Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[feature] Adds support for SAML trust relationship to existing roles #154

Merged
merged 5 commits into from
Nov 27, 2019
Merged

[feature] Adds support for SAML trust relationship to existing roles #154

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
be29e16
[feature] Adds support for SAML trust relationship to existing roles
Nov 27, 2019
c1c3877
try that?
Nov 27, 2019
001215f
would this work?
Nov 27, 2019
5ee1399
Do all roles
Nov 27, 2019
c605a34
READMEs
Nov 27, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion aws-iam-role-cloudfront-poweruser/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,8 @@ This module will create a role which is granted poweruser control over AWS Cloud
| iam\_path | | string | `"/"` | no |
| role\_name | Name of the role to create | string | n/a | yes |
| s3\_bucket\_prefixes | Limits role permissions to buckets with specific prefixes. Empty for all buckets. | list | `<list>` | no |
| source\_account\_id | AWS Account that can assume this role. | string | n/a | yes |
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. | string | '' | no |
| saml\_idp\_arn | The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided. | string | '' | no |

## Outputs

Expand Down
30 changes: 25 additions & 5 deletions aws-iam-role-cloudfront-poweruser/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,31 @@
data "aws_iam_policy_document" "assume-role" {
statement {
principals {
type = "AWS"
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
dynamic "statement" {
for_each = compact([var.source_account_id])
content {
principals {
type = "AWS"
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
}
actions = ["sts:AssumeRole"]
}
}

dynamic "statement" {
for_each = compact([var.saml_idp_arn])
content {
principals {
type = "Federated"
identifiers = ["${var.saml_idp_arn}"]
}

actions = ["sts:AssumeRole"]
actions = ["sts:AssumeRoleWithSAML"]

condition {
test = "StringEquals"
variable = "SAML:aud"
values = ["https://signin.aws.amazon.com/saml"]
}
}
}
}

Expand Down
17 changes: 12 additions & 5 deletions aws-iam-role-cloudfront-poweruser/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,3 @@
variable "source_account_id" {
type = "string"
description = "AWS Account that can assume this role."
}

variable "role_name" {
type = "string"
description = "Name of the role to create"
Expand All @@ -21,3 +16,15 @@ variable "iam_path" {
type = "string"
default = "/"
}

variable "source_account_id" {
type = "string"
default = ""
description = "The source AWS account to establish a trust relationship. Ignored if empty or not provided."
}

variable "saml_idp_arn" {
type = "string"
default = ""
description = "The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided."
}
3 changes: 2 additions & 1 deletion aws-iam-role-crossacct/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,8 @@ module "group" {
|------|-------------|:----:|:-----:|:-----:|
| iam\_path | The IAM path to put this role in. | string | `"/"` | no |
| role\_name | The name of the role. | string | n/a | yes |
| source\_account\_id | The AWS account id that should be able to assume this role. | string | n/a | yes |
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. | string | '' | no |
| saml\_idp\_arn | The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided. | string | '' | no |

## Outputs

Expand Down
30 changes: 25 additions & 5 deletions aws-iam-role-crossacct/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,31 @@
data "aws_iam_policy_document" "assume-role" {
statement {
principals {
type = "AWS"
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
dynamic "statement" {
for_each = compact([var.source_account_id])
content {
principals {
type = "AWS"
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
}
actions = ["sts:AssumeRole"]
}
}

dynamic "statement" {
for_each = compact([var.saml_idp_arn])
content {
principals {
type = "Federated"
identifiers = ["${var.saml_idp_arn}"]
}

actions = ["sts:AssumeRole"]
actions = ["sts:AssumeRoleWithSAML"]

condition {
test = "StringEquals"
variable = "SAML:aud"
values = ["https://signin.aws.amazon.com/saml"]
}
}
}
}

Expand Down
9 changes: 8 additions & 1 deletion aws-iam-role-crossacct/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,13 @@ variable "iam_path" {
}

variable "source_account_id" {
description = "The AWS account id that should be able to assume this role."
type = "string"
default = ""
description = "The source AWS account to establish a trust relationship. Ignored if empty or not provided."
}

variable "saml_idp_arn" {
type = "string"
default = ""
description = "The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided."
}
3 changes: 2 additions & 1 deletion aws-iam-role-ec2-poweruser/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,8 @@ module "ec2-poweruser" {
|------|-------------|:----:|:-----:|:-----:|
| iam\_path | | string | `"/"` | no |
| role\_name | | string | n/a | yes |
| source\_account\_id | | string | n/a | yes |
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. | string | '' | no |
| saml\_idp\_arn | The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided. | string | '' | no |

## Outputs

Expand Down
30 changes: 25 additions & 5 deletions aws-iam-role-ec2-poweruser/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,31 @@
data "aws_iam_policy_document" "assume-role" {
statement {
principals {
type = "AWS"
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
dynamic "statement" {
for_each = compact([var.source_account_id])
content {
principals {
type = "AWS"
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
}
actions = ["sts:AssumeRole"]
}
}

dynamic "statement" {
for_each = compact([var.saml_idp_arn])
content {
principals {
type = "Federated"
identifiers = ["${var.saml_idp_arn}"]
}

actions = ["sts:AssumeRole"]
actions = ["sts:AssumeRoleWithSAML"]

condition {
test = "StringEquals"
variable = "SAML:aud"
values = ["https://signin.aws.amazon.com/saml"]
}
}
}
}

Expand Down
16 changes: 12 additions & 4 deletions aws-iam-role-ec2-poweruser/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,3 @@
variable "source_account_id" {
type = "string"
}

variable "role_name" {
type = "string"
}
Expand All @@ -10,3 +6,15 @@ variable "iam_path" {
type = "string"
default = "/"
}

variable "source_account_id" {
type = "string"
default = ""
description = "The source AWS account to establish a trust relationship. Ignored if empty or not provided."
}

variable "saml_idp_arn" {
type = "string"
default = ""
description = "The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided."
}
3 changes: 2 additions & 1 deletion aws-iam-role-ecs-poweruser/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,8 @@ module "ec2-poweruser" {
|------|-------------|:----:|:-----:|:-----:|
| iam\_path | | string | `"/"` | no |
| role\_name | | string | n/a | yes |
| source\_account\_id | | string | n/a | yes |
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. | string | '' | no |
| saml\_idp\_arn | The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided. | string | '' | no |

## Outputs

Expand Down
30 changes: 25 additions & 5 deletions aws-iam-role-ecs-poweruser/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,31 @@
data "aws_iam_policy_document" "assume-role" {
statement {
principals {
type = "AWS"
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
dynamic "statement" {
for_each = compact([var.source_account_id])
content {
principals {
type = "AWS"
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
}
actions = ["sts:AssumeRole"]
}
}

dynamic "statement" {
for_each = compact([var.saml_idp_arn])
content {
principals {
type = "Federated"
identifiers = ["${var.saml_idp_arn}"]
}

actions = ["sts:AssumeRole"]
actions = ["sts:AssumeRoleWithSAML"]

condition {
test = "StringEquals"
variable = "SAML:aud"
values = ["https://signin.aws.amazon.com/saml"]
}
}
}
}

Expand Down
16 changes: 12 additions & 4 deletions aws-iam-role-ecs-poweruser/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,3 @@
variable "source_account_id" {
type = "string"
}

variable "role_name" {
type = "string"
}
Expand All @@ -10,3 +6,15 @@ variable "iam_path" {
type = "string"
default = "/"
}

variable "source_account_id" {
type = "string"
default = ""
description = "The source AWS account to establish a trust relationship. Ignored if empty or not provided."
}

variable "saml_idp_arn" {
type = "string"
default = ""
description = "The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided."
}
3 changes: 2 additions & 1 deletion aws-iam-role-infraci/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,9 @@ Creates a role useful for running `terraform plan` in CI jobs.
|------|-------------|:----:|:-----:|:-----:|
| iam\_path | | string | `"/"` | no |
| role\_name | | string | `"infraci"` | no |
| source\_account\_id | | string | n/a | yes |
| terraform\_state\_lock\_dynamodb\_arns | "A list of unique identifiers (ARNs) of state file DynamoDB tables" | string | `[]` | yes |
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. | string | '' | no |
| saml\_idp\_arn | The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided. | string | '' | no |

## Outputs

Expand Down
30 changes: 25 additions & 5 deletions aws-iam-role-infraci/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,31 @@
data "aws_iam_policy_document" "assume-role" {
statement {
principals {
type = "AWS"
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
dynamic "statement" {
for_each = compact([var.source_account_id])
content {
principals {
type = "AWS"
identifiers = ["arn:aws:iam::${var.source_account_id}:root"]
}
actions = ["sts:AssumeRole"]
}
}

actions = ["sts:AssumeRole"]
dynamic "statement" {
for_each = compact([var.saml_idp_arn])
content {
principals {
type = "Federated"
identifiers = ["${var.saml_idp_arn}"]
}

actions = ["sts:AssumeRoleWithSAML"]

condition {
test = "StringEquals"
variable = "SAML:aud"
values = ["https://signin.aws.amazon.com/saml"]
}
}
}
}

Expand Down
16 changes: 12 additions & 4 deletions aws-iam-role-infraci/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,3 @@
variable "source_account_id" {
type = "string"
}

variable "role_name" {
default = "infraci"
}
Expand All @@ -15,3 +11,15 @@ variable "terraform_state_lock_dynamodb_arns" {
default = []
description = "ARNs of the state file DynamoDB tables"
}

variable "source_account_id" {
type = "string"
default = ""
description = "The source AWS account to establish a trust relationship. Ignored if empty or not provided."
}

variable "saml_idp_arn" {
type = "string"
default = ""
description = "The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided."
}
5 changes: 3 additions & 2 deletions aws-iam-role-poweruser/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ module "group" {
# defaults to "poweruser"
role_name = "..."

# The id of the other AWS account that can assume this role.
# The id of the other AWS account that can assume this role.
source_account_id = "..."
}
```
Expand All @@ -23,7 +23,8 @@ module "group" {
|------|-------------|:----:|:-----:|:-----:|
| iam\_path | | string | `"/"` | no |
| role\_name | | string | `"poweruser"` | no |
| source\_account\_id | | string | n/a | yes |
| source\_account\_id | The source AWS account to establish a trust relationship. Ignored if empty or not provided. | string | '' | no |
| saml\_idp\_arn | The AWS SAML IDP arn to establish a trust relationship. Ignored if empty or not provided. | string | '' | no |

## Outputs

Expand Down
Loading