Home > Modules > Component: iam-delegated-roles

Component: iam-delegated-roles

No description available.

Component: iam-delegated-roles

This component is responsible for provisioning all delegated user and system IAM roles. It sets them up to be assumed from the primary, identity account roles. This is expected to be used alongside and applied after the iam-primary-roles component is applied to the identity account.

Usage

Stack Level: Global

Here’s an example snippet for how to use this component. This specific usage is for an audit stack (e.g. gbl-audit.yaml) where limiting the default permissions of the roles is desired.

components:
  terraform:
    iam-delegated-roles:
      vars:
        exclude_roles: [ "helm" ]
        account_role_policy_arns:
          # IAM Policy ARNs to attach to each role, overriding the defaults
          admin: [ "arn:aws:iam::aws:policy/PowerUserAccess" ]
          ops: [ "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess" ]
          poweruser: [ "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess" ]
          observer: [ "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess" ]
          # Use default for terraform

        trusted_primary_role_overrides:
          # Terraform in audit can wipe out logs, so access to it needs to be restricted
          terraform: [ "admin" ]

Requirements

Name Version
terraform >= 0.12.0
aws >= 2.0
local >= 1.3
template >= 2.0

Providers

Name Version
aws >= 2.0
terraform n/a

Inputs

Name Description Type Default Required
account_number Account number for the target account string n/a yes
account_role_policy_arns Custom IAM policy ARNs to override defaults map(list(string)) {} no
additional_tag_map Additional tags for appending to tags_as_list_of_maps. Not added to tags. map(string) {} no
allow_same_account_assume_role Set true to allow roles to assume other roles in the same account bool false no
attributes Additional attributes (e.g. 1) list(string) [] no
context Single object for setting entire context at once.See description of individual variables for details.Leave string and numeric variables as null to use default value.Individual variable settings (non-null) override settings in context object,except for attributes, tags, and additional_tag_map, which are merged. object({ enabled = bool namespace = string environment = string stage = string name = string delimiter = string attributes = list(string) tags = map(string) additional_tag_map = map(string) regex_replace_chars = string label_order = list(string) id_length_limit = number }) { “additional_tag_map”: {}, “attributes”: [], “delimiter”: null, “enabled”: true, “environment”: null, “id_length_limit”: null, “label_order”: [], “name”: null, “namespace”: null, “regex_replace_chars”: null, “stage”: null, “tags”: {}} no
default_account_role_policy_arns Custom IAM policy ARNs to override defaults map(list(string)) n/a yes
delimiter Delimiter to be used between namespace, environment, stage, name and attributes.Defaults to - (hyphen). Set to "" to use no delimiter at all. string null no
enabled Set to false to prevent the module from creating any resources bool null no
environment Environment, e.g. ‘uw2’, ‘us-west-2’, OR ‘prod’, ‘staging’, ‘dev’, ‘UAT’ string null no
exclude_roles Roles in roles_config that should NOT be created list(string) [] no
iam_primary_roles_stage_name The name of the stage where the IAM primary roles are provisioned string "identity" no
iam_role_max_session_duration The maximum session duration (in seconds) that you want to set for the IAM roles. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours number 43200 no
iam_roles_environment_name The name of the environment where the IAM roles are provisioned string "gbl" no
id_length_limit Limit id to this many characters.Set to 0 for unlimited length.Set to null for default, which is 0.Does not affect id_full. number null no
import_role_arn IAM Role ARN to use when importing a resource string null no
label_order The naming order of the id output and Name tag.Defaults to [“namespace”, “environment”, “stage”, “name”, “attributes”].You can omit any of the 5 elements, but at least one must be present. list(string) null no
name Solution name, e.g. ‘app’ or ‘jenkins’ string null no
namespace Namespace, which could be your organization name or abbreviation, e.g. ‘eg’ or ‘cp’ string null no
primary_account_id Primary authentication account id used as the source for assume role string n/a yes
regex_replace_chars Regex to replace chars with empty string in namespace, environment, stage and name.If not set, "/[^a-zA-Z0-9-]/" is used to remove all characters other than hyphens, letters and digits. string null no
region AWS Region string n/a yes
stage Stage, e.g. ‘prod’, ‘staging’, ‘dev’, OR ‘source’, ‘build’, ‘test’, ‘deploy’, ‘release’ string null no
tags Additional tags (e.g. map('BusinessUnit','XYZ') map(string) {} no
tfstate_account_id The ID of the account where the Terraform remote state backend is provisioned string "" no
tfstate_assume_role Set to false to use the caller’s role to access the Terraform remote state bool true no
tfstate_backend_stage_name The name of the stage where the Terraform state backend is provisioned string "root" no
tfstate_bucket_environment_name The name of the environment for Terraform state bucket string "" no
tfstate_bucket_stage_name The name of the stage for Terraform state bucket string "root" no
tfstate_existing_role_arn The ARN of the existing IAM Role to access the Terraform remote state. If not provided and remote_state_assume_role is true, a role will be constructed from remote_state_role_arn_template string "" no
tfstate_role_arn_template IAM Role ARN template for accessing the Terraform remote state string "arn:aws:iam::%s:role/%s-%s-%s-%s" no
tfstate_role_environment_name The name of the environment for Terraform state IAM role string "gbl" no
tfstate_role_name IAM Role name for accessing the Terraform remote state string "terraform" no
tfstate_role_stage_name The name of the stage for Terraform state IAM role string "root" no
trusted_primary_role_overrides Override default list of primary roles that can assume this one map(list(string)) {} no

Outputs

Name Description
role_long_name_policy_arn_map Map of role long names to attached IAM Policy ARNs
role_name_role_arn_map Map of role names to role ARNs

References