From 69a6f63794266ba6928d0ba718cae5d0f0a6b33e Mon Sep 17 00:00:00 2001 From: badra001 Date: Fri, 17 Jun 2022 08:03:08 -0400 Subject: [PATCH] add inline_policies, path, code for access keys --- CHANGELOG.md | 5 ++++ README.md | 17 ++++++++++++- access_keys.tf | 51 +++++++++++++++++++++++++++++++++++++++ base_tags.tf | 7 ++++++ data.tf | 16 ------------ locals.tf | 6 +++++ main.tf | 24 +++++++++++------- outputs.access_keys.tf | 20 +++++++++++++++ templates/rotate-keys.tpl | 5 ++++ variables.tf | 26 +++++++++++++++++++- version.tf | 3 ++- 11 files changed, 152 insertions(+), 28 deletions(-) create mode 100644 access_keys.tf create mode 100644 base_tags.tf create mode 100644 locals.tf create mode 100644 outputs.access_keys.tf create mode 100644 templates/rotate-keys.tpl diff --git a/CHANGELOG.md b/CHANGELOG.md index 03fcf95..0abe244 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -40,3 +40,8 @@ * 2.6.0 -- 2022-05-20 - update bin/show-user-info.sh to accept TFCOMMAND for an alternate terraform binary, or to pull from the git root file + +* 2.7.0 -- 2022-06-17 + - add inline_policies + - add path + - enable code for creating access keys diff --git a/README.md b/README.md index 55c9a00..0d24c7a 100644 --- a/README.md +++ b/README.md @@ -35,6 +35,7 @@ module "admin_user_bond0007" { # roles = [ ] # saml_role = [ "role-name" ] # create_access_keys = true + # inline_policies = [ { name = "my-policy", policy = data.aws_iam_policy_document.my-policy.json } ] } ``` @@ -47,6 +48,9 @@ No requirements. | Name | Version | |------|---------| | [aws](#provider\_aws) | n/a | +| [local](#provider\_local) | n/a | +| [null](#provider\_null) | n/a | +| [time](#provider\_time) | n/a | ## Modules @@ -58,11 +62,16 @@ No requirements. | Name | Type | |------|------| +| [aws_iam_access_key.iam_access_key_v1](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_access_key) | resource | | [aws_iam_user.user](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user) | resource | | [aws_iam_user_group_membership.user_groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_group_membership) | resource | | [aws_iam_user_login_profile.user](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_login_profile) | resource | +| [aws_iam_user_policy.user_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_policy) | resource | | [aws_iam_user_policy_attachment.user_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_policy_attachment) | resource | | [aws_ses_email_identity.user_send_mail](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ses_email_identity) | resource | +| [local_file.rotate_keys_tfvars](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file) | resource | +| [null_resource.rotate_keys_tfvars](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | +| [time_sleep.wait_iam_access_key_v1](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource | | [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source | | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | | [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | @@ -72,13 +81,17 @@ No requirements. | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | [attached\_policies](#input\_attached\_policies) | List of IAM Policy ARNs to attach to this user (only for service accounts) | `list(string)` | `[]` | no | -| [create\_access\_keys](#input\_create\_access\_keys) | Set to 1 or true to create access keys (not implemented) | `bool` | `false` | no | +| [component\_tags](#input\_component\_tags) | Additional tags for Components (role, policy) | `map(map(string))` | 
{
  "policy": {},
  "user": {}
}
| no | +| [create\_access\_keys](#input\_create\_access\_keys) | Flag to create access keys | `bool` | `false` | no | | [email\_address](#input\_email\_address) | Email address for the user | `string` | n/a | yes | | [enable\_sending\_mail](#input\_enable\_sending\_mail) | Enable using email address for the user from SES | `bool` | `false` | no | | [generate\_password](#input\_generate\_password) | Flag to generate\_password upon creation (requires pgp\_key set) | `bool` | `false` | no | | [groups](#input\_groups) | Groups to which the user belongs | `list(string)` | `[]` | no | | [iam\_username](#input\_iam\_username) | AWS username for user (default a-username) | `string` | `""` | no | +| [inline\_policies](#input\_inline\_policies) | List of IAM Policy Document objects to include in this role. Format is {name=name,policy=policy-json} | `list(object({ name = string, policy = string }))` | `[]` | no | +| [path](#input\_path) | IAM path | `string` | `"/"` | no | | [pgp\_key](#input\_pgp\_key) | PGP key used to encrypt access key | `string` | `""` | no | +| [profile](#input\_profile) | AWS Profile Name, used generating key rotation file | `string` | `null` | no | | [reference](#input\_reference) | Remedy ticket reference number for the user | `string` | `""` | no | | [roles](#input\_roles) | Roles to which the user belongs | `list(string)` | `[]` | no | | [saml\_role](#input\_saml\_role) | SAML role for user | `list(string)` | `[]` | no | @@ -90,6 +103,8 @@ No requirements. | Name | Description | |------|-------------| +| [aws\_access\_key\_id](#output\_aws\_access\_key\_id) | AWS Access Key (current) | +| [aws\_secret\_access\_key](#output\_aws\_secret\_access\_key) | AWS Secret Access Key [encrypted] (current) | | [user\_arn](#output\_user\_arn) | User ARN | | [user\_name](#output\_user\_name) | User name | | [user\_password](#output\_user\_password) | User Password | diff --git a/access_keys.tf b/access_keys.tf new file mode 100644 index 0000000..54a0aa4 --- /dev/null +++ b/access_keys.tf @@ -0,0 +1,51 @@ +resource "aws_iam_access_key" "iam_access_key_v1" { + count = var.create_access_keys ? 1 : 0 + user = aws_iam_user.user.name + pgp_key = file(var.gpg_key_file) + + depends_on = [time_sleep.wait_iam_access_key_v1] +} + +# this gives a prior key time to be removed. When doing just one key like +# here, this may not be necessary +resource "time_sleep" "wait_iam_access_key_v1" { + count = var.create_access_keys ? 1 : 0 + + create_duration = "60s" +} + +locals { + rotate_keys_tfvars = templatefile("${path.module}/templates/rotate-keys.tpl", + { + username = aws_iam_user.user.name + region = local.environment == "ew" ? "us-east-1" : "us-gov-east-1" + profile = var.profile + pgp_key_file = var.ppg_key_file + }) +} + +resource "null_resource" "rotate_keys_tfvars" { + count = var.create_access_keys ? 1 : 0 + triggers = { + username = aws_iam_user.user.name + access_keys_directory = format("access_keys/%v", aws_iam_user.user.name) + } + + provisioner "local-exec" { + when = create + command = "test -d ${path.root}/${self.triggers.access_keys_directory} || mkdir -p ${path.root}/${self.triggers.access_keys_directory}" + } + + # provisioner "local-exec" { + # when = create + # working_dir = self.triggers.access_keys_directory + # command = "ln -sf ../../${var.ppg_key_file} ." + # } +} + +resource "local_file" "rotate_keys_tfvars" { + count = var.create_access_keys ? 1 : 0 + content = local.rotate_keys_tfvars + + depends_on = [null_resource.rotate_keys_tfvars] +} diff --git a/base_tags.tf b/base_tags.tf new file mode 100644 index 0000000..848cfbc --- /dev/null +++ b/base_tags.tf @@ -0,0 +1,7 @@ +locals { + base_tags = { + "boc:tf_module_version" = local._module_version + "boc:tf_module_name" = local._module_name + "boc:created_by" = "terraform" + } +} diff --git a/data.tf b/data.tf index c99f19d..16506e6 100644 --- a/data.tf +++ b/data.tf @@ -5,19 +5,3 @@ data "aws_arn" "current" { } data "aws_region" "current" {} - -# output "caller_account_id" { -# value = data.aws_caller_identity.current.account_id -# } -# -# output "account_caller_arn" { -# value = data.aws_caller_identity.current.arn -# } -# -# output "account_caller_arn_partition" { -# value = data.aws_arn.current.partition -# } -# -# output "account_region_name" { -# value = data.aws_region.current.name -# } diff --git a/locals.tf b/locals.tf new file mode 100644 index 0000000..24d3131 --- /dev/null +++ b/locals.tf @@ -0,0 +1,6 @@ +locals { + # account_id = var.account_id != "" ? var.account_id : data.aws_caller_identity.current.account_id + account_id = data.aws_caller_identity.current.account_id + account_environment = data.aws_arn.current.partition == "aws-us-gov" ? "gov" : "ew" + region = data.aws_region.current.name +} diff --git a/main.tf b/main.tf index 218acf0..6f9d953 100644 --- a/main.tf +++ b/main.tf @@ -36,6 +36,7 @@ * # roles = [ ] * # saml_role = [ "role-name" ] * # create_access_keys = true +* # inline_policies = [ { name = "my-policy", policy = data.aws_iam_policy_document.my-policy.json } ] * } * ``` */ @@ -45,8 +46,8 @@ locals { username = lower(var.username) iam_username = var.iam_username != "" ? var.iam_username : "a-${local.username}" email_address = var.email_address != "" ? lower(var.email_address) : module.user_email.search_result["attribute_value"][0] - pgp_key_exists = var.pgp_key != "" ? 1 : 0 - generate_password = var.generate_password ? local.pgp_key_exists : 0 + pgp_key_exists = var.pgp_key != "" && fileexists(var.pgp_key) + generate_password = var.generate_password && local.pgp_key_exists user_password = local.generate_password == 1 ? element(concat(aws_iam_user_login_profile.user[*].encrypted_password, tolist([""])), 0) : "" ap1 = var.service_account ? var.attached_policies : [] ap2 = [for arn in local.ap1 : { @@ -70,15 +71,12 @@ locals { } tags = merge( + local.base_tags, var.tags, local.tags_username, local.tags_email[local.email_address != "" ? "exists" : "not_exists"], local.tags_service, local.tags_reference[var.reference != "" ? "exists" : "not_exists"], - { - "boc:tf_module_version" = local._module_version - "boc:created_by" = "terraform" - }, ) } @@ -87,17 +85,19 @@ locals { #--- resource "aws_iam_user" "user" { name = local.iam_username - tags = local.tags + path = var.path force_destroy = true + + tags = local.tags } #--- # login profile (if genrate password) #--- resource "aws_iam_user_login_profile" "user" { - count = local.generate_password + count = local.generate_password ? 1 : 0 user = aws_iam_user.user.name - pgp_key = var.pgp_key + pgp_key = local.generate_password ? var.pgp_key : null password_reset_required = true lifecycle { @@ -139,3 +139,9 @@ resource "aws_iam_user_policy_attachment" "user_policy" { policy_arn = each.value } + +resource "aws_iam_user_policy" "user_policy" { + for_each = { for p in local.inline_policies : p.name => p.policy } + user = aws_iam_user.user.name + policy = each.value +} diff --git a/outputs.access_keys.tf b/outputs.access_keys.tf new file mode 100644 index 0000000..78722e4 --- /dev/null +++ b/outputs.access_keys.tf @@ -0,0 +1,20 @@ +## output "aws_access_key_id_prev" { +## description = "AWS Access Key (previous)" +## value = "" +## } +## +## output "aws_secret_access_key_prev" { +## description = "AWS Secret Access Key [encrypted] (previous)" +## value = "" +## } + +output "aws_access_key_id" { + description = "AWS Access Key (current)" + value = var.create_access_key ? aws_iam_access_key.iam_access_key_v1[0].id : "" +} + +output "aws_secret_access_key" { + description = "AWS Secret Access Key [encrypted] (current)" + value = var.crate_access_key ? aws_iam_access_key.iam_access_key_v1[0].encrypted_secret : "" +} + diff --git a/templates/rotate-keys.tpl b/templates/rotate-keys.tpl new file mode 100644 index 0000000..a5807c3 --- /dev/null +++ b/templates/rotate-keys.tpl @@ -0,0 +1,5 @@ +username = "${username}" +region = "${region}" +profile = "${profile}" +service_profile = "" +gpg_key_file = "../../${pgp_key_file}" diff --git a/variables.tf b/variables.tf index 08775a9..79a6b15 100644 --- a/variables.tf +++ b/variables.tf @@ -60,11 +60,17 @@ variable "pgp_key" { # may be a sub-module by user after rotation variable "create_access_keys" { - description = "Set to 1 or true to create access keys (not implemented)" + description = "Flag to create access keys" type = bool default = false } +variable "profile" { + description = "AWS Profile Name, used generating key rotation file" + type = string + default = null +} + variable "tags" { description = "Additional tags to include on the objects" type = map(string) @@ -82,3 +88,21 @@ variable "attached_policies" { type = list(string) default = [] } + +variable "inline_policies" { + description = "List of IAM Policy Document objects to include in this role. Format is {name=name,policy=policy-json}" + type = list(object({ name = string, policy = string })) + default = [] +} + +variable "path" { + description = "IAM path" + type = string + default = "/" +} + +variable "component_tags" { + description = "Additional tags for Components (role, policy)" + type = map(map(string)) + default = { "user" = {}, "policy" = {} } +} diff --git a/version.tf b/version.tf index b061df5..997b4d4 100644 --- a/version.tf +++ b/version.tf @@ -1,3 +1,4 @@ locals { - _module_version = "2.6.0" + _module_name = "aws-iam-user" + _module_version = "2.7.0" }