AWS IAM Identity Center Terraform Module

Features

• Dynamic User Creation
• Dynamic Group Creation
• Dynamic Group Membership Creation
• Dynamic Permission Set Creation
• Dynamic Account Assignment Creation
• Dynamic Reference of Existing Users
• Dynamic Reference of Existing Groups
• AWS Managed Policy Support
• Customer Managed Policy Support

Important

• Locals are used to allow for global changes to multiple account assignments. If hard coding the account ids for your account assignments, you would need to change them in every place you want to reference the value. To simplify this, we recommend storing your desired account ids in local values. See the examples directory for more information and sample code.
• When using Customer Managed Policies with account assignments, you must ensure these policies exist in all target accounts before using the module. Failure to do this will cause deployment errors because IAM Identity Center will attempt to reference policies that do not exist.

Basic Usage - Create Users and Groups with AWS Managed Policies

// This is a template file for a basic deployment.
// Modify the parameters below with actual values

module "aws-iam-identity-center" {
  source = "aws-ia/iam-identity-center/aws"

  // Create desired GROUPS in IAM Identity Center
  sso_groups = {
    Admin : {
      group_name        = "Admin"
      group_description = "Admin IAM Identity Center Group"
    },
    Dev : {
      group_name        = "Dev"
      group_description = "Dev IAM Identity Center Group"
    },
    QA : {
      group_name        = "QA"
      group_description = "QA IAM Identity Center Group"
    },
    Audit : {
      group_name        = "Audit"
      group_description = "Audit IAM Identity Center Group"
    },
  }

  // Create desired USERS in IAM Identity Center
  sso_users = {
    NarutoUzumaki : {
      group_membership = ["Admin", "Dev", "QA", "Audit"]
      user_name        = "nuzumaki"
      given_name       = "Naruto"
      family_name      = "Uzumaki"
      email            = "nuzumaki@hiddenleaf.village"
    },
    SasukeUchiha : {
      group_membership = ["QA", "Audit"]
      user_name        = "suchiha"
      given_name       = "Sasuke"
      family_name      = "Uchiha"
      email            = "suchiha@hiddenleaf.village"
    },
  }

  // Create permissions sets backed by AWS managed policies
  permission_sets = {
    AdministratorAccess = {
      description          = "Provides AWS full access permissions.",
      session_duration     = "PT4H", // how long until session expires - this means 4 hours. max is 12 hours
      aws_managed_policies = ["arn:aws:iam::aws:policy/AdministratorAccess"]
      tags                 = { ManagedBy = "Terraform" }
    },
    ViewOnlyAccess = {
      description          = "Provides AWS view only permissions.",
      session_duration     = "PT3H", // how long until session expires - this means 3 hours. max is 12 hours
      aws_managed_policies = ["arn:aws:iam::aws:policy/job-function/ViewOnlyAccess"]
      tags                 = { ManagedBy = "Terraform" }
    },
  }

  // Assign users/groups access to accounts with the specified permissions
  account_assignments = {
    Admin : {
      principal_name  = "Admin"                                   // name of the user or group you wish to have access to the account(s)
      principal_type  = "GROUP"                                   // entity type (user or group) you wish to have access to the account(s)
      permission_sets = ["AdministratorAccess", "ViewOnlyAccess"] // permissions the user/group will have in the account(s)
      account_ids = [                                             // account(s) the group will have access to. Permissions they will have in account are above line
      "111111111111", // replace with your desired account id
      "222222222222", // replace with your desired account id
      ]
    },
    Audit : {
      principal_name  = "Audit"
      principal_type  = "GROUP"
      permission_sets = ["ViewOnlyAccess"]
      account_ids = [
      "111111111111",
      "222222222222",
      ]
    },
  }

}

Contributing

See the CONTRIBUTING.md file for information on how to contribute.

Requirements

Name	Version
terraform	>= 0.14.0
aws	>= 4.35.0
awscc	>= 0.55.0

Providers

Name	Version
aws	>= 4.35.0

Modules

No modules.

Resources

Name	Type
aws_identitystore_group.sso_groups	resource
aws_identitystore_group_membership.sso_group_membership	resource
aws_identitystore_user.sso_users	resource
aws_ssoadmin_account_assignment.account_assignment	resource
aws_ssoadmin_customer_managed_policy_attachment.pset_customer_managed_policy	resource
aws_ssoadmin_managed_policy_attachment.pset_aws_managed_policy	resource
aws_ssoadmin_permission_set.pset	resource
aws_identitystore_group.existing_sso_groups	data source
aws_identitystore_group.identity_store_group	data source
aws_identitystore_user.existing_sso_users	data source
aws_identitystore_user.identity_store_user	data source
aws_ssoadmin_instances.sso_instance	data source
aws_ssoadmin_permission_set.existing_permission_sets	data source

Inputs

Name	Description	Type	Default	Required
account_assignments	List of maps containing mapping between user/group, permission set and assigned accounts list. See account_assignments description in README for more information about map values.	map(any)	{}	no
permission_sets	Map of maps containing Permission Set names as keys. See permission_sets description in README for information about map values.	any	{ "AdministratorAccess": { "description": "Provides full access to AWS services and resources.", "managed_policies": [ "arn:aws:iam::aws:policy/AdministratorAccess" ], "session_duration": "PT2H" } }	no
sso_groups	Names of the groups you wish to create in IAM Identity Center	map(any)	{}	no
sso_users	Names of the users you wish to create in IAM Identity Center	map(any)	{}	no

Outputs

Name	Description
account_assignment_data	Tuple containing account assignment data
principals_and_assignments	Map containing account assignment data
sso_groups_ids	A map of SSO groups ids created by this module