Skip to content

vinelias/terraform-aws-permission-sets

 
 

Repository files navigation

AWS Permissions Sets

Use this module to dynamic manage AWS IAM Identity Center Permission Sets using Terraform and JSON file templates.

Prerequisites

Ensure that you have an instance of IAM Identity Center set up and enabled across your organization. For detailed guidance, refer to the Enabling AWS IAM Identity Center documentation. It is highly recommended to use an IAM Identity Center administrator delegated account for managing Permission Sets. For more information, see Delegated administration.

  1. AWS account and credentials
  2. Terraform set up
  3. JSON file templates

Usage

Make sure you are logged in the AWS account where the IAM Identity Center is deployed or in the delegated administrator account.

Create a directory to store your JSON file templates, which will include the Permission Set definitions (name, policies, assignments, etc.). When using this module, you should specify the path to this folder in the templates_path variable.

Templates directory structure sample (e.g. templates):

templates
├── my-permission-set.json
└── other-permission-set.json

Permission Set template sample (e.g. my-permission-set.json):

{
  "Name": "MyPermissionSet",
  "Comment": "This permission set will be created and assigned to the group MyGroup for all accounts within the organization.",
  "Description": "My Permission Set",
  "SessionDuration": "PT1H",
  "ManagedPolicies": [
    "arn:aws:iam::aws:policy/AdministratorAccess"
  ],
  "CustomerPolicies": [],
  "CustomPolicy": {},
  "PermissionBoundary": {
    "ManagedPolicy": "",
    "CustomerPolicy": ""
  },
  "Tags": {
    "Team": "MyTeam"
  },
  "Assignments": [
    {
      "all_accounts": true,
      "principal": "MyGroup",
      "type": "GROUP",
      "account_id": [],
      "account_ou": [],
      "account_tag": []
    }
  ]
}

Next, you can call the module, specifying the AWS provider and the IAM Identity Center region (e.g. us-east-1):

provider "aws" {
  region = "{{ region }}"
}
module "aws_permission_sets" {
  source = "aws-ia/permission-sets/aws"

  templates_path = "./templates"
  tags           = var.tags
}

JSON file templates

See the JSON schema for Permission Set templates:

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "Name": {
      "type": "string"
    },
    "Comment": {
      "type": "string"
    },
    "Description": {
      "type": "string"
    },
    "SessionDuration": {
      "type": "string"
    },
    "ManagedPolicies": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "CustomerPolicies": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "CustomPolicy": {
      "type": "object",
      "properties": {
        "items": {
          "type": "string"
        }
      }
    },
    "PermissionBoundary": {
      "type": "object",
      "properties": {
        "ManagedPolicy": {
          "type": "string"
        },
        "CustomerPolicy": {
          "type": "string"
        }
      }
    },
    "Tags": {
      "type": "object",
      "properties": {
        "Teams": {
          "type": "string"
        }
      }
    },
    "Assignments": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "all_accounts": {
            "type": "boolean"
          },
          "principal": {
            "type": "string"
          },
          "type": {
            "type": "string",
            "enum": ["GROUP", "USER"]
          },
          "account_id": {
            "type": "array",
            "items": {
              "type": "string"
            }
          },
          "account_ou": {
            "type": "array",
            "items": {
              "type": "string"
            }
          },
          "account_tag": {
            "type": "object",
            "items": {
              "type": "string"
            }
          }
        },
        "required": ["all_accounts", "principal", "type"]
      }
    }
  },
  "anyOf": [
    {
      "required": [
        "Name",
        "Comment",
        "Description",
        "SessionDuration",
        "ManagedPolicies",
        "PermissionBoundary",
        "Assignments"
      ]
    },
    {
      "required": [
        "Name",
        "Comment",
        "Description",
        "SessionDuration",
        "CustomerPolicies",
        "PermissionBoundary",
        "Assignments"
      ]
    },
    {
      "required": [
        "Name",
        "Comment",
        "Description",
        "SessionDuration",
        "CustomPolicy",
        "PermissionBoundary",
        "Assignments"
      ]
    }
  ]
}

Contributing

Please see our developer documentation for guidance on contributing to this module.

Requirements

Name Version
terraform >=1.6
aws >=5.0

Providers

Name Version
aws >=5.0

Modules

No modules.

Resources

Name Type
aws_ssoadmin_account_assignment.assignment resource
aws_ssoadmin_customer_managed_policy_attachment.customer_policy resource
aws_ssoadmin_managed_policy_attachment.managed_policy resource
aws_ssoadmin_permission_set.permission_set resource
aws_ssoadmin_permission_set_inline_policy.inline_policy resource
aws_ssoadmin_permissions_boundary_attachment.boundary resource
aws_identitystore_group.sso data source
aws_identitystore_user.sso data source
aws_organizations_organization.org data source
aws_organizations_organizational_unit_descendant_accounts.accounts_per_ou data source
aws_organizations_organizational_unit_descendant_accounts.org_accounts data source
aws_organizations_resource_tags.account_tags data source
aws_ssoadmin_instances.sso data source

Inputs

Name Description Type Default Required
tags Specifies a map of tags to be applied to the resources created by the module. map(string) {} no
templates_path Specifies the path to the folder containing the permission set templates to be read by the module. string "./templates" no

Outputs

Name Description
assignments Permission Sets assignments
permission_sets Permission Sets definitions

About

No description, website, or topics provided.

Resources

License

Code of conduct

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • HCL 48.1%
  • Shell 43.1%
  • Dockerfile 8.8%