Module: iam-assumed-roles

Terraform module to provision two IAM roles and two IAM groups for assuming the roles provided MFA is present, and add IAM users to the groups.

• Role and group with Administrator (full) access to AWS resources
• Role and group with Readonly access to AWS resources

To give a user administrator's access, add the user to the admin group.

To give a user readonly access, add the user to the readonly group.

Usage

module "assumed_roles" {
  source              = "git::https://github.com/cloudposse/terraform-aws-iam-assumed-roles.git?ref=master"
  namespace           = "cp"
  stage               = "prod"
  admin_name          = "admin"
  readonly_name       = "readonly"
  admin_user_names    = ["User1","User2"] # Add these IAM users to the admin group
  readonly_user_names = ["User3","User4"] # Add these IAM users to the readonly group
}

Requirements

No requirements.

Providers

Name	Version
aws	n/a

Modules

Name	Source	Version
admin_label	git::https://github.com/cloudposse/terraform-null-label.git	tags/0.3.3
readonly_label	git::https://github.com/cloudposse/terraform-null-label.git	tags/0.3.3

Resources

Name	Type
aws_iam_group.admin	resource
aws_iam_group.readonly	resource
aws_iam_group_membership.admin	resource
aws_iam_group_membership.readonly	resource
aws_iam_group_policy_attachment.allow_chage_password_admin	resource
aws_iam_group_policy_attachment.allow_change_password_readonly	resource
aws_iam_group_policy_attachment.assume_role_admin	resource
aws_iam_group_policy_attachment.assume_role_readonly	resource
aws_iam_group_policy_attachment.key_management_admin	resource
aws_iam_group_policy_attachment.key_management_readonly	resource
aws_iam_group_policy_attachment.manage_mfa_admin	resource
aws_iam_group_policy_attachment.manage_mfa_readonly	resource
aws_iam_policy.allow_change_password_admin	resource
aws_iam_policy.allow_change_password_readonly	resource
aws_iam_policy.allow_key_management_admin	resource
aws_iam_policy.allow_key_management_readonly	resource
aws_iam_policy.assume_role_admin	resource
aws_iam_policy.assume_role_readonly	resource
aws_iam_policy.manage_mfa_admin	resource
aws_iam_policy.manage_mfa_readonly	resource
aws_iam_role.admin	resource
aws_iam_role.readonly	resource
aws_iam_role_policy_attachment.admin	resource
aws_iam_role_policy_attachment.readonly	resource
aws_caller_identity.current	data source
aws_iam_policy_document.allow_change_password	data source
aws_iam_policy_document.allow_key_management	data source
aws_iam_policy_document.assume_role_admin	data source
aws_iam_policy_document.assume_role_readonly	data source
aws_iam_policy_document.manage_mfa	data source
aws_iam_policy_document.role_trust	data source

Inputs

Name	Description	Type	Default	Required
admin_name	Name for the admin group and role (e.g. admin)	string	"admin"	no
admin_user_names	Optional list of IAM user names to add to the admin group	list(string)	[]	no
attributes	Additional attributes (e.g. policy or role)	list(string)	[]	no
delimiter	Delimiter to be used between namespace, stage, name, and attributes	string	"-"	no
enabled	Set to false to prevent the module from creating any resources	string	"true"	no
namespace	Namespace (e.g. cp or cloudposse)	string	n/a	yes
readonly_name	Name for the readonly group and role (e.g. readonly)	string	"readonly"	no
readonly_user_names	Optional list of IAM user names to add to the readonly group	list(string)	[]	no
stage	Stage (e.g. prod, dev, staging)	string	n/a	yes
switchrole_url	URL to the IAM console to switch to a role	string	"https://signin.aws.amazon.com/switchrole?account=%s&roleName=%s&displayName=%s"	no
tags	Additional tags (e.g. map(BusinessUnit,XYZ)	map(string)	{}	no

Outputs

Name	Description
group_admin_arn	Admin group ARN
group_admin_id	Admin group ID
group_admin_name	Admin group name
group_readonly_arn	Readonly group ARN
group_readonly_id	Readonly group ID
group_readonly_name	Readonly group name
role_admin_arn	Admin role ARN
role_admin_name	Admin role name
role_readonly_arn	Readonly role ARN
role_readonly_name	Readonly role name
switchrole_admin_url	URL to the IAM console to switch to the admin role
switchrole_readonly_url	URL to the IAM console to switch to the readonly role