DOCSEARCHbyAlgolia
Submit Docs

terraform-aws-modules/terraform-aws-iam

repository·master·Indexed 21 days ago

https://github.com/terraform-aws-modules/terraform-aws-iam

A comprehensive Terraform module for managing AWS IAM resources, including accounts, groups, users, roles, policies, and OIDC/SAML providers. It includes specialized functionality for configuring AWS account aliases, password policies, GitHub OIDC providers, and IAM roles for EKS Service Accounts (IRSA). Requires Terraform >= 1.5.7 and AWS provider >= 6.28.

Tokens
32.3K
Snippets
68
Records
113
Agent score
71%

What's inside terraform-aws-iam

  1. Configure IAM Role for EKS Service Accounts (IRSA)

    master

    The iam-role-for-service-accounts module automates the creation of IAM roles intended for use with Amazon EKS Service Accounts (IRSA). It allows you to easily attach pre-defined AWS managed policies for common EKS add-ons (like EBS CSI, VPC CNI, or Load Balancer Controller) and manage OIDC provider mappings for specific namespaces and service accounts.

    Key Capabilities

    • Add-on Support: Toggle permissions for common EKS components via boolean flags (e.g., attach_ebs_csi_policy, attach_vpc_cni_policy).
    • OIDC Integration: Map roles to specific Kubernetes namespaces and service accounts using the oidc_providers input.
    • Custom Permissions: Define custom inline or managed policies using the permissions or inline_policy_permissions maps.
    • Policy Merging: Combine multiple IAM policy documents using source_policy_documents or override_policy_documents.

  3. Use the IAM Role for Service Accounts wrapper module

    master

    The iam-role-for-service-accounts wrapper is a specialized implementation of the single module wrapper pattern. It is designed to manage multiple instances of the underlying modules/iam-role-for-service-accounts module within a single configuration block. This is particularly useful in environments like Terragrunt where native Terraform for_each usage might be restricted or where you want to avoid duplicating configuration files for every individual resource instance.

    This wrapper does not add new AWS functionality; it only provides a structural way to pass multiple sets of arguments to the underlying module using a defaults and items pattern.

    module "wrapper" {
  source = "terraform-aws-modules/iam/aws//wrappers/iam-role-for-service-accounts"

  defaults = {
    create = true
    tags = {
      Terraform   = "true"
      Environment = "dev"
    }
  }

  items = {
    my-item = {
      # arguments supported by the underlying module
    }
    my-second-item = {
      # arguments supported by the underlying module
    }
  }
}

  4. Create an IAM Role for EKS Service Accounts (IRSA)

    master

    This module creates an AWS IAM role that can be assumed by AWS EKS ServiceAccounts using OIDC federation. It is designed to provide fine-grained permissions to Kubernetes pods.

    Key features include:

    • Support for multiple ServiceAccounts across multiple clusters and/or namespaces within a single IAM role.
    • Built-in support for attaching common policies used by EKS controllers (e.g., EBS CSI Driver, Load Balancer Controller, External DNS, etc.).
    • Seamless integration with the terraform-aws-eks module.

    Note: For newer EKS implementations, consider using EKS Pod Identity instead of IRSA.

    module "irsa" {
  source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"

  name = "my-app"

  oidc_providers = {
    one = {
      provider_arn               = "arn:aws:iam::012345678901:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/5C54DDF35ER19312844C7333374CC09D"
      namespace_service_accounts = ["default:my-app-staging", "canary:my-app-staging"]
    }
    two = {
      provider_arn               = "arn:aws:iam::012345678901:oidc-provider/oidc.ap-southeast-1.amazonaws.com/id/5C54DDF35ER54476848E7333374FF09G"
      namespace_service_accounts = ["default:my-app-staging"]
    }
  }

  policies = {
    policy = "arn:aws:iam::012345678901:policy/myapp"
  }
}

  5. What is the IAM OIDC Provider wrapper module?

    master

    The iam-oidc-provider wrapper is a specialized implementation of the 'single module wrapper pattern'. It is designed to allow managing multiple instances of the underlying modules/iam-oidc-provider module within a single configuration block.

    This is particularly useful in environments like Terragrunt where using native Terraform for_each logic might not be feasible or where you want to manage multiple resources without duplicating terragrunt.hcl files for every single instance.

    Note that this wrapper does not add any new AWS functionality; it only provides a structural way to iterate over multiple resource definitions using defaults and items blocks.

  6. Use the iam-policy module wrapper

    master

    The iam-policy wrapper is a pattern used to manage multiple instances of the modules/iam-policy module within a single configuration block. This is particularly useful in environments like Terragrunt where native Terraform for_each logic might not be feasible for managing multiple distinct resource copies without duplicating configuration files.

    This wrapper does not add new functionality; it simply provides a way to pass a map of items and a map of defaults to the underlying module.

  7. Use PGP encryption with Keybase to secure secrets

    master

    To prevent Terraform from storing unencrypted passwords and access secret keys in the state file, use PGP encryption by providing a pgp_key.

    You can specify a Keybase username in the format keybase:username. Ensure the target user has already uploaded their public key to Keybase.io. When this is used, the module will output encrypted versions of the password and secret key.

  9. Configure IAM group permissions and policies

    master

    The module provides several ways to define what the group can do:

    1. Managed Policies: Use the policies input to attach existing AWS managed policies or custom policies using a map in {'static_name' = 'policy_arn'} format.
    2. Custom Inline Permissions: Use the permissions input to define custom IAM policy statements. This accepts a map where keys are identifiers and values are objects defining the statement (actions, resources, effect, etc.).
    3. Specialized Permissions:
      • enable_mfa_enforcement: When true, adds permissions to the policy that require group users to use MFA.
      • enable_self_management_permissions: When true, adds permissions allowing users to manage their own credentials and MFA.

  10. Use the IAM Role module wrapper for multiple resources

    master

    The wrappers/iam-role directory provides a single module wrapper pattern. This is designed for scenarios where native Terraform for_each is not feasible, such as when using Terragrunt. It allows you to manage multiple instances of the modules/iam-role module within a single configuration file by defining a map of items.

    This wrapper does not add new functionality; it simply facilitates the bulk management of multiple IAM roles through two primary input blocks:

    1. defaults: A map of arguments applied to every item in the items block.
    2. items: A map where each key represents a unique instance of the module, and the value is a map of arguments specific to that instance (which can override or supplement defaults).

  11. IAM Role module variations

    master

    This example demonstrates several ways to configure the iam-role module, covering different permission models and trust relationships:

    • iam_role_circleci_oidc: Configures a role for CircleCI using OIDC.
    • iam_role_disabled: Configures a role with certain features disabled.
    • iam_role_github_oidc: Configures a role for GitHub Actions using OIDC.
    • iam_role_inline_policy: Configures a role with an inline policy.
    • iam_role_instance_profile: Configures a role with an IAM instance profile.
    • iam_role_saml: Configures a role for SAML 2.0 federation.
    • iam_roles: A multi-role configuration.

  12. Configure multiple resources using the wrapper pattern

    master

    The wrapper pattern uses two primary input blocks to manage multiple resources efficiently:

    1. defaults: A map containing arguments that will be applied to every item in the items list (e.g., tags, create, or specific policy flags).
    2. items: A map where each key represents a unique identifier for a resource, and the value is a map of arguments specific to that resource. Any argument supported by the underlying modules/iam-read-only-policy can be used here.
    inputs = {
  defaults = {
    force_destroy = true
    attach_elb_log_delivery_policy        = true
    attach_lb_log_delivery_policy         = true
    attach_deny_insecure_transport_policy = true
    attach_require_latest_tls_policy      = true
  }

  items = {
    bucket1 = {
      bucket = "my-random-bucket-1"
    }
    bucket2 = {
      bucket = "my-random-bucket-2"
      tags = {
        Secure = "probably"
      }
    }
  }
}