Skip to content

Commit 2793698

Browse files
bcarranzabcarranza
authored
IAM generic module (#375)
1 parent d5c6cdb commit 2793698

File tree

4 files changed

+197
-0
lines changed

4 files changed

+197
-0
lines changed

‎terraform-modules/aws/iam/generic/README.md‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
## Requirements
2+
3+
No requirements.
4+
5+
## Providers
6+
7+
| Name | Version |
8+
|------|---------|
9+
| <a name="provider_aws"></a> [aws](#provider\_aws) | n/a |
10+
11+
## Modules
12+
13+
No modules.
14+
15+
## Resources
16+
17+
| Name | Type |
18+
|------|------|
19+
| [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
20+
21+
## Inputs
22+
23+
| Name | Description | Type | Default | Required |
24+
|------|-------------|------|---------|:--------:|
25+
| <a name="input_iam_assume_role_policy"></a> [iam\_assume\_role\_policy](#input\_iam\_assume\_role\_policy) | Json to create assume\_role\_policy in line | `string` | `"{}"` | no |
26+
| <a name="input_iam_description"></a> [iam\_description](#input\_iam\_description) | (Optional) Description of the role. | `string` | `"New Role created from ManagedKube Module"` | no |
27+
| <a name="input_iam_force_detach_policies"></a> [iam\_force\_detach\_policies](#input\_iam\_force\_detach\_policies) | (Optional) Whether to force detaching any policies the role has before destroying it | `bool` | `false` | no |
28+
| <a name="input_iam_inline_policy"></a> [iam\_inline\_policy](#input\_iam\_inline\_policy) | Json to create policy in line | `string` | `"{}"` | no |
29+
| <a name="input_iam_managed_policy_arns"></a> [iam\_managed\_policy\_arns](#input\_iam\_managed\_policy\_arns) | List of arn policies to attached | `list(string)` | `[]` | no |
30+
| <a name="input_iam_max_session_duration"></a> [iam\_max\_session\_duration](#input\_iam\_max\_session\_duration) | (Optional) Maximum session duration (in seconds) that you want to set for the specified role his setting can have a value from 1 hour to 12 hours. | `number` | `3600` | no |
31+
| <a name="input_iam_name"></a> [iam\_name](#input\_iam\_name) | Friendly name of the role | `string` | n/a | yes |
32+
| <a name="input_tags"></a> [tags](#input\_tags) | Key-value mapping of tags for the IAM role. If configured with a provider | `map(any)` | n/a | yes |
33+
34+
## Outputs
35+
36+
| Name | Description |
37+
|------|-------------|
38+
| <a name="output_iam_arn"></a> [iam\_arn](#output\_iam\_arn) | Amazon Resource Name (ARN) specifying the role. |
39+
40+
41+
## Example Usage
42+
Here are some examples of how we can consume the module through the inputs variables.
43+
44+
1. **IAM Role Basic Example With Managed Policy Attached**
45+
You can create a basic iam role with Managed Policy Attached
46+
The iam_managed_policy_arns input param allows an array with one or more managed policies
47+
```
48+
iam_name = local.iam_rolename
49+
iam_description = local.iam_description
50+
iam_force_detach_policies = true
51+
iam_managed_policy_arns = ["arn:aws:iam::aws:policy/ReadOnlyAccess"]
52+
tags = local.tags
53+
```
54+
55+
2. **Role With Inline policy**
56+
You can create a Iam Role with your own inline policy
57+
58+
2.1 Create a new policy file (example: mypolicy.json)
59+
```
60+
{
61+
"Id": "ExamplePolicy",
62+
"Version": "2012-10-17",
63+
"Statement": [
64+
{
65+
"Sid": "AllowSSLRequestsOnly",
66+
"Action": "s3:*",
67+
"Effect": "Deny",
68+
"Resource": [
69+
"arn:aws:s3:::${bucket_name}",
70+
"arn:aws:s3:::${bucket_name}/*"
71+
],
72+
"Condition": {
73+
"Bool": {
74+
"aws:SecureTransport": "false"
75+
}
76+
},
77+
"Principal": "*"
78+
}
79+
]
80+
}
81+
```
82+
2.2 Consume the module sending as parameter the previous file with its respective parameters.
83+
```
84+
iam_name = local.iam_rolename
85+
iam_description = local.iam_description
86+
iam_force_detach_policies = true
87+
input_iam_inline_policy = templatefile("mypolicy.json", { bucket_name="my_bucket_name" })
88+
tags = local.tags
89+
```
90+
91+
3. **Role With Trusted relationship policy**
92+
Trust relationship – This policy defines which principals can assume the role,
93+
and under which conditions. This is sometimes referred to as a resource-based policy
94+
for the IAM role. We’ll refer to this policy simply as the ‘trust policy’.
95+
96+
3.1 You can create a file (example: assume_role_policy.json)
97+
```
98+
{
99+
{
100+
"Version": "2012-10-17",
101+
"Statement": [
102+
{
103+
"Effect": "Allow",
104+
"Principal": {
105+
"AWS": "${account_id}"
106+
},
107+
"Action": "sts:AssumeRole",
108+
"Condition": {
109+
"StringEquals": {
110+
"sts:ExternalId": "${external_id}"
111+
}
112+
}
113+
}
114+
]
115+
}
116+
```
117+
3.2 Consume the module sending as parameter the previous file with its respective parameters.
118+
```
119+
iam_name = local.iam_rolename
120+
iam_description = local.iam_description
121+
iam_force_detach_policies = true
122+
iam_assume_role_policy = templatefile("assume_role_policy.json", { account_id = local.account_id, external_id = local.iam_external_id})
123+
tags = local.tags
124+
```

‎terraform-modules/aws/iam/generic/main.tf‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
resource "aws_iam_role" "this" {
2+
name = var.iam_name
3+
description = var.iam_description
4+
force_detach_policies = var.iam_force_detach_policies
5+
max_session_duration = var.iam_max_session_duration
6+
7+
8+
inline_policy {
9+
name = var.iam_name
10+
policy = var.iam_inline_policy
11+
}
12+
13+
managed_policy_arns = var.iam_managed_policy_arns
14+
assume_role_policy = var.iam_assume_role_policy
15+
tags = var.tags
16+
}

‎terraform-modules/aws/iam/generic/outputs.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
output "iam_arn" {
2+
description = "Amazon Resource Name (ARN) specifying the role."
3+
value = aws_iam_role.this.arn
4+
}

‎terraform-modules/aws/iam/generic/variables.tf‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
variable iam_name {
2+
type = string
3+
description = "Friendly name of the role"
4+
}
5+
6+
variable iam_description {
7+
type = string
8+
default = "New Role created from ManagedKube Module"
9+
description = "(Optional) Description of the role."
10+
}
11+
12+
variable iam_force_detach_policies {
13+
type = bool
14+
default = false
15+
description = "(Optional) Whether to force detaching any policies the role has before destroying it"
16+
}
17+
18+
variable iam_max_session_duration {
19+
type = number
20+
default = 3600
21+
description = "(Optional) Maximum session duration (in seconds) that you want to set for the specified role his setting can have a value from 1 hour to 12 hours."
22+
}
23+
24+
25+
26+
#Permission section-----------------------------------------
27+
variable iam_inline_policy {
28+
type = string
29+
description = "Json to create policy in line"
30+
default = "{}"
31+
}
32+
33+
variable iam_managed_policy_arns {
34+
type = list(string)
35+
description = "List of arn policies to attached"
36+
default = []
37+
}
38+
#End of Permission section----------------------------------
39+
40+
41+
#Trust relationship section---------------------------------
42+
variable iam_assume_role_policy {
43+
type = string
44+
description = "Json to create assume_role_policy in line"
45+
default = "{}"
46+
}
47+
#End Trust relationship section-----------------------------
48+
49+
50+
variable tags {
51+
type = map(any)
52+
description = "Key-value mapping of tags for the IAM role. If configured with a provider"
53+
}

0 commit comments

Comments
 (0)