Terraform AWS iam-user

This module implements a simple user module that allows the user to create their own credentials and assign MFA.

How does it work

First use after you clone this repository or when .pre-commit-config.yaml is updated

Run pre-commit install to install any guardrails implemented using pre-commit.

See pre-commit installation on how to install pre-commit.

Usage

To use this module ...

module "iam_user" {
  source   = "git@github.com:wearetechnative/terraform-aws-module-iam-user.git?ref=HEAD"

  user_name = "example@example.com"
  user_path = "/example_path/"

  customer_managed_policies = {
    "website_codebuild_cloudwatch": jsondecode(data.aws_iam_policy_document.website_codebuild_cloudwatch.json)
  }
  aws_managed_policies      = [ "AdministratorAccess" ]

  assume_role_configuration = { "example": { "account_id" : 123123123, "role_path" : "/role/path/to/assume/role_name" } }

  allow_access_keys         = false
  allow_console_login = true
}

data "aws_iam_policy_document" "website_codebuild_cloudwatch" {
  statement {
    actions = ["logs:CreateLogStream", "logs:PutLogEvents"]

    resources = [ "arn:${data.aws_partition.current.id}:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:log-group:/aws/codebuild/website_stack_website_*" ]
  }
}

Providers

Name	Version
aws	>=4.3.0

Modules

Name	Source	Version
policy_helper	git@github.com:wearetechnative/terraform-aws-iam-helper.git	b5e28f28c11fd0f5733f0a0c8ad212bed4b99ff6

Resources

Name	Type
aws_iam_policy.access_keys	resource
aws_iam_policy.login_credentials	resource
aws_iam_user.this	resource
aws_iam_user_login_profile.login_profile	resource
aws_iam_user_policy_attachment.access_keys	resource
aws_iam_user_policy_attachment.login_credentials	resource
aws_caller_identity.current	data source
aws_iam_policy_document.access_key	data source
aws_iam_policy_document.list_keys	data source
aws_iam_policy_document.login_credentials	data source
aws_iam_policy_document.manage_keys	data source
aws_region.current	data source

Inputs

Name	Description	Type	Default	Required
allow_access_keys	Allow self management of access keys.	bool	false	no
allow_console_login	Allow console access.	bool	false	no
assume_role_configuration	Policies for assume role. Optional.	map(object({ account_id = string role_path = string }))	{}	no
aws_managed_policies	Optional list of AWS managed policies. We assume that these policies already exist.	list(string)	[]	no
customer_managed_policies	Optional map of customer managed policy names. Key is policyname and value is policy object in HCL.	any	{}	no
user_name	User name for new user. Required value.	string	n/a	yes
user_path	Path for new user. Defaults to "/".	string	"/"	no

Outputs

Name	Description
iam_user_arn	n/a
iam_user_id	n/a
user_initial_password	n/a