Creating users to test permissions and updating level 4 policy

[chelseyklein]

What changed?

• Added two users I'm using to test permissions. I'll delete these accounts once we have all of the permissions sorted - changes were already applied locally
• Updated policy name to change 'admin' to 'supervisor'
• Granted level 4 accounts cloudshell access

[github-actions]

Terraform plan in terraform

Plan: 2 to add, 0 to change, 2 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+   create
-   destroy
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # module.aws_custom_policies.aws_iam_policy.custom_policy["IAMServicesAdmin"] will be destroyed
  # (because key ["IAMServicesAdmin"] is not in for_each map)
-   resource "aws_iam_policy" "custom_policy" {
-       arn         = "arn:aws:iam::035866691871:policy/IAMServicesAdmin" -> null
-       description = "Policy granting IAM services admins permissions to make changes to user accounts" -> null
-       id          = "arn:aws:iam::035866691871:policy/IAMServicesAdmin" -> null
-       name        = "IAMServicesAdmin" -> null
-       path        = "/" -> null
-       policy      = jsonencode(
            {
-               Statement = [
-                   {
-                       Action   = [
-                           "iam:CreateAccessKey",
                        ]
-                       Effect   = "Allow"
-                       Resource = "arn:aws:iam::*:user/*"
                    },
-                   {
-                       Action    = [
-                           "iam:UpdateLoginProfile",
                        ]
-                       Condition = {
-                           StringEquals = {
-                               "iam:ResourceTag/Access Level" = [
-                                   "1",
-                                   "2",
                                ]
                            }
                        }
-                       Effect    = "Allow"
-                       Resource  = "arn:aws:iam::*:user/*"
                    },
-                   {
-                       Action   = [
-                           "cloudshell:CreateEnvironment",
-                           "cloudshell:GetEnvironmentStatus",
-                           "cloudshell:CreateSession",
-                           "cloudshell:StartEnvironment",
-                           "cloudshell:StopEnvironment",
                        ]
-                       Effect   = "Allow"
-                       Resource = "*"
                    },
                ]
-               Version   = "2012-10-17"
            }
        ) -> null
-       policy_id   = "ANPAQQWOSJEPRL2DTHOJL" -> null
-       tags        = {} -> null
-       tags_all    = {} -> null
    }

  # module.aws_custom_policies.aws_iam_policy.custom_policy["IAMServicesSupervisor"] will be created
+   resource "aws_iam_policy" "custom_policy" {
+       arn         = (known after apply)
+       description = "Policy granting IAM services admins permissions to make changes to user accounts"
+       id          = (known after apply)
+       name        = "IAMServicesSupervisor"
+       name_prefix = (known after apply)
+       path        = "/"
+       policy      = jsonencode(
            {
+               Statement = [
+                   {
+                       Action   = [
+                           "iam:CreateAccessKey",
                        ]
+                       Effect   = "Allow"
+                       Resource = "arn:aws:iam::*:user/*"
                    },
+                   {
+                       Action    = [
+                           "iam:UpdateLoginProfile",
                        ]
+                       Condition = {
+                           StringEquals = {
+                               "iam:ResourceTag/Access Level" = [
+                                   "1",
+                                   "2",
                                ]
                            }
                        }
+                       Effect    = "Allow"
+                       Resource  = "arn:aws:iam::*:user/*"
                    },
+                   {
+                       Action   = [
+                           "cloudshell:CreateEnvironment",
+                           "cloudshell:GetEnvironmentStatus",
+                           "cloudshell:CreateSession",
+                           "cloudshell:StartEnvironment",
+                           "cloudshell:StopEnvironment",
                        ]
+                       Effect   = "Allow"
+                       Resource = "*"
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       policy_id   = (known after apply)
+       tags_all    = (known after apply)
    }

  # module.iam_services_admin_group.aws_iam_group_policy_attachment.group_policy_attachment["IAMServicesAdmin"] must be replaced
-/+ resource "aws_iam_group_policy_attachment" "group_policy_attachment" {
!~      id         = "***************************************************" -> (known after apply)
!~      policy_arn = "arn:aws:iam::035866691871:policy/IAMServicesAdmin" # forces replacement -> (known after apply) # forces replacement
#        (1 unchanged attribute hidden)
    }

Plan: 2 to add, 0 to change, 2 to destroy.

❌ Error applying plan in Apply Terraform changes on merge #3

[freaky4wrld]

@chelseybeck thanks for the PR, the branches looks good, the descriptions is apt , the terraform policy you provided for level-4 clearly provides the IAM privileges to :

• create keys
• reset passwords for profile
• and cloudshell access to create and start environment

two users are added to the aws-users.tf file, and the file name is saved as directed

thanks PR approved!!

[freaky4wrld]

@chelseybeck merged the PR and it's throwing error on Terraform apply, re-ran the failing jobs but it has errors. Maybe should've waited for you before merging it, my guess is it's failing as it is trying to destroy the renamed policy and we are trying to update it, I might be wrong, please check and correct me

Thanks

[github-actions]

Terraform plan in terraform

Plan: 1 to add, 0 to change, 1 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+   create
-   destroy

Terraform will perform the following actions:

  # module.aws_custom_policies.aws_iam_policy.custom_policy["IAMServicesAdmin"] will be destroyed
  # (because key ["IAMServicesAdmin"] is not in for_each map)
-   resource "aws_iam_policy" "custom_policy" {
-       arn         = "arn:aws:iam::035866691871:policy/IAMServicesAdmin" -> null
-       description = "Policy granting IAM services admins permissions to make changes to user accounts" -> null
-       id          = "arn:aws:iam::035866691871:policy/IAMServicesAdmin" -> null
-       name        = "IAMServicesAdmin" -> null
-       path        = "/" -> null
-       policy      = jsonencode(
            {
-               Statement = [
-                   {
-                       Action   = [
-                           "iam:CreateAccessKey",
                        ]
-                       Effect   = "Allow"
-                       Resource = "arn:aws:iam::*:user/*"
                    },
-                   {
-                       Action    = [
-                           "iam:UpdateLoginProfile",
                        ]
-                       Condition = {
-                           StringEquals = {
-                               "iam:ResourceTag/Access Level" = [
-                                   "1",
-                                   "2",
                                ]
                            }
                        }
-                       Effect    = "Allow"
-                       Resource  = "arn:aws:iam::*:user/*"
                    },
-                   {
-                       Action   = [
-                           "cloudshell:CreateEnvironment",
-                           "cloudshell:GetEnvironmentStatus",
-                           "cloudshell:CreateSession",
-                           "cloudshell:StartEnvironment",
-                           "cloudshell:StopEnvironment",
                        ]
-                       Effect   = "Allow"
-                       Resource = "*"
                    },
                ]
-               Version   = "2012-10-17"
            }
        ) -> null
-       policy_id   = "ANPAQQWOSJEPRL2DTHOJL" -> null
-       tags        = {} -> null
-       tags_all    = {} -> null
    }

  # module.iam_services_admin_group.aws_iam_group_policy_attachment.group_policy_attachment["IAMServicesAdmin"] will be created
+   resource "aws_iam_group_policy_attachment" "group_policy_attachment" {
+       group      = "iam-services-admin-group"
+       id         = (known after apply)
+       policy_arn = "arn:aws:iam::035866691871:policy/IAMServicesSupervisor"
    }

Plan: 1 to add, 0 to change, 1 to destroy.

📝 Plan generated in Write Terraform Plan to Pull Request #32