rename, update

billing-policies/README.md

@@ -0,0 +1,53 @@
+# aws-inf-setup :: billing-policies
+
+This defines policies to be used for billing roles. It does not create any resources.
+
+```hcl
+module "billing" {
+  source = "git@github.e.it.census.gov:terraform-modules/aws-inf-setup.git//billing-policies"
+}
+
+module "role" {
+  source = ...
+  inline_policy = [ module.billing.billing_policies["full-billing"] ]
+}
+```
+
+## Requirements
+
+No requirements.
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | n/a |
+
+## Modules
+
+No modules.
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source |
+| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
+| [aws_iam_policy_document.full_billing](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.limited_billing](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_account_alias"></a> [account\_alias](#input\_account\_alias) | AWS Account Alias | `string` | `""` | no |
+| <a name="input_account_id"></a> [account\_id](#input\_account\_id) | AWS Account ID (default will pull from current user) | `string` | `""` | no |
+| <a name="input_override_prefixes"></a> [override\_prefixes](#input\_override\_prefixes) | Override built-in prefixes by component (efs, s3, ebs, kms, role, policy, security-group). This should be used primarily for common infrastructure things | `map(string)` | `{}` | no |
+| <a name="input_tags"></a> [tags](#input\_tags) | AWS Tags to apply to appropriate resources (S3, KMS).  Do not include safeguard tags here, use the data\_safeguard field for such things. | `map(string)` | `{}` | no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_billing_policies"></a> [billing\_policies](#output\_billing\_policies) | Map of label and policy JSON for billing accesses |

billing-policies/base_tags.tf

@@ -0,0 +1 @@
+../common/base_tags.tf

billing-policies/data.tf

@@ -0,0 +1 @@
+../common/data.tf

billing-policies/defaults.tf

@@ -0,0 +1 @@
+../common/defaults.tf

billing-policies/main.tf

@@ -0,0 +1,23 @@
+/*
+* # aws-inf-setup :: billing-policies
+* 
+* This defines policies to be used for billing roles. It does not create any resources.
+* 
+* ```hcl
+* module "billing" {
+*   source = "git@github.e.it.census.gov:terraform-modules/aws-inf-setup.git//billing-policies"
+* }
+* 
+* module "role" {
+*   source = ...
+*   inline_policy = [ module.billing.billing_policies["full-billing"] ]
+* }
+* ```
+*/
+
+locals {
+  base_tags = {
+    "boc:tf_module_version" = local._module_version
+    "boc:created_by"        = "terraform"
+  }
+}

billing-policies/outputs.tf

@@ -0,0 +1,18 @@
+output "billing_policies" {
+  description = "Map of label and policy JSON for billing accesses"
+  value = {
+    "full-billing"    = data.aws_iam_policy_document.full_billing.json
+    "limited-billing" = data.aws_iam_policy_document.limitd_billing.json
+  }
+}
+
+# output "full_billing" {
+#   description = "Map of label and policy JSON for full billing access"
+#   value = { "full-billing" = data.aws_iam_policy_document.full_billing.json }
+# }
+# 
+# output "limited_billing" {
+#   description = "Map of label and policy JSON for limied billing access"
+#   value = { "limited-billing" = data.aws_iam_policy_document.limited_billing.json }
+# }
+# 

billing-policies/policy.tf

@@ -0,0 +1,41 @@
+data "aws_iam_policy_document" "full_billing" {
+  statement {
+    sid       = "FullBillingAccess"
+    effect    = "Allow"
+    resources = ["*"]
+
+    actions = [
+      "aws-portal:View*",
+      "ce:Describe*",
+      "ce:Get*",
+      "ce:List*",
+      "ce:CreateNotificationSubscription",
+      "ce:CreateReport",
+      "ce:DeleteNotificationSubscription",
+      "ce:DeleteReport",
+      "ce:UpdateNotificationSubscription",
+      "ce:UpdateReport",
+      "ce:UpdatePreferences",
+      "budgets:View*",
+      "budgets:Describe*",
+      #"budgets:*",
+      # add others, to allow cost explorer and budgets
+    ]
+  }
+}
+
+data "aws_iam_policy_document" "limited_billing" {
+  statement {
+    sid       = "LimitedBillingAccess"
+    effect    = "Allow"
+    resources = ["*"]
+
+    actions = [
+      "aws-portal:View*",
+      "ce:Describe*",
+      "ce:Get*",
+      "ce:List*",
+      # put in right set of things for cost explorer and read access to billing
+    ]
+  }
+}

billing-policies/prefixes.tf

@@ -0,0 +1 @@
+../common/prefixes.tf

billing-policies/variables.common.tf

@@ -0,0 +1 @@
+../common/variables.common.tf

billing-policies/version.tf

@@ -0,0 +1 @@
+../common/version.tf