Merge pull request #7875 from ministryofjustice/feature/add-quicksigh…

…t-permission-set Adding QuickSight Admin Permission Set
ministryofjustice · Sep 6, 2024 · be38812 · be38812
2 parents f0c061d + ff30195
commit be38812
Show file tree

Hide file tree

Showing 2 changed files with 43 additions and 0 deletions.
diff --git a/terraform/single-sign-on/outputs.tf b/terraform/single-sign-on/outputs.tf
@@ -59,6 +59,11 @@ output "read_only" {
  value = data.aws_ssoadmin_permission_set.read_only.arn
 }
 
+output "quicksight_admin" {
+ value = aws_ssoadmin_permission_set.modernisation_platform_quicksight_admin.arn
+}
+
 output "ssoadmin_instances" {
  value = data.aws_ssoadmin_instances.default
 }
+
diff --git a/terraform/single-sign-on/sso-permission-sets.tf b/terraform/single-sign-on/sso-permission-sets.tf
@@ -409,3 +409,41 @@ resource "aws_ssoadmin_customer_managed_policy_attachment" "modernisation_platfo
  path = "/"
  }
 }
+
+
+# Modernisation Platform QuickSight Administrator
+resource "aws_ssoadmin_permission_set" "modernisation_platform_quicksight_admin" {
+ provider = aws.sso-management
+ name = "modernisation-platform-qs-admin"
+ description = "Modernisation Platform: quicksight admin tenancy"
+ instance_arn = local.sso_admin_instance_arn
+ session_duration = "PT8H"
+ tags = {}
+}
+
+resource "aws_ssoadmin_managed_policy_attachment" "modernisation_platform_quicksight_admin" {
+ provider = aws.sso-management
+ instance_arn = local.sso_admin_instance_arn
+ managed_policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess"
+ permission_set_arn = aws_ssoadmin_permission_set.modernisation_platform_quicksight_admin.arn
+}
+
+resource "aws_ssoadmin_customer_managed_policy_attachment" "modernisation_platform_quicksight_admin" {
+ provider = aws.sso-management
+ instance_arn = local.sso_admin_instance_arn
+ permission_set_arn = aws_ssoadmin_permission_set.modernisation_platform_quicksight_admin.arn
+ customer_managed_policy_reference {
+ name = "quicksight_administrator_policy"
+ path = "/"
+ }
+}
+
+resource "aws_ssoadmin_customer_managed_policy_attachment" "modernisation_platform_quicksight_admin_common" {
+ provider = aws.sso-management
+ instance_arn = local.sso_admin_instance_arn
+ permission_set_arn = aws_ssoadmin_permission_set.modernisation_platform_quicksight_admin.arn
+ customer_managed_policy_reference {
+ name = "common_policy"
+ path = "/"
+ }
+}