Skip to content

Manage IAM permissions for users who provision COOL assessment environments

License

Notifications You must be signed in to change notification settings

jmorrowomni/cool-assessment-provisioner-iam

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

cool-assessment-provisioner-iam

GitHub Build Status

This is a Terraform deployment for creating IAM resources for those users allowed to provision assessment environments in the COOL.

Pre-requisites

  • Terraform installed on your system.
  • An accessible AWS S3 bucket to store Terraform state (specified in backend.tf).
  • An accessible AWS DynamoDB database to store the Terraform state lock (specified in backend.tf).
  • Access to all of the Terraform remote states specified in remote_states.tf.
  • User accounts for all users must have been created previously. We recommend using the cisagov/cool-users-non-admin repository to create users.

Usage

  1. Create a Terraform workspace (if you haven't already done so) by running terraform workspace new <workspace_name>
  2. Create a <workspace_name>.tfvars file with all of the required variables (see Inputs below for details):
users = [
  "firstname1.lastname1",
  "firstname2.lastname2"
]
  1. Run the command terraform init.
  2. Run the command terraform apply -var-file=<workspace_name>.tfvars.

Requirements

Name Version
terraform ~> 1.0
aws ~> 3.38

Providers

Name Version
aws ~> 3.38
aws.organizationsreadonly ~> 3.38
aws.users ~> 3.38
terraform n/a

Modules

No modules.

Resources

Name Type
aws_iam_group.assessment_provisioners resource
aws_iam_group_policy_attachment.assessment_provisioners resource
aws_iam_policy.provision_assessment resource
aws_iam_user_group_membership.assessment_provisioners resource
aws_caller_identity.default data source
aws_caller_identity.users data source
aws_iam_policy_document.provision_assessment data source
aws_organizations_organization.cool data source
terraform_remote_state.dns_certboto data source
terraform_remote_state.images_parameterstore-production data source
terraform_remote_state.images_parameterstore-staging data source
terraform_remote_state.master data source
terraform_remote_state.sharedservices-production data source
terraform_remote_state.sharedservices-staging data source
terraform_remote_state.terraform data source
terraform_remote_state.users data source

Inputs

Name Description Type Default Required
assessment_provisioners_group_name The name of the IAM group whose members are allowed to provision assessment environments. string "assessment_provisioners" no
aws_region The AWS region to deploy into (e.g. us-east-1). string "us-east-1" no
provision_assessment_policy_description The description to associate with the IAM policy in the Users account that allows the assessment provisioner group to assume all roles needed in order to provision assessment environments. string "Allows the assessment provisioner group to assume all roles needed in order to provision assessment environments." no
provision_assessment_policy_name The name of the IAM policy in the Users account that allows the assessment provisioner group to assume all roles needed in order to provision assessment environments. string "AssumeProvisionAssessment" no
provision_assessment_role_name The name of the IAM role in assessment accounts that includes all permissions necessary to provision the assessment environment in that account. If this role does not exist in an account, an assessment environment cannot be provisioned in that account. string "ProvisionAccount" no
startstopssmsession_role_name The name of the IAM role in assessment accounts that includes all permissions necessary to start and stop an SSM session in that account. string "StartStopSSMSession" no
tags Tags to apply to all AWS resources created. map(string) {} no
users A list containing the usernames of users that exist in the Users account who are allowed to provision assessment environments. Example: [ "firstname1.lastname1", "firstname2.lastname2" ]. list(string) n/a yes

Outputs

Name Description
assessment_provisioners_group The IAM group whose members are allowed to provision assessment environments.
assessment_provisioners_policy The IAM policy in the Users account that allows the assessment provisioners group to assume the provisioning role in assessment accounts.

Notes

Running pre-commit requires running terraform init in every directory that contains Terraform code. In this repository, this is just the main directory.

Contributing

We welcome contributions! Please see CONTRIBUTING.md for details.

License

This project is in the worldwide public domain.

This project is in the public domain within the United States, and copyright and related rights in the work worldwide are waived through the CC0 1.0 Universal public domain dedication.

All contributions to this project will be released under the CC0 dedication. By submitting a pull request, you are agreeing to comply with this waiver of copyright interest.

About

Manage IAM permissions for users who provision COOL assessment environments

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • HCL 75.1%
  • Shell 24.9%