cool-assessment-provisioner-iam

This is a Terraform deployment for creating IAM resources for those users allowed to provision assessment environments in the COOL.

Pre-requisites

• Terraform installed on your system.
• An accessible AWS S3 bucket to store Terraform state (specified in backend.tf).
• An accessible AWS DynamoDB database to store the Terraform state lock (specified in backend.tf).
• Access to all of the Terraform remote states specified in remote_states.tf.
• User accounts for all users must have been created previously. We recommend using the cisagov/cool-users-non-admin repository to create users.

Usage

1. Create a Terraform workspace (if you haven't already done so) by running terraform workspace new <workspace_name>
2. Create a <workspace_name>.tfvars file with all of the required variables (see Inputs below for details):

users = [
  "firstname1.lastname1",
  "firstname2.lastname2"
]

1. Run the command terraform init.
2. Run the command terraform apply -var-file=<workspace_name>.tfvars.

Requirements

Name	Version
terraform	~> 1.0
aws	~> 3.38

Providers

Name	Version
aws	~> 3.38
aws.organizationsreadonly	~> 3.38
aws.users	~> 3.38
terraform	n/a

Modules

No modules.

Resources

Name	Type
aws_iam_group.assessment_provisioners	resource
aws_iam_group_policy_attachment.assessment_provisioners	resource
aws_iam_policy.provision_assessment	resource
aws_iam_user_group_membership.assessment_provisioners	resource
aws_caller_identity.default	data source
aws_caller_identity.users	data source
aws_iam_policy_document.provision_assessment	data source
aws_organizations_organization.cool	data source
terraform_remote_state.dns_certboto	data source
terraform_remote_state.images_parameterstore-production	data source
terraform_remote_state.images_parameterstore-staging	data source
terraform_remote_state.master	data source
terraform_remote_state.sharedservices-production	data source
terraform_remote_state.sharedservices-staging	data source
terraform_remote_state.terraform	data source
terraform_remote_state.users	data source

Inputs

Name	Description	Type	Default	Required
assessment_provisioners_group_name	The name of the IAM group whose members are allowed to provision assessment environments.	string	"assessment_provisioners"	no
aws_region	The AWS region to deploy into (e.g. us-east-1).	string	"us-east-1"	no
provision_assessment_policy_description	The description to associate with the IAM policy in the Users account that allows the assessment provisioner group to assume all roles needed in order to provision assessment environments.	string	"Allows the assessment provisioner group to assume all roles needed in order to provision assessment environments."	no
provision_assessment_policy_name	The name of the IAM policy in the Users account that allows the assessment provisioner group to assume all roles needed in order to provision assessment environments.	string	"AssumeProvisionAssessment"	no
provision_assessment_role_name	The name of the IAM role in assessment accounts that includes all permissions necessary to provision the assessment environment in that account. If this role does not exist in an account, an assessment environment cannot be provisioned in that account.	string	"ProvisionAccount"	no
startstopssmsession_role_name	The name of the IAM role in assessment accounts that includes all permissions necessary to start and stop an SSM session in that account.	string	"StartStopSSMSession"	no
tags	Tags to apply to all AWS resources created.	map(string)	{}	no
users	A list containing the usernames of users that exist in the Users account who are allowed to provision assessment environments. Example: [ "firstname1.lastname1", "firstname2.lastname2" ].	list(string)	n/a	yes

Outputs

Name	Description
assessment_provisioners_group	The IAM group whose members are allowed to provision assessment environments.
assessment_provisioners_policy	The IAM policy in the Users account that allows the assessment provisioners group to assume the provisioning role in assessment accounts.

Notes

Running pre-commit requires running terraform init in every directory that contains Terraform code. In this repository, this is just the main directory.

Contributing

We welcome contributions! Please see CONTRIBUTING.md for details.

License

This project is in the worldwide public domain.

This project is in the public domain within the United States, and copyright and related rights in the work worldwide are waived through the CC0 1.0 Universal public domain dedication.

All contributions to this project will be released under the CC0 dedication. By submitting a pull request, you are agreeing to comply with this waiver of copyright interest.