init

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2017 Zoi TechCon GmbH
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,20 @@
+# AWS generic account setup
+Terraform module which creates AWS access via SAML.
+* Create SAML Provider
+* Create Role for SAML access
+* Attach given set of policies
+
+## Usage
+```hcl
+module "saml" {
+  source = "zoitech/saml/aws"
+  role_name = "SAML-Admin"
+  provider_metadata_url = "https://something.com/metadata.xml"
+}
+```
+
+## Authors
+Module managed by [Zoi](https://github.com/zoitech).
+
+## License
+MIT License. See LICENSE for full details.

iam_providers.tf

@@ -0,0 +1,4 @@
+resource "aws_iam_saml_provider" "saml" {
+  name                   = "${var.provider_name}"
+  saml_metadata_document = "${file(var.provider_metadata_file)}"
+}

iam_roles.tf

@@ -0,0 +1,27 @@
+resource "aws_iam_role" "DelegateUser" {
+    name = "${var.role_name}"
+    assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "Federated": "${aws_iam_saml_provider.saml.id}"
+      },
+      "Action": "sts:AssumeRoleWithSAML",
+      "Condition": {
+        "StringEquals": {
+          "SAML:aud": "https://signin.aws.amazon.com/saml"
+        }
+      }
+    }
+  ]
+}
+EOF
+}
+resource "aws_iam_role_policy_attachment" "DelegateUser_Attachment" {
+    role = "${aws_iam_role.DelegateUser.name}"
+    policy_arn = "${element(var.role_policies, count.index)}"
+    count = "${length(var.role_policies)}"
+}

outputs.tf

@@ -0,0 +1,8 @@
+output "role"{
+  description = "ARN of the Role"
+  value = "${aws_iam_role.DelegateUser.id}"
+}
+output "saml_provider"{
+  description = "ARN of the SAML Provider"
+  value = "${aws_iam_saml_provider.saml.id}"
+}

providers.tf

@@ -0,0 +1,3 @@
+provider "aws" {
+    region = "${var.aws_region}"
+}

variables.tf

@@ -0,0 +1,26 @@
+# Settings
+# Account ID
+data "aws_caller_identity" "current" { }
+
+variable "aws_region" {
+  description = "The reqion where the ressrouces should be create. Unimportant as IAM."
+  default = "eu-central-1"
+}
+variable "role_name" {
+  description = "The name of the Role"
+  default = "Delegate-Saml-Admin"
+}
+variable "role_policies" {
+  description = "The policies attached to the role"
+  default = ["arn:aws:iam::aws:policy/AdministratorAccess"]
+  type = "list"
+}
+
+variable "provider_name" {
+  description = "The name of the provider."
+  default = "default-saml-provider"
+}
+variable "provider_metadata_file" {
+  description = "The path to of the metadatafile"
+  default =""
+}