cool-users-non-admin

This project is used to manage IAM user accounts for non-admin users. All admin users are set up in the cool-accounts repository (in the users subdirectory).

Pre-requisites

Your "users" provider must have AWS permissions to provision users and attach policies to them. We recommend creating your Users account via the cool-accounts repository.

Usage

1. Create a Terraform workspace (if you haven't already done so) by running terraform workspace new <workspace_name>

2. Create a <workspace_name>.tfvars file with all of the required variables (see Inputs below for details):

   users = {
     "firstname1.lastname1" = { "require_mfa" = false, "self_managed" = true },
     "firstname2.lastname2" = { "require_mfa" = true, "self_managed" = true },
     "firstname3.lastname3" = { "require_mfa" = false, "self_managed" = true },
     "service-account1"     = { "require_mfa" = false, "self_managed" = false },
   }

3. Run the command terraform init.

4. Run the command terraform apply -var-file=<workspace_name>.tfvars.

Requirements

Name	Version
terraform	~> 1.0
aws	~> 4.9

Providers

Name	Version
aws	~> 4.9
aws.users	~> 4.9
terraform	n/a

Modules

No modules.

Resources

Name	Type
aws_iam_user.users	resource
aws_iam_user_policy_attachment.self_managed_creds_with_mfa	resource
aws_iam_user_policy_attachment.self_managed_creds_without_mfa	resource
aws_caller_identity.current	data source
terraform_remote_state.users	data source

Inputs

Name	Description	Type	Default	Required
aws_region	The AWS region where the non-global resources are to be provisioned (e.g. "us-east-1").	string	"us-east-1"	no
tags	Tags to apply to all AWS resources created.	map(string)	{}	no
users	A map whose keys are the usernames of each non-admin user and whose values are a map containing supported user attributes. The currently-supported attributes are "require_mfa" (boolean) and "self_managed" (boolean). Example: { "firstname1.lastname1" = { "require_mfa" = false, "self_managed" = true }, "firstname2.lastname2" = { "require_mfa" = true, "self_managed" = true }, "firstname3.lastname3" = { "require_mfa" = false, "self_managed" = true }, "service-account1" = { "require_mfa" = false, "self_managed" = false } }	map(object({ require_mfa = bool, self_managed = bool }))	n/a	yes

Outputs

No outputs.

Notes

Running pre-commit requires running terraform init in every directory that contains Terraform code. In this repository, this is only the main directory.

Contributing

We welcome contributions! Please see CONTRIBUTING.md for details.

License

This project is in the worldwide public domain.

This project is in the public domain within the United States, and copyright and related rights in the work worldwide are waived through the CC0 1.0 Universal public domain dedication.

All contributions to this project will be released under the CC0 dedication. By submitting a pull request, you are agreeing to comply with this waiver of copyright interest.