diff --git a/CHANGELOG.md b/CHANGELOG.md index 17cc870..c334995 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,3 +3,7 @@ * 1.0.0 -- 2023-09-08 - initial creation +* 1.0.1 -- 2023-09-21 + - add ability to grab description, permissionset_name from settings + - find permissionset if arn not found + diff --git a/common/version.tf b/common/version.tf index fa2705b..374ba43 100644 --- a/common/version.tf +++ b/common/version.tf @@ -1,3 +1,3 @@ locals { - _module_version = "1.0.0" + _module_version = "1.0.1" } diff --git a/group-assignment/README.md b/group-assignment/README.md index 6311215..acd72d1 100644 --- a/group-assignment/README.md +++ b/group-assignment/README.md @@ -31,6 +31,7 @@ No modules. | [aws_organizations_organizational_unit_descendant_accounts.accounts](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/organizations_organizational_unit_descendant_accounts) | data source | | [aws_organizations_organizational_unit_descendant_accounts.ou](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/organizations_organizational_unit_descendant_accounts) | data source | | [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | +| [aws_ssoadmin_permission_set.pset](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssoadmin_permission_set) | data source | | [ldap_object.users](https://registry.terraform.io/providers/trevex/ldap/latest/docs/data-sources/object) | data source | ## Inputs @@ -50,7 +51,8 @@ No modules. | [organizational\_unit\_ids](#input\_organizational\_unit\_ids) | List of AWS Organizational Unit names to assocate with this group | `list(string)` | `[]` | no | | [organizational\_unit\_names](#input\_organizational\_unit\_names) | List of AWS Organizational Unit names to assocate with this group | `list(string)` | `[]` | no | | [override\_prefixes](#input\_override\_prefixes) | Override built-in prefixes by component. This should be used primarily for common infrastructure things | `map(string)` | `{}` | no | -| [permissionset\_arn](#input\_permissionset\_arn) | AWS SSO/IDC Permission set ARN | `string` | n/a | yes | +| [permissionset\_arn](#input\_permissionset\_arn) | AWS SSO/IDC Permission set ARN | `string` | `null` | no | +| [permissionset\_name](#input\_permissionset\_name) | AWS SSO/IDC Permission set name to find the permission set if ARN not set | `string` | `null` | no | | [settings\_file](#input\_settings\_file) | File name and path to YAML with users(list), account\_ids(list), org\_ous(list), and all(bool). See sample.yml in code. | `string` | `null` | no | | [tags](#input\_tags) | AWS Tags to apply to appropriate resources | `map(string)` | `{}` | no | | [users](#input\_users) | List of Census usernames to assign to the group | `list(string)` | `[]` | no | diff --git a/group-assignment/main.tf b/group-assignment/main.tf index ebd113c..3df2dfa 100644 --- a/group-assignment/main.tf +++ b/group-assignment/main.tf @@ -1,10 +1,13 @@ locals { - description = coalesce(var.description, var.name) + name = coalesce(var.name, try(local.settings.group, null)) + description = coalesce(var.description, try(local.settings.description, null), local.name) + permissionset_name = coalesce(var.permissionset_name, local.name) + permissionset_arn = coalesce(var.permissionset_arn, try(data.aws_sso_admin_permission_set.pset[0].arn, null)) } resource "aws_identitystore_group" "group" { identity_store_id = var.identity_store_id - display_name = var.name + display_name = local.name description = local.description } @@ -16,11 +19,26 @@ resource "aws_identitystore_group_membership" "group" { } resource "aws_ssoadmin_account_assignment" "accounts" { - for_each = toset(local.account_ids) - instance_arn = var.instance_arn - permission_set_arn = var.permissionset_arn + for_each = toset(local.account_ids) + instance_arn = var.instance_arn + # permission_set_arn = var.permissionset_arn + permission_set_arn = local.permissionset_arn principal_id = aws_identitystore_group.group.group_id principal_type = "GROUP" target_id = each.value target_type = "AWS_ACCOUNT" + + lifecycle { + precondition { + condition = local.permissionset_arn != null + error_message = "The permissionset ARN is missing or not found from the permissionset_name." + } + } +} + +data "aws_ssoadmin_permission_set" "pset" { + count = var.permissionset_arn == null && local.permissionset_name != null ? 1 : 0 + instance_arn = var.instance_arn + name = local.permissionset_name } + diff --git a/group-assignment/sample.yml b/group-assignment/sample.yml index 98676f1..0eaad9a 100644 --- a/group-assignment/sample.yml +++ b/group-assignment/sample.yml @@ -1,4 +1,6 @@ group: NAME +description: string +permissionset_name: string all: true account_names: [] account_ids: [] diff --git a/group-assignment/variables.tf b/group-assignment/variables.tf index 2a9df21..ac807a7 100644 --- a/group-assignment/variables.tf +++ b/group-assignment/variables.tf @@ -22,6 +22,13 @@ variable "instance_arn" { variable "permissionset_arn" { description = "AWS SSO/IDC Permission set ARN" type = string + default = null +} + +variable "permissionset_name" { + description = "AWS SSO/IDC Permission set name to find the permission set if ARN not set" + type = string + default = null } variable "users" {