This is a Terraform deployment for creating IAM resources for those users allowed to provision assessment environments in the COOL.
- Terraform installed on your system.
- An accessible AWS S3 bucket to store Terraform state (specified in backend.tf).
- An accessible AWS DynamoDB database to store the Terraform state lock (specified in backend.tf).
- Access to all of the Terraform remote states specified in remote_states.tf.
- User accounts for all users must have been created previously. We
recommend using the
cisagov/cool-users-non-adminrepository to create users.
- Create a Terraform workspace (if you haven't already done so) by running
terraform workspace new <workspace_name> - Create a
<workspace_name>.tfvarsfile with all of the required variables (see Inputs below for details):
users = [
"firstname1.lastname1",
"firstname2.lastname2"
]- Run the command
terraform init. - Run the command
terraform apply -var-file=<workspace_name>.tfvars.
| Name | Version |
|---|---|
| terraform | ~> 1.0 |
| aws | ~> 4.9 |
| Name | Version |
|---|---|
| aws | ~> 4.9 |
| aws.organizationsreadonly | ~> 4.9 |
| aws.users | ~> 4.9 |
| terraform | n/a |
No modules.
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| assessment_provisioners_group_name | The name of the IAM group whose members are allowed to provision assessment environments. | string |
"assessment_provisioners" |
no |
| assessment_provisioners_no_backend_group_name | The name of the IAM group whose members are allowed to provision assessment environments but do not have general access to the Terraform backend. | string |
"assessment_provisioners_no_backend" |
no |
| aws_region | The AWS region to deploy into (e.g. us-east-1). | string |
"us-east-1" |
no |
| provision_assessment_backend_policy_description | The description to associate with the IAM policy in the Users account that allows assumption of all non-assessment roles needed in order to provision assessment environments. | string |
"Allows assumption of all non-assessment roles needed in order to provision assessment environments." |
no |
| provision_assessment_backend_policy_name | The name of the IAM policy in the Users account that allows assumption of all non-assessment roles needed in order to provision assessment environments. | string |
"AssumeProvisionAssessmentBackend" |
no |
| provision_assessment_base_policy_description | The description to associate with the IAM policy in the Users account that allows assumption of all assessment roles needed in order to provision assessment environments. | string |
"Allows assumption of all assessment roles needed in order to provision assessment environments." |
no |
| provision_assessment_base_policy_name | The name of the IAM policy in the Users account that allows the assessment provisioner group to assume all assessment roles needed in order to provision assessment environments. | string |
"AssumeProvisionAssessment" |
no |
| provision_assessment_no_backend_policy_description | The description to associate with the IAM policy in the Users account that allows assumption of all non-assessment roles needed in order to provision assessment environments, with the exception of Terraform backend access. | string |
"Allows assumption of all non-assessment roles needed in order to provision assessment environments, with the exception of backend access." |
no |
| provision_assessment_no_backend_policy_name | The name of the IAM policy in the Users account that allows assumption of all non-assessment roles needed in order to provision assessment environments, with the exception of Terraform backend access. | string |
"AssumeProvisionAssessmentNoBackend" |
no |
| provision_assessment_role_name | The name of the IAM role in assessment accounts that includes all permissions necessary to provision the assessment environment in that account. If this role does not exist in an account, an assessment environment cannot be provisioned in that account. | string |
"ProvisionAccount" |
no |
| startstopssmsession_role_name | The name of the IAM role in assessment accounts that includes all permissions necessary to start and stop an SSM session in that account. | string |
"StartStopSSMSession" |
no |
| tags | Tags to apply to all AWS resources created. | map(string) |
{} |
no |
| users | A map. The keys are the names of users that exist in the Users account and are to be allowed to provision assessment environments. The values are maps with a single key, "backend_access", which is a boolean value indicating whether or not the user should have general Terraform backend access. Example: {"firstname1.lastname1" = {backend_access = true}}, {"firstname2.lastname2" = {backend_access = false}}. | map(object({ backend_access = bool })) |
n/a | yes |
| Name | Description |
|---|---|
| assessment_provisioners_backend_policy | The IAM policy in the Users account that allows assumption of all non-assessment roles needed in order to provision assessment environments. |
| assessment_provisioners_base_policy | The IAM policy in the Users account that allows assumption of all assessment roles needed in order to provision assessment environments. |
| assessment_provisioners_group | The IAM group whose members are allowed to provision assessment environments. |
| assessment_provisioners_no_backend_group | The IAM group whose members are allowed to provision assessment environments but do not have general access to the Terraform backend. |
| assessment_provisioners_no_backend_policy | The IAM policy in the Users account that allows assumption of all non-assessment roles needed in order to provision assessment environments, with the exception of Terraform backend access. |
Running pre-commit requires running terraform init in every directory that
contains Terraform code. In this repository, this is just the main directory.
We welcome contributions! Please see CONTRIBUTING.md for
details.
This project is in the worldwide public domain.
This project is in the public domain within the United States, and copyright and related rights in the work worldwide are waived through the CC0 1.0 Universal public domain dedication.
All contributions to this project will be released under the CC0 dedication. By submitting a pull request, you are agreeing to comply with this waiver of copyright interest.