Inicio Explorar Axuda
Rexistro Iniciar sesión
AFS
/
xdr-terraform-modules
2
0
Fork 0
Ficheiros Incidencias 0 Pull Requests 0 Wiki
Árbore: 3eb55e1cb1
Ramas Etiquetas
xdr-terraform-m...
/
submodules
/
iam
/
child_account_roles
Fred Damstra 826dc0b5be Updates Terraform Version Requirements to 0.13 %!s(int64=5) %!d(string=hai) anos
..
README.md ffc81e90b9 Decouples IAM terraform from the `live` repository %!s(int64=5) %!d(string=hai) anos
account_alias.tf ffc81e90b9 Decouples IAM terraform from the `live` repository %!s(int64=5) %!d(string=hai) anos
assume_role_policy-non_saml.tf ffc81e90b9 Decouples IAM terraform from the `live` repository %!s(int64=5) %!d(string=hai) anos
datasources.tf ffc81e90b9 Decouples IAM terraform from the `live` repository %!s(int64=5) %!d(string=hai) anos
locals.tf ffc81e90b9 Decouples IAM terraform from the `live` repository %!s(int64=5) %!d(string=hai) anos
module-policies.tf ffc81e90b9 Decouples IAM terraform from the `live` repository %!s(int64=5) %!d(string=hai) anos
role-mdr_engineer_readonly.tf 44d01b5fff [MSOCI-1388] increase some roles to 8hrs to avoid packer issues %!s(int64=5) %!d(string=hai) anos
role-mdr_terraformer.tf 65bf317038 Adds 'AWSSupportAccess' Policy to mdr_terraformer %!s(int64=5) %!d(string=hai) anos
variables.tf ffc81e90b9 Decouples IAM terraform from the `live` repository %!s(int64=5) %!d(string=hai) anos
versions.tf 826dc0b5be Updates Terraform Version Requirements to 0.13 %!s(int64=5) %!d(string=hai) anos

README.md

child_account_roles module

Creates "standard" IAM policies and roles in an account being treated like an AWS organizations child account.

Picture our collection of AWS accounts with the "common-services" account being the root of an Organizations hierarchy, where all of the users exist there and AssumeRole to the correct role in the child account.

common-services
    prod-c2
    test-c2
    prod-customer-1
    prod-customer-2
    ...

This module makes roles that are NOT SAML linked. It is expected you will AssumeRole into these roles cross-account.

Providers

Name Version
aws ~2.0?

Inputs

Name Description Type Required
okta_app The (friendly) name of the Okta app. In our environment either "AWS - Commercial" or "AWS - GovCloud" string Yes
account_alias The account alias that should be set for the AWS account. This is an AWS global value string yes

Roles created

Role Name Attached Policies Description
/user/mdr_engineer_readonly ReadOnlyAccess
mdr_engineer_readonly_assumerole		 Read only access to AWS console with ability to escalate to Terraformer role
/user/mdr_terraformer mdr_terraformer Full read/write access to (almost) everything. Has some limitations around PassRole and AssumeRole

Modules referenced

Module name purpose
standard_iam_policies defines the policies used by the roles