @@ No requirements.
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | <a name="input_attached_policies"></a> [attached\_policies](#input\_attached\_policies) | List of IAM Policy ARNs to attach to this user (only for service accounts) | `list(string)` | `[]` | no |
-| <a name="input_create_access_keys"></a> [create\_access\_keys](#input\_create\_access\_keys) | Set to 1 or true to create access keys (not implemented) | `bool` | `false` | no |
+| <a name="input_component_tags"></a> [component\_tags](#input\_component\_tags) | Additional tags for Components (role, policy) | `map(map(string))` | <pre>{<br>  "policy": {},<br>  "user": {}<br>}</pre> | no |
+| <a name="input_create_access_keys"></a> [create\_access\_keys](#input\_create\_access\_keys) | Flag to create access keys | `bool` | `false` | no |
 | <a name="input_email_address"></a> [email\_address](#input\_email\_address) | Email address for the user | `string` | n/a | yes |
 | <a name="input_enable_sending_mail"></a> [enable\_sending\_mail](#input\_enable\_sending\_mail) | Enable using email address for the user from SES | `bool` | `false` | no |
 | <a name="input_generate_password"></a> [generate\_password](#input\_generate\_password) | Flag to generate\_password upon creation (requires pgp\_key set) | `bool` | `false` | no |
 | <a name="input_groups"></a> [groups](#input\_groups) | Groups to which the user belongs | `list(string)` | `[]` | no |
 | <a name="input_iam_username"></a> [iam\_username](#input\_iam\_username) | AWS username for user (default a-username) | `string` | `""` | no |
+| <a name="input_inline_policies"></a> [inline\_policies](#input\_inline\_policies) | List of IAM Policy Document objects to include in this role. Format is {name=name,policy=policy-json} | `list(object({ name = string, policy = string }))` | `[]` | no |
+| <a name="input_path"></a> [path](#input\_path) | IAM path | `string` | `"/"` | no |
 | <a name="input_pgp_key"></a> [pgp\_key](#input\_pgp\_key) | PGP key used to encrypt access key | `string` | `""` | no |
+| <a name="input_profile"></a> [profile](#input\_profile) | AWS Profile Name, used generating key rotation file | `string` | `null` | no |
 | <a name="input_reference"></a> [reference](#input\_reference) | Remedy ticket reference number for the user | `string` | `""` | no |
 | <a name="input_roles"></a> [roles](#input\_roles) | Roles to which the user belongs | `list(string)` | `[]` | no |
 | <a name="input_saml_role"></a> [saml\_role](#input\_saml\_role) | SAML role for user | `list(string)` | `[]` | no |
@@ -90,6 +103,8 @@ No requirements.
 
 | Name | Description |
 |------|-------------|
+| <a name="output_aws_access_key_id"></a> [aws\_access\_key\_id](#output\_aws\_access\_key\_id) | AWS Access Key (current) |
+| <a name="output_aws_secret_access_key"></a> [aws\_secret\_access\_key](#output\_aws\_secret\_access\_key) | AWS Secret Access Key [encrypted] (current) |
 | <a name="output_user_arn"></a> [user\_arn](#output\_user\_arn) | User ARN |
 | <a name="output_user_name"></a> [user\_name](#output\_user\_name) | User name |
 | <a name="output_user_password"></a> [user\_password](#output\_user\_password) | User Password |

access_keys.tf

@@ -0,0 +1,51 @@
+resource "aws_iam_access_key" "iam_access_key_v1" {
+  count   = var.create_access_keys ? 1 : 0
+  user    = aws_iam_user.user.name
+  pgp_key = file(var.gpg_key_file)
+
+  depends_on = [time_sleep.wait_iam_access_key_v1]
+}
+
+# this gives a prior key time to be removed.  When doing just one key like
+# here, this may not be necessary
+resource "time_sleep" "wait_iam_access_key_v1" {
+  count = var.create_access_keys ? 1 : 0
+
+  create_duration = "60s"
+}
+
+locals {
+  rotate_keys_tfvars = templatefile("${path.module}/templates/rotate-keys.tpl",
+    {
+      username     = aws_iam_user.user.name
+      region       = local.environment == "ew" ? "us-east-1" : "us-gov-east-1"
+      profile      = var.profile
+      pgp_key_file = var.ppg_key_file
+  })
+}
+
+resource "null_resource" "rotate_keys_tfvars" {
+  count = var.create_access_keys ? 1 : 0
+  triggers = {
+    username              = aws_iam_user.user.name
+    access_keys_directory = format("access_keys/%v", aws_iam_user.user.name)
+  }
+
+  provisioner "local-exec" {
+    when    = create
+    command = "test -d ${path.root}/${self.triggers.access_keys_directory} || mkdir -p ${path.root}/${self.triggers.access_keys_directory}"
+  }
+
+  #  provisioner "local-exec" { 
+  #    when = create
+  #    working_dir = self.triggers.access_keys_directory 
+  #    command = "ln -sf ../../${var.ppg_key_file} ."
+  #  }
+}
+
+resource "local_file" "rotate_keys_tfvars" {
+  count   = var.create_access_keys ? 1 : 0
+  content = local.rotate_keys_tfvars
+
+  depends_on = [null_resource.rotate_keys_tfvars]
+}

base_tags.tf

@@ -0,0 +1,7 @@
+locals {
+  base_tags = {
+    "boc:tf_module_version" = local._module_version
+    "boc:tf_module_name"    = local._module_name
+    "boc:created_by"        = "terraform"
+  }
+}

data.tf

@@ -5,19 +5,3 @@ data "aws_arn" "current" {
 }
 
 data "aws_region" "current" {}
-
-# output "caller_account_id" {
-#   value = data.aws_caller_identity.current.account_id
-# }
-#
-# output "account_caller_arn" {
-#   value = data.aws_caller_identity.current.arn
-# }
-#
-# output "account_caller_arn_partition" {
-#   value = data.aws_arn.current.partition
-# }
-#
-# output "account_region_name" {
-#   value = data.aws_region.current.name
-# }

locals.tf

@@ -0,0 +1,6 @@
+locals {
+  #  account_id          = var.account_id != "" ? var.account_id : data.aws_caller_identity.current.account_id
+  account_id          = data.aws_caller_identity.current.account_id
+  account_environment = data.aws_arn.current.partition == "aws-us-gov" ? "gov" : "ew"
+  region              = data.aws_region.current.name
+}

main.tf

@@ -36,6 +36,7 @@
 *   # roles               = [ ]
 *   # saml_role          = [ "role-name" ]
 *   # create_access_keys = true
+*   # inline_policies    = [ { name = "my-policy", policy = data.aws_iam_policy_document.my-policy.json } ]
 * }
 * ```
 */
@@ -45,8 +46,8 @@ locals {
   username          = lower(var.username)
   iam_username      = var.iam_username != "" ? var.iam_username : "a-${local.username}"
   email_address     = var.email_address != "" ? lower(var.email_address) : module.user_email.search_result["attribute_value"][0]
-  pgp_key_exists    = var.pgp_key != "" ? 1 : 0
-  generate_password = var.generate_password ? local.pgp_key_exists : 0
+  pgp_key_exists    = var.pgp_key != "" && fileexists(var.pgp_key)
+  generate_password = var.generate_password && local.pgp_key_exists
   user_password     = local.generate_password == 1 ? element(concat(aws_iam_user_login_profile.user[*].encrypted_password, tolist([""])), 0) : ""
   ap1               = var.service_account ? var.attached_policies : []
   ap2 = [for arn in local.ap1 : {
@@ -70,15 +71,12 @@ locals {
   }
 
   tags = merge(
+    local.base_tags,
     var.tags,
     local.tags_username,
     local.tags_email[local.email_address != "" ? "exists" : "not_exists"],
     local.tags_service,
     local.tags_reference[var.reference != "" ? "exists" : "not_exists"],
-    {
-      "boc:tf_module_version" = local._module_version
-      "boc:created_by"        = "terraform"
-    },
   )
 }
 
@@ -87,17 +85,19 @@ locals {
 #---
 resource "aws_iam_user" "user" {
   name          = local.iam_username
-  tags          = local.tags
+  path          = var.path
   force_destroy = true
+
+  tags = local.tags
 }
 
 #---
 # login profile (if genrate password)
 #---
 resource "aws_iam_user_login_profile" "user" {
-  count                   = local.generate_password
+  count                   = local.generate_password ? 1 : 0
   user                    = aws_iam_user.user.name
-  pgp_key                 = var.pgp_key
+  pgp_key                 = local.generate_password ? var.pgp_key : null
   password_reset_required = true
 
   lifecycle {
@@ -139,3 +139,9 @@ resource "aws_iam_user_policy_attachment" "user_policy" {
   policy_arn = each.value
 }
 
+
+resource "aws_iam_user_policy" "user_policy" {
+  for_each = { for p in local.inline_policies : p.name => p.policy }
+  user     = aws_iam_user.user.name
+  policy   = each.value
+}

outputs.access_keys.tf

@@ -0,0 +1,20 @@
+## output "aws_access_key_id_prev" {
+##   description = "AWS Access Key (previous)"
+##   value = ""
+## }
+## 
+## output "aws_secret_access_key_prev" {
+##   description = "AWS Secret Access Key [encrypted] (previous)"
+##   value = ""
+## }
+
+output "aws_access_key_id" {
+  description = "AWS Access Key (current)"
+  value       = var.create_access_key ? aws_iam_access_key.iam_access_key_v1[0].id : ""
+}
+
+output "aws_secret_access_key" {
+  description = "AWS Secret Access Key [encrypted] (current)"
+  value       = var.crate_access_key ? aws_iam_access_key.iam_access_key_v1[0].encrypted_secret : ""
+}
+

templates/rotate-keys.tpl

@@ -0,0 +1,5 @@
+username        = "${username}"
+region          = "${region}"
+profile         = "${profile}"
+service_profile = ""
+gpg_key_file    = "../../${pgp_key_file}"

variables.tf

@@ -60,11 +60,17 @@ variable "pgp_key" {
 
 # may be a sub-module by user after rotation
 variable "create_access_keys" {
-  description = "Set to 1 or true to create access keys (not implemented)"
+  description = "Flag to create access keys"
   type        = bool
   default     = false
 }
 
+variable "profile" {
+  description = "AWS Profile Name, used generating key rotation file"
+  type        = string
+  default     = null
+}
+
 variable "tags" {
   description = "Additional tags to include on the objects"
   type        = map(string)
@@ -82,3 +88,21 @@ variable "attached_policies" {
   type        = list(string)
   default     = []
 }
+
+variable "inline_policies" {
+  description = "List of IAM Policy Document objects to include in this role. Format is {name=name,policy=policy-json}"
+  type        = list(object({ name = string, policy = string }))
+  default     = []
+}
+
+variable "path" {
+  description = "IAM path"
+  type        = string
+  default     = "/"
+}
+
+variable "component_tags" {
+  description = "Additional tags for Components (role, policy)"
+  type        = map(map(string))
+  default     = { "user" = {}, "policy" = {} }
+}

version.tf

@@ -1,3 +1,4 @@
 locals {
-  _module_version = "2.6.0"
+  _module_name    = "aws-iam-user"
+  _module_version = "2.7.0"
 }