Skip to main content

IAM Users and IAM Groups

Convenient module to manage best practices set of IAM Groups for permissions management, and configuring IAM Users that take advantage of those groups.

View on GitHub

Reference​

  • aws_account_id — The AWS Account ID the template should be operated on. This avoids misconfiguration errors caused by environment variables.
  • cloudtrail_kms_key_arn — The ARN of a KMS CMK used to encrypt CloudTrail logs. If set, the logs group will include permissions to decrypt using this CMK.
  • force_destroy_users — When destroying this user, destroy even if it has non-Terraform-managed IAM access keys, login profile, or MFA devices. Without force_destroy a user with non-Terraform-managed access keys and login profile will fail to be destroyed.
  • iam_group_developers_permitted_services — A list of AWS services for which the developers IAM Group will receive full permissions. See https://goo.gl/ZyoHlz to find the IAM Service name. For example, to grant developers access only to EC2 and Amazon Machine Learning, use the value ["ec2","machinelearning"]. Do NOT add iam to the list of services, or that will grant Developers de facto admin access. If you need to grant iam privileges, just grant the user Full Access.
  • iam_group_name_billing — The name to be used for the IAM Group that grants read/write access to all billing features in AWS.
  • iam_group_name_developers — The name to be used for the IAM Group that grants IAM Users a reasonable set of permissions for developers.
  • iam_group_name_iam_admin — The name to be used for the IAM Group that grants IAM administrative access. Effectively grants administrator access.
  • iam_group_name_logs — The name to be used for the IAM Group that grants read access to CloudTrail, AWS Config, and CloudWatch in AWS.
  • iam_group_name_use_existing_iam_roles — The name to be used for the IAM Group that grants IAM Users the permissions to use existing IAM Roles when launching AWS Resources. This does NOT grant the permission to create new IAM Roles.
  • iam_group_names_ssh_grunt_sudo_users — The list of names to be used for the IAM Group that enables its members to SSH as a sudo user into any server configured with the ssh-grunt Gruntwork module. Pass in multiple to configure multiple different IAM groups to control different groupings of access at the server level. Pass in empty list to disable creation of the IAM groups.
  • iam_group_names_ssh_grunt_users — The name to be used for the IAM Group that enables its members to SSH as a non-sudo user into any server configured with the ssh-grunt Gruntwork module. Pass in multiple to configure multiple different IAM groups to control different groupings of access at the server level. Pass in empty list to disable creation of the IAM groups.
  • iam_groups_for_cross_account_access — This variable is used to create groups that allow IAM users to assume roles in your other AWS accounts. It should be a list of objects, where each object has the fields 'group_name', which will be used as the name of the IAM group, and 'iam_role_arns', which is a list of ARNs of IAM Roles that you can assume when part of that group. For each entry in the list of objects, we will create an IAM group that allows users to assume the given IAM role(s) in the other AWS account. This allows you to define all your IAM users in one account (e.g. the users account) and to grant them access to certain IAM roles in other accounts (e.g. the stage, prod, audit accounts).
  • iam_policy_iam_user_self_mgmt — The name to be used for the IAM Policy that grants IAM Users the permissions to manage their own IAM User account.
  • iam_role_tags — The tags to apply to all the IAM role resources.
  • max_session_duration_human_users — The maximum allowable session duration, in seconds, for the credentials you get when assuming the IAM roles created by this module. This variable applies to all IAM roles created by this module that are intended for people to use, such as allow-read-only-access-from-other-accounts. For IAM roles that are intended for machine users, such as allow-auto-deploy-from-other-accounts, see max_session_duration_machine_users.
  • max_session_duration_machine_users — The maximum allowable session duration, in seconds, for the credentials you get when assuming the IAM roles created by this module. This variable applies to all IAM roles created by this module that are intended for machine users, such as allow-auto-deploy-from-other-accounts. For IAM roles that are intended for human users, such as allow-read-only-access-from-other-accounts, see max_session_duration_human_users.
  • should_create_iam_group_iam_admin — Should we create the IAM Group for IAM administrator access? Allows users to manage all IAM entities, effectively granting administrator access. (true or false)
  • should_create_iam_group_user_self_mgmt — Should we create the IAM Group for user self-management? Allows users to manage their own IAM user accounts, but not other IAM users. (true or false)
  • should_require_mfa — Should we require that all IAM Users use Multi-Factor Authentication for both AWS API calls and the AWS Web Console? (true or false)
  • users — A map of users to create. The keys are the user names and the values are an object with the optional keys 'groups' (a list of IAM groups to add the user to), 'tags' (a map of tags to apply to the user), 'pgp_key' (either a base-64 encoded PGP public key, or a keybase username in the form keybase:username, used to encrypt the user's credentials; required if create_login_profile or create_access_keys is true), 'create_login_profile' (if set to true, create a password to login to the AWS Web Console), 'create_access_keys' (if set to true, create access keys for the user), 'path' (the path), and 'permissions_boundary' (the ARN of the policy that is used to set the permissions boundary for the user).