diff --git a/CHANGELOG.md b/CHANGELOG.md index 597717f..4f1f86b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -169,3 +169,6 @@ * 2.0.1 -- 2022-05-24 - billing-policies - add submodule for policies + +* 2.0.2 -- 2022-05-24 + - remove billing-policies, move into iam-general-policies diff --git a/billing-policies/README.md b/billing-policies/README.md deleted file mode 100644 index 9330901..0000000 --- a/billing-policies/README.md +++ /dev/null @@ -1,53 +0,0 @@ -# aws-inf-setup :: billing-policies - -This defines policies to be used for billing roles. It does not create any resources. - -```hcl -module "billing" { - source = "git@github.e.it.census.gov:terraform-modules/aws-inf-setup.git//billing-policies" -} - -module "role" { - source = ... - inline_policy = [ module.billing.policies["full-billing"] ] -} -``` - -## Requirements - -No requirements. - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | n/a | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source | -| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | -| [aws_iam_policy_document.full_billing](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_iam_policy_document.limited_billing](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [account\_alias](#input\_account\_alias) | AWS Account Alias | `string` | `""` | no | -| [account\_id](#input\_account\_id) | AWS Account ID (default will pull from current user) | `string` | `""` | no | -| [override\_prefixes](#input\_override\_prefixes) | Override built-in prefixes by component (efs, s3, ebs, kms, role, policy, security-group). This should be used primarily for common infrastructure things | `map(string)` | `{}` | no | -| [tags](#input\_tags) | AWS Tags to apply to appropriate resources (S3, KMS). Do not include safeguard tags here, use the data\_safeguard field for such things. | `map(string)` | `{}` | no | - -## Outputs - -| Name | Description | -|------|-------------| -| [policies](#output\_policies) | Map of label and policy JSON for billing accesses | diff --git a/billing-policies/base_tags.tf b/billing-policies/base_tags.tf deleted file mode 120000 index 91c15aa..0000000 --- a/billing-policies/base_tags.tf +++ /dev/null @@ -1 +0,0 @@ -../common/base_tags.tf \ No newline at end of file diff --git a/billing-policies/data.tf b/billing-policies/data.tf deleted file mode 120000 index 995624d..0000000 --- a/billing-policies/data.tf +++ /dev/null @@ -1 +0,0 @@ -../common/data.tf \ No newline at end of file diff --git a/billing-policies/defaults.tf b/billing-policies/defaults.tf deleted file mode 120000 index a5556ac..0000000 --- a/billing-policies/defaults.tf +++ /dev/null @@ -1 +0,0 @@ -../common/defaults.tf \ No newline at end of file diff --git a/billing-policies/main.tf b/billing-policies/main.tf deleted file mode 100644 index 47ffbd4..0000000 --- a/billing-policies/main.tf +++ /dev/null @@ -1,17 +0,0 @@ -/* -* # aws-inf-setup :: billing-policies -* -* This defines policies to be used for billing roles. It does not create any resources. -* -* ```hcl -* module "billing" { -* source = "git@github.e.it.census.gov:terraform-modules/aws-inf-setup.git//billing-policies" -* } -* -* module "role" { -* source = ... -* inline_policy = [ module.billing.policies["full-billing"] ] -* } -* ``` -*/ - diff --git a/billing-policies/outputs.tf b/billing-policies/outputs.tf deleted file mode 100644 index 806eb8e..0000000 --- a/billing-policies/outputs.tf +++ /dev/null @@ -1,18 +0,0 @@ -output "policies" { - description = "Map of label and policy JSON for billing accesses" - value = { - "full-billing" = data.aws_iam_policy_document.full_billing.json - "limited-billing" = data.aws_iam_policy_document.limited_billing.json - } -} - -# output "full_billing" { -# description = "Map of label and policy JSON for full billing access" -# value = { "full-billing" = data.aws_iam_policy_document.full_billing.json } -# } -# -# output "limited_billing" { -# description = "Map of label and policy JSON for limied billing access" -# value = { "limited-billing" = data.aws_iam_policy_document.limited_billing.json } -# } -# diff --git a/billing-policies/policy.tf b/billing-policies/policy.tf deleted file mode 100644 index e94a654..0000000 --- a/billing-policies/policy.tf +++ /dev/null @@ -1,41 +0,0 @@ -data "aws_iam_policy_document" "full_billing" { - statement { - sid = "FullBillingAccess" - effect = "Allow" - resources = ["*"] - - actions = [ - "aws-portal:View*", - "ce:Describe*", - "ce:Get*", - "ce:List*", - "ce:CreateNotificationSubscription", - "ce:CreateReport", - "ce:DeleteNotificationSubscription", - "ce:DeleteReport", - "ce:UpdateNotificationSubscription", - "ce:UpdateReport", - "ce:UpdatePreferences", - "budgets:View*", - "budgets:Describe*", - #"budgets:*", - # add others, to allow cost explorer and budgets - ] - } -} - -data "aws_iam_policy_document" "limited_billing" { - statement { - sid = "LimitedBillingAccess" - effect = "Allow" - resources = ["*"] - - actions = [ - "aws-portal:View*", - "ce:Describe*", - "ce:Get*", - "ce:List*", - # put in right set of things for cost explorer and read access to billing - ] - } -} diff --git a/billing-policies/prefixes.tf b/billing-policies/prefixes.tf deleted file mode 120000 index 7e265d5..0000000 --- a/billing-policies/prefixes.tf +++ /dev/null @@ -1 +0,0 @@ -../common/prefixes.tf \ No newline at end of file diff --git a/billing-policies/variables.common.tf b/billing-policies/variables.common.tf deleted file mode 120000 index 7439ed8..0000000 --- a/billing-policies/variables.common.tf +++ /dev/null @@ -1 +0,0 @@ -../common/variables.common.tf \ No newline at end of file diff --git a/billing-policies/version.tf b/billing-policies/version.tf deleted file mode 120000 index b83c5b7..0000000 --- a/billing-policies/version.tf +++ /dev/null @@ -1 +0,0 @@ -../common/version.tf \ No newline at end of file diff --git a/common/version.tf b/common/version.tf index 100daf2..4bdd4c1 100644 --- a/common/version.tf +++ b/common/version.tf @@ -1,3 +1,3 @@ locals { - _module_version = "2.0.1" + _module_version = "2.0.2" } diff --git a/examples/billing-policy/roles.tf b/examples/billing-policy/roles.tf deleted file mode 100644 index 6d809cd..0000000 --- a/examples/billing-policy/roles.tf +++ /dev/null @@ -1,29 +0,0 @@ -module "billing" { - source = "git@github.e.it.census.gov:terraform-modules/aws-inf-setup.git//billing-policies?ref=tf-upgrade" -} - -module "role_full_billing" { - source = "git@github.e.it.census.gov:terraform-modules/aws-iam-role.git?ref=tf-upgrade" - - role_name = "inf-billing" - saml_provider_arn = module.saml.saml_provider - enable_ldap_creation = true - assume_policy_document = module.saml.saml_assume_policy - max_session_duration = 3600 - ldap_user = var.ldap_user - ldap_password = var.ldap_password - inline_policies = [module.billing.policies["full-billing"]] -} - -module "role_limited_billing" { - source = "git@github.e.it.census.gov:terraform-modules/aws-iam-role.git?ref=tf-upgrade" - - role_name = "limited-billing" - saml_provider_arn = module.saml.saml_provider - enable_ldap_creation = true - assume_policy_document = module.saml.saml_assume_policy - max_session_duration = 3600 - ldap_user = var.ldap_user - ldap_password = var.ldap_password - inline_policies = [module.billing.policies["limited-billing"]] -}