Skip to content

Commit 1db79b2

Browse files
nozaqnozaq
authored
Merge pull request #7 from nozaq/iam-baseline
feat: add IAM baseline module
2 parents 2ccd6ea + 3593e1e commit 1db79b2

File tree

9 files changed

+380
-19
lines changed

9 files changed

+380
-19
lines changed

‎.circleci/config.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
command: terraform init
1313
- run:
1414
name: Make sure the syntax is correct.
15-
command: terraform validate -var access_key=DUMMY -var secret_key=DUMMY
15+
command: terraform validate -var access_key=DUMMY -var secret_key=DUMMY -var iam_support_role_principal_arn=DUMMY
1616
- run:
1717
name: Make sure format wouldn't produce any diffs.
18-
command: terraform fmt -check=true
18+
command: terraform fmt -check=true

‎examples/root-example/main.tf

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,10 @@ data "aws_caller_identity" "current" {}
99
module "root_example" {
1010
source = "../../"
1111

12-
audit_log_bucket_name = "${var.audit_s3_bucket_name}"
13-
aws_account_id = "${data.aws_caller_identity.current.account_id}"
14-
region = "${var.region}"
12+
audit_log_bucket_name = "${var.audit_s3_bucket_name}"
13+
aws_account_id = "${data.aws_caller_identity.current.account_id}"
14+
region = "${var.region}"
15+
iam_support_role_principal_arn = "${var.iam_support_role_principal_arn}"
1516

1617
providers = {
1718
"aws" = "aws"

‎examples/root-example/variables.tf

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,16 @@
11
variable "access_key" {}
22
variable "secret_key" {}
33

4-
variable "region" {
5-
default = "us-east-1"
4+
variable "audit_s3_bucket_name" {
5+
description = "The name of the S3 bucket to store various audit logs."
6+
default = "YOUR_BUCKET_NAME_HERE"
67
}
78

8-
variable "audit_s3_bucket_name" {
9-
default = "YOUR_BUCKET_NAME_HERE"
9+
variable "iam_support_role_principal_arn" {
10+
description = "The ARN of the IAM principal element by which the support role could be assumed."
11+
}
12+
13+
variable "region" {
14+
description = "The AWS region in which global resources are set up."
15+
default = "us-east-1"
1016
}

‎main.tf

Lines changed: 20 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -64,18 +64,28 @@ END_OF_POLICY
6464
}
6565

6666
# --------------------------------------------------------------------------------------------------
67-
# IAM Password Policy
67+
# IAM Baseline
6868
# --------------------------------------------------------------------------------------------------
6969

70-
resource "aws_iam_account_password_policy" "default" {
71-
minimum_password_length = 14
72-
password_reuse_prevention = 24
73-
require_lowercase_characters = true
74-
require_numbers = true
75-
require_uppercase_characters = true
76-
require_symbols = true
77-
allow_users_to_change_password = true
78-
max_password_age = 90
70+
module "iam_baseline" {
71+
source = "./modules/iam-baseline"
72+
73+
aws_account_id = "${var.aws_account_id}"
74+
iam_master_role_name = "${var.iam_master_role_name}"
75+
iam_master_role_policy_name = "${var.iam_master_role_policy_name}"
76+
iam_manager_role_name = "${var.iam_manager_role_name}"
77+
iam_manager_role_policy_name = "${var.iam_manager_role_policy_name}"
78+
iam_support_role_name = "${var.iam_support_role_name}"
79+
iam_support_role_policy_name = "${var.iam_support_role_policy_name}"
80+
iam_support_role_principal_arn = "${var.iam_support_role_principal_arn}"
81+
minimum_password_length = "${var.minimum_password_length}"
82+
password_reuse_prevention = "${var.password_reuse_prevention}"
83+
require_lowercase_characters = "${var.require_lowercase_characters}"
84+
require_numbers = "${var.require_numbers}"
85+
require_uppercase_characters = "${var.require_uppercase_characters}"
86+
require_symbols = "${var.require_symbols}"
87+
allow_users_to_change_password = "${var.allow_users_to_change_password}"
88+
max_password_age = "${var.max_password_age}"
7989
}
8090

8191
# --------------------------------------------------------------------------------------------------

‎modules/iam-baseline/main.tf

Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
# --------------------------------------------------------------------------------------------------
2+
# Password Policy
3+
# --------------------------------------------------------------------------------------------------
4+
5+
resource "aws_iam_account_password_policy" "default" {
6+
minimum_password_length = "${var.minimum_password_length}"
7+
password_reuse_prevention = "${var.password_reuse_prevention}"
8+
require_lowercase_characters = "${var.require_lowercase_characters}"
9+
require_numbers = "${var.require_numbers}"
10+
require_uppercase_characters = "${var.require_uppercase_characters}"
11+
require_symbols = "${var.require_symbols}"
12+
allow_users_to_change_password = "${var.allow_users_to_change_password}"
13+
max_password_age = "${var.max_password_age}"
14+
}
15+
16+
# --------------------------------------------------------------------------------------------------
17+
# Manager & Master Role Separation
18+
# --------------------------------------------------------------------------------------------------
19+
20+
resource "aws_iam_role" "master" {
21+
name = "${var.iam_master_role_name}"
22+
23+
assume_role_policy = <<END_OF_POLICY
24+
{
25+
"Version": "2012-10-17",
26+
"Statement": [
27+
{
28+
"Effect": "Allow",
29+
"Action": "sts:AssumeRole",
30+
"Principal": {
31+
"AWS": "arn:aws:iam::${var.aws_account_id}:root"
32+
}
33+
}
34+
]
35+
}
36+
END_OF_POLICY
37+
}
38+
39+
resource "aws_iam_role_policy" "master_policy" {
40+
name = "${var.iam_master_role_policy_name}"
41+
42+
role = "${aws_iam_role.master.id}"
43+
44+
policy = <<END_OF_POLICY
45+
{
46+
"Version": "2012-10-17",
47+
"Statement": [
48+
{
49+
"Effect": "Allow",
50+
"Action": [
51+
"iam:CreateGroup", "iam:CreatePolicy", "iam:CreatePolicyVersion", "iam:CreateRole", "iam:CreateUser",
52+
"iam:DeleteGroup", "iam:DeletePolicy", "iam:DeletePolicyVersion", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DeleteUser",
53+
"iam:PutRolePolicy",
54+
"iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy",
55+
"iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser",
56+
"iam:ListPolicies", "iam:ListPoliciesGrantingServiceAccess", "iam:ListPolicyVersions",
57+
"iam:ListRolePolicies", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies",
58+
"iam:ListAttachedUserPolicies", "iam:ListRoles", "iam:ListUsers"
59+
],
60+
"Resource": "*",
61+
"Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}}
62+
}, {
63+
"Effect": "Deny",
64+
"Action": [
65+
"iam:AddUserToGroup",
66+
"iam:AttachGroupPolicy",
67+
"iam:DeleteGroupPolicy", "iam:DeleteUserPolicy",
68+
"iam:DetachGroupPolicy", "iam:DetachRolePolicy", "iam:DetachUserPolicy",
69+
"iam:PutGroupPolicy", "iam:PutUserPolicy",
70+
"iam:RemoveUserFromGroup",
71+
"iam:UpdateGroup", "iam:UpdateAssumeRolePolicy", "iam:UpdateUser"
72+
],
73+
"Resource": "*"
74+
}
75+
]
76+
}
77+
END_OF_POLICY
78+
}
79+
80+
resource "aws_iam_role" "manager" {
81+
name = "${var.iam_manager_role_name}"
82+
83+
assume_role_policy = <<END_OF_POLICY
84+
{
85+
"Version": "2012-10-17",
86+
"Statement": [
87+
{
88+
"Effect": "Allow",
89+
"Action": "sts:AssumeRole",
90+
"Principal": {
91+
"AWS": "arn:aws:iam::${var.aws_account_id}:root"
92+
}
93+
}
94+
]
95+
}
96+
END_OF_POLICY
97+
}
98+
99+
resource "aws_iam_role_policy" "manager_policy" {
100+
name = "${var.iam_manager_role_policy_name}"
101+
102+
role = "${aws_iam_role.manager.id}"
103+
104+
policy = <<END_OF_POLICY
105+
{
106+
"Version": "2012-10-17",
107+
"Statement": [
108+
{
109+
"Effect": "Allow",
110+
"Action": [
111+
"iam:AddUserToGroup",
112+
"iam:AttachGroupPolicy",
113+
"iam:DeleteGroupPolicy", "iam:DeleteUserPolicy",
114+
"iam:DetachGroupPolicy", "iam:DetachRolePolicy","iam:DetachUserPolicy",
115+
"iam:PutGroupPolicy", "iam:PutUserPolicy",
116+
"iam:RemoveUserFromGroup",
117+
"iam:UpdateGroup", "iam:UpdateAssumeRolePolicy", "iam:UpdateUser",
118+
"iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy",
119+
"iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser",
120+
"iam:ListPolicies", "iam:ListPoliciesGrantingServiceAccess", "iam:ListPolicyVersions",
121+
"iam:ListRolePolicies", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies",
122+
"iam:ListAttachedUserPolicies", "iam:ListRoles", "iam:ListUsers"
123+
],
124+
"Resource": "*",
125+
"Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}}
126+
}, {
127+
"Effect": "Deny",
128+
"Action": [
129+
"iam:CreateGroup", "iam:CreatePolicy", "iam:CreatePolicyVersion", "iam:CreateRole", "iam:CreateUser",
130+
"iam:DeleteGroup", "iam:DeletePolicy", "iam:DeletePolicyVersion", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DeleteUser",
131+
"iam:PutRolePolicy"
132+
],
133+
"Resource": "*"
134+
}
135+
]
136+
}
137+
END_OF_POLICY
138+
}
139+
140+
# --------------------------------------------------------------------------------------------------
141+
# Support Role
142+
# --------------------------------------------------------------------------------------------------
143+
144+
resource "aws_iam_role" "support" {
145+
name = "${var.iam_support_role_name}"
146+
147+
assume_role_policy = <<END_OF_POLICY
148+
{
149+
"Version": "2012-10-17",
150+
"Statement": [
151+
{
152+
"Effect": "Allow",
153+
"Action": "sts:AssumeRole",
154+
"Principal": {
155+
"AWS": "${var.iam_support_role_principal_arn}"
156+
}
157+
}
158+
]
159+
}
160+
END_OF_POLICY
161+
}
162+
163+
resource "aws_iam_role_policy_attachment" "support_policy" {
164+
role = "${aws_iam_role.support.id}"
165+
policy_arn = "arn:aws:iam::aws:policy/AWSSupportAccess"
166+
}

‎modules/iam-baseline/outputs.tf

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
output "iam_master_role_arn" {
2+
value = "${aws_iam_role.master.arn}"
3+
}
4+
5+
output "iam_manager_role_arn" {
6+
value = "${aws_iam_role.manager.arn}"
7+
}
8+
9+
output "iam_support_role_arn" {
10+
value = "${aws_iam_role.support.arn}"
11+
}

‎modules/iam-baseline/variables.tf

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
variable "aws_account_id" {
2+
description = "The AWS Account ID number of the account."
3+
}
4+
5+
variable "iam_master_role_name" {
6+
description = "The name of the IAM Master role."
7+
default = "IAM-Master"
8+
}
9+
10+
variable "iam_master_role_policy_name" {
11+
description = "The name of the IAM Master role policy."
12+
default = "IAM-Master-Policy"
13+
}
14+
15+
variable "iam_manager_role_name" {
16+
description = "The name of the IAM Manager role."
17+
default = "IAM-Manager"
18+
}
19+
20+
variable "iam_manager_role_policy_name" {
21+
description = "The name of the IAM Manager role policy."
22+
default = "IAM-Manager-Policy"
23+
}
24+
25+
variable "iam_support_role_name" {
26+
description = "The name of the the support role."
27+
default = "IAM-Support"
28+
}
29+
30+
variable "iam_support_role_policy_name" {
31+
description = "The name of the support role policy."
32+
default = "IAM-Support-Role"
33+
}
34+
35+
variable "iam_support_role_principal_arn" {
36+
description = "The ARN of the IAM principal element by which the support role could be assumed."
37+
}
38+
39+
variable "max_password_age" {
40+
description = "The number of days that an user password is valid."
41+
default = 90
42+
}
43+
44+
variable "minimum_password_length" {
45+
description = "Minimum length to require for user passwords."
46+
default = 14
47+
}
48+
49+
variable "password_reuse_prevention" {
50+
description = "The number of previous passwords that users are prevented from reusing."
51+
default = 24
52+
}
53+
54+
variable "require_lowercase_characters" {
55+
description = "Whether to require lowercase characters for user passwords."
56+
default = true
57+
}
58+
59+
variable "require_numbers" {
60+
description = "Whether to require numbers for user passwords."
61+
default = true
62+
}
63+
64+
variable "require_uppercase_characters" {
65+
description = "Whether to require uppercase characters for user passwords."
66+
default = true
67+
}
68+
69+
variable "require_symbols" {
70+
description = "Whether to require symbols for user passwords."
71+
default = true
72+
}
73+
74+
variable "allow_users_to_change_password" {
75+
description = "Whether to allow users to change their own password."
76+
default = true
77+
}

‎outputs.tf

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,15 @@
11
output "audit_bucket_id" {
22
value = "${module.audit_log_bucket.bucket_id}"
33
}
4+
5+
output "iam_master_role_arn" {
6+
value = "${module.iam_baseline.iam_master_role_arn}"
7+
}
8+
9+
output "iam_manager_role_arn" {
10+
value = "${module.iam_baseline.iam_manager_role_arn}"
11+
}
12+
13+
output "iam_support_role_arn" {
14+
value = "${module.iam_baseline.iam_support_role_arn}"
15+
}

0 commit comments

Comments
 (0)