ace-teknologi / terraform-iam Goto Github PK

View Code? Open in Web Editor NEW

0.0 0.0 1.0 32 KB

A generic module to create best practice AWS IAM resources

Shell 2.07% HCL 97.93%

iam security terraform

terraform-iam's People

Contributors

Watchers

Forkers

enosi

terraform-iam's Issues

Cannot add MFA with current self management group permissions

User: arn:aws:iam::***:user/*** is not authorized to perform: iam:DeleteVirtualMFADevice on resource:
arn:aws:iam::***:mfa/***

tf_module_repo pointing at the wrong github url

Cannot import user

➜  infra-**** git:(feature/2/import-users) ✗ aws-vault exec **** -- terraform import module.iam-user-legacy-joel.aws_iam_user.main joel
module.iam-user-legacy-joel.aws_iam_user.main: Importing from ID "joel"...
module.iam-user-legacy-joel.aws_iam_user.main: Import prepared!
  Prepared aws_iam_user for import
module.iam-user-legacy-joel.aws_iam_user.main: Refreshing state... [id=joel]

Error: Invalid index

  on .terraform/modules/iam-groups/groups/tagging.tf line 4, in locals:
   4:   tf_root_path   = coalesce(var.tags["tf_path"], "unknown")
    |----------------
    | var.tags is empty map of string

The given key does not identify an element in this collection value.


Error: Invalid index

  on .terraform/modules/iam-roles/roles/tagging.tf line 4, in locals:
   4:   tf_root_path   = coalesce(var.tags["tf_path"], "unknown")
    |----------------
    | var.tags is empty map of string

The given key does not identify an element in this collection value.

🔪🐰 remove rabbit reference

https://github.com/ace-teknologi/terraform-iam/blob/master/user/variables.tf#L10-L17

IAM User cannot change password without MFA already set

Allow viewing of AWS IAM Account information

iam:GetAccountSummary (ref: https://iam.cloudonaut.io/reference/iam/GetAccountSummary.html) usage and quotas ?
iam:ListAccountAliases (ref: https://iam.cloudonaut.io/reference/iam/ListAccountAliases.html) to give access to the shortcut url

Add `tags` to resources

readonly role cannot be assumed

The readonly role cannot be assumed.

➜  terraform-repo git:(master) ✗ aws-vault exec bob-readonly -- aws s3 ls
Enter token for arn:aws:iam::***:mfa/username: ******
aws-vault: error: Failed to get credentials for bob (source profile for bob-readonly): AccessDenied: Access denied
    status code: 403, request id: 06a71f25-b716-11e9-84a2-83fe1cca3dc5

Cross account assume roles won't work

terraform-iam/roles/main.tf

Lines 4 to 7 in 44cd2f0

 authorised_account_ids = (length(var.authorised_account_ids) == 0 ? 

 var.authorised_account_ids : 

 [data.aws_caller_identity.current.account_id]) 

 authorised_account_root_arns = formatlist("arn:aws:iam::%s:root", local.authorised_account_ids)

Should be:

  authorised_account_ids = (length(var.authorised_account_ids) == 0 ?
    [data.aws_caller_identity.current.account_id] :
    var.authorised_account_ids)
  authorised_account_root_arns = formatlist("arn:aws:iam::%s:root", local.authorised_account_ids)

ace-teknologi / terraform-iam Goto Github PK

terraform-iam's People

Contributors

Watchers

Forkers

terraform-iam's Issues

Cannot add MFA with current self management group permissions

tf_module_repo pointing at the wrong github url

Cannot import user

🔪🐰 remove rabbit reference

IAM User cannot change password without MFA already set

Allow viewing of AWS IAM Account information

Add `tags` to resources

readonly role cannot be assumed

Cross account assume roles won't work

🔑 Allow a user to manage their own ssh key(s)

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent

Jobs

	authorised_account_ids = (length(var.authorised_account_ids) == 0 ?
	var.authorised_account_ids :
	[data.aws_caller_identity.current.account_id])
	authorised_account_root_arns = formatlist("arn:aws:iam::%s:root", local.authorised_account_ids)