cool-domain-manager-iam

This project is used to manage IAM permissions for Domain Manager users.

Pre-requisites

• Terraform installed on your system.
• An accessible AWS S3 bucket to store Terraform state (specified in backend.tf).
• An accessible AWS DynamoDB database to store the Terraform state lock (specified in backend.tf).
• Access to all of the Terraform remote states specified in remote_states.tf.
• User accounts for all users must have been created previously. We recommend using the cisagov/cool-users-non-admin repository to create users.
• User Services account and roles must have been created using cisagov/cool-accounts-userservices.
• Terraform in cisagov/cool-domain-manager-networking must have been applied.

Usage

1. Create a Terraform workspace (if you haven't already done so) by running terraform workspace new <workspace_name>
2. Create a <workspace_name>.tfvars file with all of the required variables (see Inputs below for details):

users = {
  "firstname1.lastname1"    = { "roles" = ["provisioner"] },
  "firstname2.lastname2"    = { "roles" = ["provisioner"] }
}

1. Run the command terraform init.
2. Run the command terraform apply -var-file=<workspace_name>.tfvars.

Requirements

Name	Version
terraform	~> 1.0
aws	~> 4.9

Providers

Name	Version
aws	~> 4.9
aws.users	~> 4.9
terraform	n/a

Modules

No modules.

Resources

Name	Type
aws_iam_group.provisioner_users	resource
aws_iam_group_policy.assume_sharedservices_provisionprivatednsrecords_role	resource
aws_iam_group_policy_attachment.assume_access_dm_terraform_backend_role_attachment	resource
aws_iam_group_policy_attachment.assume_domainmanager_provisionaccount_role_attachment	resource
aws_iam_group_policy_attachment.assume_read_domainmanager_networking_state_role	resource
aws_iam_group_policy_attachment.assume_read_sharedservices_networking_state_role	resource
aws_iam_policy.assume_access_dm_terraform_backend_role	resource
aws_iam_policy.assume_domainmanager_provisionaccount_role	resource
aws_iam_user_group_membership.provisioner	resource
aws_caller_identity.current	data source
aws_iam_policy_document.assume_access_dm_terraform_backend_role_doc	data source
aws_iam_policy_document.assume_domainmanager_provisionaccount_role_doc	data source
aws_iam_policy_document.assume_sharedservices_provisionprivatednsrecords_role_doc	data source
aws_iam_user.users	data source
terraform_remote_state.domainmanager_networking_staging	data source
terraform_remote_state.domainmanager_production	data source
terraform_remote_state.domainmanager_staging	data source
terraform_remote_state.sharedservices_networking_production	data source
terraform_remote_state.sharedservices_networking_staging	data source
terraform_remote_state.terraform	data source
terraform_remote_state.users	data source

Inputs

Name	Description	Type	Default	Required
assume_access_dm_terraform_backend_policy_description	The description to associate with the IAM policy that allows assumption of the role that allows access to Domain Manager-related Terraform backend resources.	string	"The IAM policy that allows assumption of the role that allows access to Domain Manager-related Terraform backend resources."	no
assume_access_dm_terraform_backend_policy_name	The name to assign the IAM policy that allows assumption of the role that allows access to Domain Manager-related Terraform backend resources.	string	"AssumeAccessDomainManagerTerraformBackend"	no
assume_domainmanager_provisionaccount_policy_description	The description to associate with the IAM policy that allows assumption of the role that allows sufficient permissions to provision all AWS resources for Domain Manager in the Domain Manager accounts.	string	"The IAM policy that allows assumption of the role that allows sufficient permissions to provision all AWS resources for Domain Manager in the Domain Manager accounts."	no
assume_domainmanager_provisionaccount_policy_name	The name to assign the IAM policy that allows assumption of the role that allows sufficient permissions to provision all AWS resources for Domain Manager in the Domain Manager accounts.	string	"DomainManager-AssumeProvisionAccount"	no
assume_sharedservices_provisionprivatednsrecords_policy_name	The name to assign the IAM policy that allows assumption of the role that allows access to provision DNS records in private zones in the Shared Services account.	string	"SharedServices-AssumeProvisionPrivateDNSRecords"	no
aws_region	The AWS region to deploy into (e.g. us-east-1)	string	"us-east-1"	no
provisioner_users_group_name	The name of the group to be created for provisioner users.	string	"domain_manager_provisioners"	no
tags	Tags to apply to all AWS resources created.	map(string)	{}	no
users	A map containing the usernames of each Domain Manager user and a list of roles assigned to that user. The only currently-defined role is "provisioner". Example: { "firstname1.lastname1" = { "roles" = [ "provisioner" ] } }	map(map(list(string)))	n/a	yes

Outputs

No outputs.

Notes

Running pre-commit requires running terraform init in every directory that contains Terraform code. In this repository, this is just the main directory.

Contributing

We welcome contributions! Please see CONTRIBUTING.md for details.

License

This project is in the worldwide public domain.

This project is in the public domain within the United States, and copyright and related rights in the work worldwide are waived through the CC0 1.0 Universal public domain dedication.

All contributions to this project will be released under the CC0 dedication. By submitting a pull request, you are agreeing to comply with this waiver of copyright interest.