Skip to content

Commit b69b58d

Browse files
colincolemancolincoleman
authored
Optionalrolenames (telia-oss#4)
* make role names optionally configurable * move selfmanagement policy to submodule as it can't be called more than once * add testing pipeline
1 parent 7515d70 commit b69b58d

File tree

21 files changed

+273
-51
lines changed

21 files changed

+273
-51
lines changed

‎.ci/pipeline.yml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
jobs:
2+
- name: test-default
3+
plan:
4+
- aggregate:
5+
- get: this-module
6+
trigger: true
7+
- task: apply
8+
params:
9+
directory: default
10+
AWS_ACCOUNT_ID: ((telia-divx-common-services-stage-account-id))
11+
AWS_ACCESS_KEY_ID: ((telia-divx-common-services-stage-access-key))
12+
AWS_SECRET_ACCESS_KEY: ((telia-divx-common-services-stage-secret-key))
13+
AWS_SESSION_TOKEN: ((telia-divx-common-services-stage-session-token))
14+
KMS_KEY_ID: ((telia-divx-common-services-stage-state-bucket-key))
15+
file: this-module/.ci/tasks/apply/task.yml
16+
input_mapping: {source: this-module}
17+
- task: test
18+
params:
19+
directory: default
20+
AWS_ACCESS_KEY_ID: ((telia-divx-common-services-stage-access-key))
21+
AWS_SECRET_ACCESS_KEY: ((telia-divx-common-services-stage-secret-key))
22+
AWS_SESSION_TOKEN: ((telia-divx-common-services-stage-session-token))
23+
file: this-module/.ci/tasks/test/task.yml
24+
- task: destroy
25+
params:
26+
directory: default
27+
AWS_ACCESS_KEY_ID: ((telia-divx-common-services-stage-access-key))
28+
AWS_SECRET_ACCESS_KEY: ((telia-divx-common-services-stage-secret-key))
29+
AWS_SESSION_TOKEN: ((telia-divx-common-services-stage-session-token))
30+
file: this-module/.ci/tasks/destroy/task.yml
31+
32+
resources:
33+
- name: this-module
34+
type: git
35+
source:
36+
uri: [email protected]:telia-oss/terraform-aws-iam.git
37+
branch: master
38+
private_key: ((aws-common-services-deploy-key))
39+

‎.ci/tasks/apply/task.sh

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/bin/sh
2+
export DIR="${PWD}"
3+
cp -a ${DIR}/source/. ${DIR}/secret-source/
4+
cd ${DIR}/secret-source/examples/${directory}
5+
sed -i 's#<test-account-id>#'${AWS_ACCOUNT_ID}'#g' main.tf
6+
sed -i 's#<kms-key-id>#'${KMS_KEY_ID}'#g' main.tf
7+
terraform init
8+
terraform apply --auto-approve
9+
terraform output -json > ${DIR}/terraform-out/terraform-out.json

‎.ci/tasks/apply/task.yml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
platform: linux
2+
3+
image_resource:
4+
type: docker-image
5+
source:
6+
repository: hashicorp/terraform
7+
tag: "0.11.11"
8+
9+
params:
10+
AWS_ACCOUNT_ID:
11+
directory:
12+
AWS_ACCESS_KEY_ID:
13+
AWS_SECRET_ACCESS_KEY:
14+
AWS_SESSION_TOKEN:
15+
KMS_KEY_ID:
16+
17+
inputs:
18+
- name: source
19+
20+
outputs:
21+
- name: secret-source
22+
- name: terraform-out
23+
24+
run:
25+
path: source/.ci/tasks/apply/task.sh

‎.ci/tasks/destroy/task.sh

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/sh
2+
export DIR="${PWD}"
3+
cd ${DIR}/secret-source/examples/${directory}
4+
rm -rf .terraform
5+
terraform init
6+
terraform destroy --auto-approve

‎.ci/tasks/destroy/task.yml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
platform: linux
2+
3+
image_resource:
4+
type: docker-image
5+
source:
6+
repository: hashicorp/terraform
7+
tag: "0.11.11"
8+
9+
params:
10+
directory:
11+
AWS_ACCESS_KEY_ID:
12+
AWS_SECRET_ACCESS_KEY:
13+
AWS_SESSION_TOKEN:
14+
15+
inputs:
16+
- name: secret-source
17+
18+
run:
19+
path: secret-source/.ci/tasks/destroy/task.sh

‎.ci/tasks/test/task.sh

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
#!/bin/sh
2+
export DIR="${PWD}"
3+
${DIR}/secret-source/examples/${directory}/test.sh

‎.ci/tasks/test/task.yml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
platform: linux
2+
3+
image_resource:
4+
type: docker-image
5+
source:
6+
repository: teliaoss/concourse-awscli
7+
8+
params:
9+
directory:
10+
AWS_ACCESS_KEY_ID:
11+
AWS_SECRET_ACCESS_KEY:
12+
AWS_SESSION_TOKEN:
13+
14+
inputs:
15+
- name: secret-source
16+
- name: terraform-out
17+
18+
run:
19+
path: secret-source/.ci/tasks/test/task.sh

‎.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,5 @@
22
**/.terraform
33
**/*.tfstate*
44
crash.log
5+
# InteliJ IDE
6+
.idea/

‎.travis.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ dist: trusty
22
sudo: true
33

44
before_install:
5-
- curl -fSL "https://releases.hashicorp.com/terraform/0.11.7/terraform_0.11.7_linux_amd64.zip" -o terraform.zip
5+
- curl -fSL "https://releases.hashicorp.com/terraform/0.11.11/terraform_0.11.11_linux_amd64.zip" -o terraform.zip
66
- sudo unzip terraform.zip -d /opt/terraform
77
- sudo ln -s /opt/terraform/terraform /usr/bin/terraform
88
- rm -f terraform.zip

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ A collection of modules for handling IAM setup.
77

88
## Examples
99

10-
* [Simple Example](examples/default/example.tf)
10+
* [Simple Example](examples/default/main.tf)
1111

1212
## Authors
1313

‎examples/default/example.tf

Lines changed: 0 additions & 41 deletions
This file was deleted.

‎examples/default/lambda.js

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
exports.handler = function (event, context) {
2+
context.succeed('hello world');
3+
};

‎examples/default/lambda.zip

237 Bytes
Binary file not shown.

‎examples/default/main.tf

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
terraform {
2+
required_version = "0.11.11"
3+
4+
backend "s3" {
5+
key = "terraform-modules/development/terraform-module-template/default.tfstate"
6+
bucket = "<test-account-id>-terraform-state"
7+
dynamodb_table = "<test-account-id>-terraform-state"
8+
acl = "bucket-owner-full-control"
9+
encrypt = "true"
10+
kms_key_id = "<kms-key-id>"
11+
region = "eu-west-1"
12+
}
13+
}
14+
15+
provider "aws" {
16+
version = "1.60.0"
17+
region = "eu-west-1"
18+
allowed_account_ids = ["<test-account-id>"]
19+
}
20+
21+
data "aws_caller_identity" "current" {}
22+
23+
module "admin" {
24+
source = "../../modules/user"
25+
name = "first.last.admin"
26+
path = "/admins/"
27+
keybase = "itsdalmo"
28+
}
29+
30+
module "user_policy" {
31+
source = "../../modules/user-policies"
32+
}
33+
34+
module "developer" {
35+
source = "../../modules/user"
36+
37+
name = "first.last.developer"
38+
path = "/developer/"
39+
keybase = "itsdalmo"
40+
}
41+
42+
module "user_roles" {
43+
source = "../../modules/user-roles"
44+
trusted_account = "${data.aws_caller_identity.current.account_id}"
45+
view_only_role_suffix = "read-only"
46+
admin_role_suffix = "administrator"
47+
48+
admin_users = [
49+
"admins/first.last.admin",
50+
]
51+
52+
view_only_users = [
53+
"developer/first.last.developer",
54+
]
55+
}
56+
57+
module "machine_role" {
58+
source = "../../modules/machine-role"
59+
name = "machine-user-role"
60+
61+
trusted_principals = [
62+
"${aws_iam_role.example-lambda-role.arn}",
63+
]
64+
}
65+
66+
resource "aws_iam_role" "example-lambda-role" {
67+
name = "example-lambda-role"
68+
69+
assume_role_policy = <<EOF
70+
{
71+
"Version": "2012-10-17",
72+
"Statement": [
73+
{
74+
"Action": "sts:AssumeRole",
75+
"Principal": {
76+
"Service": "lambda.amazonaws.com"
77+
},
78+
"Effect": "Allow"
79+
}
80+
]
81+
}
82+
EOF
83+
}
84+
85+
resource "aws_iam_role_policy_attachment" "basic-exec" {
86+
policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
87+
role = "${aws_iam_role.example-lambda-role.name}"
88+
}
89+
90+
resource "aws_lambda_function" "example" {
91+
function_name = "example-lambda-function"
92+
handler = "lambda.handler"
93+
role = "${aws_iam_role.example-lambda-role.arn}"
94+
runtime = "nodejs8.10"
95+
filename = "lambda.zip"
96+
}

‎examples/default/test.sh

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#!/bin/sh
2+
set -euo pipefail
3+
4+
# for integer comparisons: check_counts <testValue> <expectedValue> <testName>
5+
check_counts() {
6+
if [ $1 -eq $2 ]
7+
then
8+
echo "√ $3"
9+
else
10+
echo "✗ $3"
11+
tests_failed=$((tests_failed+1))
12+
fi
13+
}
14+
15+
export AWS_DEFAULT_REGION=eu-west-1
16+
tests_failed=0
17+
# Add tests here e.g.
18+
19+
#VPC_ID=`cat terraform-out/terraform-out.json | jq -r '.vpc_id.value'`
20+
#subnet_count=`aws ec2 describe-subnets | jq --arg VPC_ID "$VPC_ID" '.Subnets[]| select (.VpcId==$VPC_ID)' | jq -s length`
21+
#check_counts $subnet_count 3 "Expected # of Subnets"
22+
23+
exit $tests_failed

‎modules/user-policies/main.tf

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
data "aws_caller_identity" "current" {}
2+
3+
locals {
4+
name_prefix = "${var.name_prefix == "" ? "" : "${var.name_prefix}-"}"
5+
}
6+
7+
resource "aws_iam_policy" "iam_self_management" {
8+
name = "${local.name_prefix}iam-self-management"
9+
description = "Allow users to manage their own IAM credentials"
10+
policy = "${data.aws_iam_policy_document.iam_self_management.json}"
11+
}

‎modules/user/policies.tf renamed to ‎modules/user-policies/policies.tf

File renamed without changes.

‎modules/user-policies/variables.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
variable "name_prefix" {
2+
description = "Optional prefix to add to policy name"
3+
default = ""
4+
}

‎modules/user-roles/main.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ locals {
99
}
1010

1111
resource "aws_iam_role" "admin" {
12-
name = "${local.name_prefix}admin"
12+
name = "${local.name_prefix}${var.admin_role_suffix}"
1313
description = "Admin role assumable from a trusted account"
1414
assume_role_policy = "${data.aws_iam_policy_document.admin_assume.json}"
1515
force_detach_policies = "true"
@@ -48,7 +48,7 @@ data "aws_iam_policy_document" "admin_assume" {
4848
}
4949

5050
resource "aws_iam_role" "view_only" {
51-
name = "${local.name_prefix}view-only"
51+
name = "${local.name_prefix}${var.view_only_role_suffix}"
5252
description = "View-only role assumable from a trusted account"
5353
assume_role_policy = "${data.aws_iam_policy_document.view_only_assume.json}"
5454
force_detach_policies = "true"

‎modules/user-roles/variables.tf

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,16 @@ variable "name_prefix" {
66
default = ""
77
}
88

9+
variable "admin_role_suffix" {
10+
description = "The suffix appended to the name_prefix for the name of the admin role"
11+
default = "admin"
12+
}
13+
14+
variable "view_only_role_suffix" {
15+
description = "The suffix appended to the name_prefix for the name of the view-only role"
16+
default = "view-only"
17+
}
18+
919
variable "trusted_account" {
1020
description = "ID of the account which is trusted with access to assume this role."
1121
}

‎modules/user/main.tf

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,3 @@ resource "aws_iam_user_login_profile" "main" {
1717
password_reset_required = "false"
1818
password_length = "20"
1919
}
20-
21-
resource "aws_iam_policy" "iam_self_management" {
22-
name = "iam-self-management"
23-
description = "Allow users to manage their own IAM credentials"
24-
policy = "${data.aws_iam_policy_document.iam_self_management.json}"
25-
}

0 commit comments

Comments
 (0)