feat: add Forms Staging/Prod billing read only groups (#308)

Add two new groups that allow members to have read-only billing access to the Forms accounts.
cds-snc · Sep 16, 2024 · f17d5f1 · f17d5f1
1 parent c4fe853
commit f17d5f1
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 0 deletions.
diff --git a/terragrunt/org_account/iam_identity_center/platform_forms_assignments.tf b/terragrunt/org_account/iam_identity_center/platform_forms_assignments.tf
@@ -12,6 +12,10 @@ locals {
       group          = aws_identitystore_group.forms_production_athena_query_access,
       permission_set = aws_ssoadmin_permission_set.athena_query_access,
     },
+    {
+      group          = aws_identitystore_group.forms_production_billing_read_only,
+      permission_set = aws_ssoadmin_permission_set.read_only_billing,
+    },
     {
       group          = aws_identitystore_group.forms_production_rds_query_access,
       permission_set = aws_ssoadmin_permission_set.rds_query_access,
@@ -35,6 +39,10 @@ locals {
       group          = aws_identitystore_group.forms_staging_athena_query_access,
       permission_set = aws_ssoadmin_permission_set.athena_query_access,
     },
+    {
+      group          = aws_identitystore_group.forms_staging_billing_read_only,
+      permission_set = aws_ssoadmin_permission_set.read_only_billing,
+    },
     {
       group          = aws_identitystore_group.forms_staging_rds_query_access,
       permission_set = aws_ssoadmin_permission_set.rds_query_access,

diff --git a/terragrunt/org_account/iam_identity_center/platform_forms_groups.tf b/terragrunt/org_account/iam_identity_center/platform_forms_groups.tf
@@ -13,6 +13,12 @@ resource "aws_identitystore_group" "forms_production_athena_query_access" {
   identity_store_id = local.sso_identity_store_id
 }
 
+resource "aws_identitystore_group" "forms_production_billing_read_only" {
+  display_name      = "Forms-Production-Billing-ReadOnly"
+  description       = "Grants members read-only Billing and Cost Explorer access to the Forms Production account."
+  identity_store_id = local.sso_identity_store_id
+}
+
 resource "aws_identitystore_group" "forms_production_rds_query_access" {
   display_name      = "Forms-Production-RDS-Query-Access"
   description       = "Grants members access to the RDS query editor in the GC Forms Production account."
@@ -40,6 +46,12 @@ resource "aws_identitystore_group" "forms_staging_athena_query_access" {
   identity_store_id = local.sso_identity_store_id
 }
 
+resource "aws_identitystore_group" "forms_staging_billing_read_only" {
+  display_name      = "Forms-Staging-Billing-ReadOnly"
+  description       = "Grants members read-only Billing and Cost Explorer access to the Forms Staging account."
+  identity_store_id = local.sso_identity_store_id
+}
+
 resource "aws_identitystore_group" "forms_staging_rds_query_access" {
   display_name      = "Forms-Staging-RDS-Query-Access"
   description       = "Grants members access to the RDS query editor in the GC Forms Staging account."