* 1.4.2 -- 2026-01-23

  - created policies
    - policies/inf-idc-t1
    - policies/inf-idc-t2

CHANGELOG.md

@@ -67,3 +67,8 @@
   - created policies
     - policies/sc-servicecatalog-t2
     - policies/sc-servicecatalog-t3
+
+* 1.4.2 -- 2026-01-23
+  - created policies
+    - policies/inf-idc-t1
+    - policies/inf-idc-t2

common/version.tf

@@ -1,3 +1,3 @@
 locals {
-  _module_version = "1.4.1"
+  _module_version = "1.4.2"
 }

policies/inf-idc-t1/README.md

@@ -0,0 +1,33 @@
+## Requirements
+
+No requirements.
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | n/a |
+
+## Modules
+
+No modules.
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_iam_policy_document.inline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+
+## Inputs
+
+No inputs.
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_customer_managed_policy_names"></a> [customer\_managed\_policy\_names](#output\_customer\_managed\_policy\_names) | Map of policy name to permission boundary of Customer Managed Policy to attach to the permissionset |
+| <a name="output_inline_policy"></a> [inline\_policy](#output\_inline\_policy) | AWS Policy document for the single allowed inline policy (use .json to get policy) |
+| <a name="output_managed_policy_names"></a> [managed\_policy\_names](#output\_managed\_policy\_names) | Names of AWS Managed Policy to attach to the permissionset |
+| <a name="output_name"></a> [name](#output\_name) | Permission Set Name for which all settings apply |
+| <a name="output_relay_state"></a> [relay\_state](#output\_relay\_state) | Relay State to pass along to permissionset |

policies/inf-idc-t1/locals.tf

@@ -0,0 +1,12 @@
+locals {
+  account_id          = var.account_id != "" ? var.account_id : data.aws_caller_identity.current.account_id
+  account_environment = data.aws_arn.current.partition == "aws-us-gov" ? "gov" : "ew"
+  region              = data.aws_region.current.region
+  region_short        = join("", [for c in split("-", local.region) : substr(c, 0, 1)])
+
+  base_tags = {
+    "boc:tf_module_version" = local._module_version
+    "boc:tf_module_name"    = local._module_name
+    "boc:created_by"        = "terraform"
+  }
+}

policies/inf-idc-t1/main.tf

@@ -0,0 +1,2 @@
+/*
+*/

policies/inf-idc-t1/module_name.tf

@@ -0,0 +1,3 @@
+locals {
+  _module_name = "aws-sso/policies/inf-idc-t1"
+}

policies/inf-idc-t1/outputs.tf

@@ -0,0 +1,24 @@
+output "name" {
+  description = "Permission Set Name for which all settings apply"
+  value       = local.name
+}
+
+output "managed_policy_names" {
+  description = "Names of AWS Managed Policy to attach to the permissionset"
+  value       = local.managed_policy_names
+}
+
+output "customer_managed_policy_names" {
+  description = "Map of policy name to permission boundary of Customer Managed Policy to attach to the permissionset"
+  value       = local.customer_managed_policy_names
+}
+
+output "inline_policy" {
+  description = "AWS Policy document for the single allowed inline policy (use .json to get policy)"
+  value       = local.inline_policy
+}
+
+output "relay_state" {
+  description = "Relay State to pass along to permissionset"
+  value       = local.relay_state
+}

policies/inf-idc-t1/policy.tf

@@ -0,0 +1 @@
+data "aws_iam_policy_document" "inline" {}

policies/inf-idc-t1/settings.tf

@@ -0,0 +1,12 @@
+locals {
+  name = "inf-idc-t1"
+  managed_policy_names = [
+    "ReadOnlyAccess",
+    "AWSSSOReadOnly",
+    "AWSSSODirectoryReadOnly",
+  ]
+  customer_managed_policy_names = { "p-inf-tfstate-write" = null }
+  relay_state                   = data.aws_arn.current.partition == "aws-us-gov" ? "https://console.amazonaws-us-gov.com/singlesignon/home?region=us-gov-east-1" : "https://console.aws.amazon.com/singlesignon/home?region=us-east-1"
+  #  inline_policy                 = data.aws_iam_policy_document.inline
+  inline_policy = null
+}

policies/inf-idc-t1/variables.tf.unused

@@ -0,0 +1,29 @@
+variable "name" {
+  description = "Permission Set Name for which all settings apply"
+  type        = string
+  default     = null
+}
+
+variable "managed_policy_names" {
+  description = "Names of AWS Managed Policy to attach to the permissionset"
+  type        = list(string)
+  default     = []
+}
+
+variable "customer_managed_policy_names" {
+  description = "Map of policy name to permission boundary of Customer Managed Policy to attach to the permissionset"
+  type        = map(string)
+  default     = {}
+}
+
+# variable "inline_policy" {
+#   description = "AWS Policy document for the single allowed inline policy"
+#   type        = string
+#   default     = null
+# }
+
+variable "relay_state" {
+  description = "Relay State to pass along to permissionset"
+  type        = string
+  default     = null
+}

policies/inf-idc-t2/README.md

@@ -0,0 +1,33 @@
+## Requirements
+
+No requirements.
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | n/a |
+
+## Modules
+
+No modules.
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_iam_policy_document.inline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+
+## Inputs
+
+No inputs.
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_customer_managed_policy_names"></a> [customer\_managed\_policy\_names](#output\_customer\_managed\_policy\_names) | Map of policy name to permission boundary of Customer Managed Policy to attach to the permissionset |
+| <a name="output_inline_policy"></a> [inline\_policy](#output\_inline\_policy) | AWS Policy document for the single allowed inline policy (use .json to get policy) |
+| <a name="output_managed_policy_names"></a> [managed\_policy\_names](#output\_managed\_policy\_names) | Names of AWS Managed Policy to attach to the permissionset |
+| <a name="output_name"></a> [name](#output\_name) | Permission Set Name for which all settings apply |
+| <a name="output_relay_state"></a> [relay\_state](#output\_relay\_state) | Relay State to pass along to permissionset |

policies/inf-idc-t2/locals.tf

@@ -0,0 +1,12 @@
+locals {
+  account_id          = var.account_id != "" ? var.account_id : data.aws_caller_identity.current.account_id
+  account_environment = data.aws_arn.current.partition == "aws-us-gov" ? "gov" : "ew"
+  region              = data.aws_region.current.region
+  region_short        = join("", [for c in split("-", local.region) : substr(c, 0, 1)])
+
+  base_tags = {
+    "boc:tf_module_version" = local._module_version
+    "boc:tf_module_name"    = local._module_name
+    "boc:created_by"        = "terraform"
+  }
+}

policies/inf-idc-t2/main.tf

@@ -0,0 +1,2 @@
+/*
+*/

policies/inf-idc-t2/module_name.tf

@@ -0,0 +1,3 @@
+locals {
+  _module_name = "aws-sso/policies/inf-idc-t1"
+}

policies/inf-idc-t2/outputs.tf

@@ -0,0 +1,24 @@
+output "name" {
+  description = "Permission Set Name for which all settings apply"
+  value       = local.name
+}
+
+output "managed_policy_names" {
+  description = "Names of AWS Managed Policy to attach to the permissionset"
+  value       = local.managed_policy_names
+}
+
+output "customer_managed_policy_names" {
+  description = "Map of policy name to permission boundary of Customer Managed Policy to attach to the permissionset"
+  value       = local.customer_managed_policy_names
+}
+
+output "inline_policy" {
+  description = "AWS Policy document for the single allowed inline policy (use .json to get policy)"
+  value       = local.inline_policy
+}
+
+output "relay_state" {
+  description = "Relay State to pass along to permissionset"
+  value       = local.relay_state
+}

policies/inf-idc-t2/policy.tf

@@ -0,0 +1,23 @@
+data "aws_iam_policy_document" "inline" {
+  statement {
+    sid    = "IDCPermissions"
+    effect = "Allow"
+    actions = [
+      "iam:Describe*",
+      "iam:Get*",
+      "iam:List*",
+      "iam:ListRoles",
+      "ec2:Describe*",
+      "ec2:Get*",
+      "ec2:List*",
+      "ec2:Report*",
+      "ec2:Search*",
+      "identitystore:*",
+      "organizations:Describe*",
+      "organizations:List*",
+      "sso:*",
+      "sso-directory:*",
+    ]
+    resources = ["*"]
+  }
+}

policies/inf-idc-t2/settings.tf

@@ -0,0 +1,11 @@
+locals {
+  name = "inf-idc-t1"
+  managed_policy_names = [
+    "ReadOnlyAccess",
+    "AWSSSOReadOnly",
+    "AWSSSODirectoryAdministrator",
+  ]
+  customer_managed_policy_names = { "p-inf-tfstate-write" = null }
+  relay_state                   = data.aws_arn.current.partition == "aws-us-gov" ? "https://console.amazonaws-us-gov.com/singlesignon/home?region=us-gov-east-1" : "https://console.aws.amazon.com/singlesignon/home?region=us-east-1"
+  inline_policy                 = data.aws_iam_policy_document.inline
+}

policies/inf-idc-t2/variables.tf.unused

@@ -0,0 +1,29 @@
+variable "name" {
+  description = "Permission Set Name for which all settings apply"
+  type        = string
+  default     = null
+}
+
+variable "managed_policy_names" {
+  description = "Names of AWS Managed Policy to attach to the permissionset"
+  type        = list(string)
+  default     = []
+}
+
+variable "customer_managed_policy_names" {
+  description = "Map of policy name to permission boundary of Customer Managed Policy to attach to the permissionset"
+  type        = map(string)
+  default     = {}
+}
+
+# variable "inline_policy" {
+#   description = "AWS Policy document for the single allowed inline policy"
+#   type        = string
+#   default     = null
+# }
+
+variable "relay_state" {
+  description = "Relay State to pass along to permissionset"
+  type        = string
+  default     = null
+}