-
-
Notifications
You must be signed in to change notification settings - Fork 10
/
Copy pathmain.tf
82 lines (65 loc) · 2.04 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
locals {
metadata = {
package = "terraform-aws-account"
version = trimspace(file("${path.module}/../../VERSION"))
module = basename(path.module)
name = var.name
}
module_tags = var.module_tags_enabled ? {
"module.terraform.io/package" = local.metadata.package
"module.terraform.io/version" = local.metadata.version
"module.terraform.io/name" = local.metadata.module
"module.terraform.io/full-name" = "${local.metadata.package}/${local.metadata.module}"
"module.terraform.io/instance" = local.metadata.name
} : {}
}
resource "aws_iam_user" "this" {
name = var.name
path = var.path
force_destroy = var.force_destroy
permissions_boundary = var.permissions_boundary
tags = merge(
{
"Name" = local.metadata.name
},
local.module_tags,
var.tags,
)
}
resource "aws_iam_user_group_membership" "this" {
user = aws_iam_user.this.name
groups = var.groups
}
###################################################
# IAM Policy for AssumeRole
###################################################
data "aws_iam_policy_document" "assume_role" {
statement {
effect = "Allow"
actions = ["sts:AssumeRole"]
resources = var.assumable_roles
}
}
resource "aws_iam_user_policy" "assume_role" {
count = length(var.assumable_roles) > 0 ? 1 : 0
user = aws_iam_user.this.name
name = "assume-role"
policy = data.aws_iam_policy_document.assume_role.json
}
###################################################
# IAM Policy Attachment for Managed Policies
###################################################
resource "aws_iam_user_policy_attachment" "managed" {
for_each = toset(var.policies)
user = aws_iam_user.this.name
policy_arn = each.key
}
###################################################
# IAM Policy Attachment for Inline Policies
###################################################
resource "aws_iam_user_policy" "inline" {
for_each = var.inline_policies
user = aws_iam_user.this.name
name = each.key
policy = each.value
}