Module: organization-access-group

Terraform module to create an IAM Group and Policy to grant permissions to delegated IAM users in the Organization's master account to access a member account

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access.html

Introduction

By default, when you create a member account as part of your Organization, AWS automatically creates OrganizationAccountAccessRole in the member account.

The role grants admin permissions to access the member account to delegated IAM users in the master account.

In the master account you need to create a Policy to grant permissions to IAM users to assume OrganizationAccountAccessRole in the member account.

This module does the following:

1. Creates an IAM Group
2. Adds the provided IAM users to the Group
3. Creates a Policy to grant permissions to the IAM users in the master account to assume OrganizationAccountAccessRole in the member account
4. Attaches the Policy to the Group

Users who are members of the Group will be able to assume the role and administer the member account by going here:

(change XXXXXXXXXXXX to the ID of the member account)

https://signin.aws.amazon.com/switchrole
                ?account=XXXXXXXXXXXX
                &roleName=OrganizationAccountAccessRole
                &displayName=Dev

NOTE: Member accounts that you invite to join your Organization (that are not part of your Organization) do not automatically get OrganizationAccountAccessRole created. You can use terraform-aws-organization-access-role module to create OrganizationAccountAccessRole role in an invited member account.

Usage

module "organization_access_group" {
  source            = "git::https://github.com/cloudposse/terraform-aws-organization-access-group.git?ref=master"
  namespace         = "cp"
  stage             = "dev"
  name              = "cluster"
  user_names        = ["User1","User2"]
  role_arns         = {
    "cp@dev" = "arn:aws:iam::XXXXXXXXX:role/OrganizationAccountAccessRole"
  }
  require_mfa       = "true"
}

Requirements

No requirements.

Providers

Name	Version
aws	n/a
null	n/a

Modules

Name	Source	Version
label	git::https://github.com/cloudposse/terraform-null-label.git	tags/0.3.3

Resources

Name	Type
aws_iam_group.default	resource
aws_iam_group_policy.with_mfa	resource
aws_iam_group_policy.without_mfa	resource
aws_iam_user_group_membership.default	resource
null_resource.role	resource
aws_iam_policy_document.with_mfa	data source
aws_iam_policy_document.without_mfa	data source

Inputs

Name	Description	Type	Default	Required
attributes	Additional attributes (e.g. 1)	list(string)	[]	no
delimiter	Delimiter to be used between namespace, stage, name, and attributes	string	"-"	no
enabled	Whether to create these resources	string	"true"	no
name	Name (e.g. app or cluster)	string	n/a	yes
namespace	Namespace (e.g. cp or cloudposse)	string	n/a	yes
require_mfa	Require the users to have MFA enabled	string	"false"	no
role_arns	A map of alias -> IAM Role ARNs the users in the Group can assume	map(string)	{}	no
stage	Stage (e.g. prod, dev, staging, infra)	string	n/a	yes
switchrole_url_template	URL template for the IAM console to switch to the roles	string	"https://signin.aws.amazon.com/switchrole?account=%s&roleName=%s&displayName=%s"	no
tags	Additional tags (e.g. map(BusinessUnit,XYZ)	map(string)	{}	no
user_names	A list of IAM User names to associate with the Group	list(string)	n/a	yes

Outputs

Name	Description
group_arn	The ARN assigned by AWS for the Group
group_id	The Group's ID
group_name	The Group's name
group_unique_id	Group's unique ID assigned by AWS
policy_id	The policy ID
policy_name	The name of the policy
switchrole_urls	List of URL to the IAM console to switch to the roles