LZA-133: add permission set module

modules/aws/permission_sets/README.md

@@ -0,0 +1,52 @@
+# Core Cloud AWS Identity Center Permission Set Module
+
+This module is responsible for creating and managing permission sets through Identity Center in AWS.
+
+## Usage
+
+### Permission Set
+
+```hcl
+module "permission_sets" {
+  source = "git::ssh://[email protected]/UKHomeOffice/core-cloud-terraform-modules.git//modules/aws/permission_sets"
+
+  name                = <VALUE>
+  description         = <VALUE>
+  identity_store_arn  = <VALUE>
+  inline_policies     = ARRAY(<INLINE_POLICY>)
+}
+```
+
+## Validation
+
+This module expects the variables to conform to the following:
+- `name` - Must be a string between 1 and 64 characters.
+- `description` - Must be a string between 1 and 256 characters.
+- `identity_store_arn` - Must be a valid Identity Store ARN.
+- `inline_policies` - Must be a list of objects that conforms to [Inline Policy](#inline-policy) schema.
+
+### Inline Policy
+
+```hcl
+{
+  sid       = OPTIONAL(<VALUE>)
+  actions   = ARRAY(<VALUE>)
+  resources = ARRAY(<VALUE>)
+}
+```
+
+## Examples
+
+### Simple Inline Policy
+
+```yaml
+name: "PermissionSetName"
+description: "This is an example permission set."
+identity_store_arn: "arn:aws:sso:::instance/ssoins-1234567890abcdef0"
+inline_policies:
+  - sid: "TestPolicy"
+    actions:
+      - s3:ListBucket
+    resources: 
+      - "*"
+```

modules/aws/permission_sets/main.tf

@@ -0,0 +1,32 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.39.0"
+    }
+  }
+}
+
+resource "aws_ssoadmin_permission_set" "identity_store_permission_set" {
+  name = var.name
+  description = var.description
+  instance_arn = var.identity_store_arn
+}
+
+data "aws_iam_policy_document" "iam_policy_document" {
+  dynamic "statement" {
+    for_each = var.inline_policies
+
+    content {
+      sid       = try(statement.value.sid, null)
+      actions   = statement.value.actions
+      resources = statement.value.resources
+    }
+  }
+}
+
+resource "aws_ssoadmin_permission_set_inline_policy" "permission_set_inline_policy" {
+  inline_policy      = data.aws_iam_policy_document.iam_policy_document.json
+  instance_arn       = var.identity_store_arn
+  permission_set_arn = aws_ssoadmin_permission_set.identity_store_permission_set.arn
+}

modules/aws/permission_sets/variables.tf

@@ -0,0 +1,33 @@
+variable "name" {
+  type        = string
+  description = "The name of the permission set to create."
+
+  validation {
+    condition     = length(var.name) >= 1 && length(var.name) <= 64
+    error_message = "The group name must be less than 64 characters."
+  }
+}
+
+variable "description" {
+  type        = string
+  description = "The description of the permission set to create."
+
+  validation {
+    condition     = length(var.description) >= 1 && length(var.description) <= 256
+    error_message = "The description must be less than 256 characters."
+  }
+}
+
+variable "identity_store_arn" {
+  description = "The ARN of the Identity Center instance to create the permission set in."
+  type        = string
+}
+
+variable "inline_policies" {
+  description = "The inline policy to attach to the permission set."
+  type        = list(object({
+    sid       = optional(string)
+    actions        = list(string)
+    resources = list(string)
+  }))
+}