This is a Terraform deployment for creating IAM resources for those users allowed to provision any environment in the COOL.
- Terraform installed on your system.
- An accessible AWS S3 bucket to store Terraform state (specified in backend.tf).
- An accessible AWS DynamoDB database to store the Terraform state lock (specified in backend.tf).
- Access to all of the Terraform remote states specified in remote_states.tf.
- User accounts for all users must have been created previously. We
recommend using the
cisagov/cool-users-non-adminrepository to create users.
- Create a Terraform workspace (if you haven't already done so) by running
terraform workspace new <workspace_name> - Create a
<workspace_name>.tfvarsfile with all of the required variables (see Inputs below for details):
users = [
"firstname1.lastname1",
"firstname2.lastname2"
]- Run the command
terraform init. - Run the command
terraform apply -var-file=<workspace_name>.tfvars.
| Name | Version |
|---|---|
| terraform | ~> 1.1 |
| aws | ~> 4.9 |
| Name | Version |
|---|---|
| aws | ~> 4.9 |
| aws.users | ~> 4.9 |
| terraform | n/a |
No modules.
| Name | Type |
|---|---|
| aws_iam_group.admin_provisioners | resource |
| aws_iam_group_policy_attachment.admin_provisioners | resource |
| aws_iam_policy.provision | resource |
| aws_iam_user_group_membership.admin_provisioners | resource |
| aws_caller_identity.default | data source |
| aws_iam_policy_document.provision | data source |
| terraform_remote_state.dns_certboto | data source |
| terraform_remote_state.images_parameterstore-production | data source |
| terraform_remote_state.images_parameterstore-staging | data source |
| terraform_remote_state.master | data source |
| terraform_remote_state.terraform | data source |
| terraform_remote_state.users | data source |
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| admin_provisioners_group_name | The name of the IAM group whose members are allowed to provision any environment. | string |
"admin_provisioners" |
no |
| aws_region | The AWS region to deploy into (e.g. us-east-1). | string |
"us-east-1" |
no |
| provision_policy_description | The description to associate with the IAM policy in the Users account that allows the admin provisioner group to assume all roles needed in order to provision any environment. | string |
"Allows the admin provisioner group to assume all roles needed in order to provision any environment." |
no |
| provision_policy_name | The name of the IAM policy in the Users account that allows the admin provisioner group to assume all roles needed in order to provision any environment. | string |
"AssumeProvisionAnyEnvironment" |
no |
| provision_role_name | The name of the IAM role in an account that includes all permissions necessary to provision the environment in that account. If this role does not exist in an account, an environment cannot be provisioned in that account. | string |
"ProvisionAccount" |
no |
| startstopssmsession_role_name | The name of the IAM role in an account that includes all permissions necessary to start and stop an SSM session in that account. | string |
"StartStopSSMSession" |
no |
| tags | Tags to apply to all AWS resources created. | map(string) |
{} |
no |
| users | A list containing the usernames of users that exist in the Users account who are allowed to provision any environment. Example: [ "firstname1.lastname1", "firstname2.lastname2" ]. | list(string) |
n/a | yes |
| Name | Description |
|---|---|
| admin_provisioners_group | The IAM group whose members are allowed to provision any environment. |
| admin_provisioners_policy | The IAM policy in the Users account that allows the admin provisioners group to assume the provisioning role in any account. |
Running pre-commit requires running terraform init in every directory that
contains Terraform code. In this repository, this is just the main directory.
We welcome contributions! Please see CONTRIBUTING.md for
details.
This project is in the worldwide public domain.
This project is in the public domain within the United States, and copyright and related rights in the work worldwide are waived through the CC0 1.0 Universal public domain dedication.
All contributions to this project will be released under the CC0 dedication. By submitting a pull request, you are agreeing to comply with this waiver of copyright interest.