* 3.0.1 -- 2024-07-17

  - add permissions_boundary attribute

CHANGELOG.md

@@ -75,3 +75,6 @@
 
 * 3.0.0 -- 2023-11-22 tf-upgrade
   - if pgp_key_file is not provided (empty), it will use the secret vs encrypted secret, so that the secret can be used as input into other resources
+
+* 3.0.1 -- 2024-07-17
+  - add permissions_boundary attribute

README.md

@@ -138,6 +138,7 @@ No requirements.
 | <a name="input_iam_username"></a> [iam\_username](#input\_iam\_username) | AWS username for user (default a-username) | `string` | `""` | no |
 | <a name="input_inline_policies"></a> [inline\_policies](#input\_inline\_policies) | List of IAM Policy Document objects to include in this user. Format is {name=name,policy=policy-json} | `list(object({ name = string, policy = string }))` | `[]` | no |
 | <a name="input_path"></a> [path](#input\_path) | IAM path | `string` | `"/"` | no |
+| <a name="input_permissions_boundary"></a> [permissions\_boundary](#input\_permissions\_boundary) | ARN of permission boundary policy | `string` | `null` | no |
 | <a name="input_pgp_key"></a> [pgp\_key](#input\_pgp\_key) | PGP key used to encrypt access key | `string` | `""` | no |
 | <a name="input_pgp_key_file"></a> [pgp\_key\_file](#input\_pgp\_key\_file) | PGP key filename for encrypting the access key (supercedes pgp\_key) | `string` | `""` | no |
 | <a name="input_profile"></a> [profile](#input\_profile) | AWS Profile Name, used generating key rotation file | `string` | `null` | no |

main.tf

@@ -130,9 +130,10 @@ locals {
 # user setup
 #---
 resource "aws_iam_user" "user" {
-  name          = local.iam_username
-  path          = var.path
-  force_destroy = true
+  name                 = local.iam_username
+  path                 = var.path
+  force_destroy        = true
+  permissions_boundary = var.permissions_boundary
 
   tags = local.tags
 }

variables.tf

@@ -112,3 +112,9 @@ variable "component_tags" {
   type        = map(map(string))
   default     = { "user" = {}, "policy" = {} }
 }
+
+variable "permissions_boundary" {
+  description = "ARN of permission boundary policy"
+  type        = string
+  default     = null
+}

version.tf

@@ -1,4 +1,4 @@
 locals {
   _module_name    = "aws-iam-user"
-  _module_version = "3.0.0"
+  _module_version = "3.0.1"
 }