terraform-aws-account-security

This terraform module creates IAM roles for federated users to assume from an IdP account.

Deploy this module to every AWS account, except IdP and master.

You will need an AWS Organization created in the master account and an IdP account with federated login.

Use idp_admin_trust_account_ids and idp_admin_trust_names to allow access from external accounts. Enter a list of IDs of IDP accounts that will be able to assume to this account.

See:

• Create an organization with terraform-aws-organization
• Create accounts with terraform-aws-account
• Deploy IdP IAM roles (for gsuite) with terraform-aws-idp-gsuite

This modules creates the following resources:

• Identity and Access Management2 roles:
  • idp-admin with full admin permissions
  • idp-read-only with read-only permissions

In addition you have the option to:

• Creates a client-admin/client-read-only role for external IDPs
• Create admin and read-only roles trusting IDP account
• Create IAM role to assume from management account for CI deployments
• Create IAM instance profile and user for use with CI workers deployed to the account
• Set Maximum CLI/API session duration. The default value is 43200

Usage

module "my_account_roles" {
  source                = "git::https://github.com/DNXLabs/terraform-aws-account-roles.git?ref=0.2.0"
  org_name              = "my_organization"
  account_name          = "my_account"
  idp_account_id        = "000000000000"

  idp_admin_trust_account_ids = ["1234567890123"] # optional
  idp_admin_trust_names       = ["dnx"]                        # optional
}

Requirements

Name	Version
terraform	>= 0.12.0

Providers

Name	Version
aws	n/a

Inputs

Name	Description	Type	Default	Required
account_name	Account name (slug)	any	n/a	yes
ci_account_id	Account ID of MGMT account for use with IAM CI role. Required when create_ci_iam_role=true	string	""	no
create_ci_profile	Create IAM instance profile and user for use with CI workers deployed to the account	bool	false	no
create_ci_role	Create IAM role to assume from MGMT account for CI deployments	bool	true	no
create_idp_trusted_roles	Create admin and read-only roles trusting IDP account	bool	true	no
extra_roles	A list of extra roles to create in this account	list	[]	no
extra_roles_policy	A map of { <role_name> = } to create policies to extra roles in this account (role must be declared at extra_roles first)	map	{}	no
extra_roles_policy_arn	A map of { <role_name> = } to attach policies to extra roles in this account (role must be declared at extra_roles first)	map	{}	no
idp_account_id	Account ID of IDP account (needs to be set when is_idp_account=true)	string	""	no
idp_external_trust_account_ids	List of account IDs to trust as external IDPs (leave empty to disable external access)	list(string)	[]	no
idp_external_trust_client_role	Creates a client-admin/client-read-only role for external IDPs	bool	true	no
org_name	Name for this organization (slug)	any	n/a	yes
role_max_session_duration	Maximum CLI/API session duration	string	"43200"	no
ssm_account_ids	List of account IDs to save in SSM	list(string)	[]	no
ssm_account_names	List of account names (slugs) to save in SSM, must match ssm_account_ids	list(string)	[]	no

Outputs

Name	Description
iam_role_admin_arn	ARN for admin IAM role
iam_role_read_only_arn	ARN for read-only IAM role

Authors

Module managed by DNX Solutions.

License

Apache 2 Licensed. See LICENSE for full details.