Skip to content

Commit 37ba3b2

Browse files
author
jczerniak
authored
Merge pull request #1 from jczerniak/assume_role_with_saml_provider
Assume role with saml provider
2 parents e8c695d + f6e9e51 commit 37ba3b2

File tree

8 files changed

+399
-0
lines changed

8 files changed

+399
-0
lines changed

‎README.md

+18
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,23 @@ module "iam_assumable_roles" {
7373
}
7474
```
7575

76+
`iam-assumable-roles-with-saml`:
77+
```hcl
78+
module "iam_assumable_roles_with_saml" {
79+
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-roles-with-saml"
80+
81+
create_admin_role = true
82+
83+
create_poweruser_role = true
84+
poweruser_role_name = "developer"
85+
86+
create_readonly_role = true
87+
88+
provider_name = "${aws_iam_saml_provider.idp_saml.name}"
89+
provider_id = "${aws_iam_saml_provider.idp_saml.id}"
90+
}
91+
```
92+
7693
`iam-user`:
7794
```hcl
7895
module "iam_user" {
@@ -202,6 +219,7 @@ Use [iam-policy module](https://github.com/terraform-aws-modules/terraform-aws-i
202219
* [iam-account](https://github.com/terraform-aws-modules/terraform-aws-iam/tree/master/examples/iam-account) - Set AWS account alias and password policy
203220
* [iam-assumable-role](https://github.com/terraform-aws-modules/terraform-aws-iam/tree/master/examples/iam-assumable-roles) - Create individual IAM role which can be assumed from specified ARNs (AWS accounts, IAM users, etc)
204221
* [iam-assumable-roles](https://github.com/terraform-aws-modules/terraform-aws-iam/tree/master/examples/iam-assumable-roles) - Create several IAM roles which can be assumed from specified ARNs (AWS accounts, IAM users, etc)
222+
* [iam-assumable-roles-with-saml](https://github.com/terraform-aws-modules/terraform-aws-iam/tree/master/examples/iam-assumable-roles-with-saml) - Create several IAM roles which can be assumed from Users with a SAML Identity Provider
205223
* [iam-group-with-assumable-roles-policy](https://github.com/terraform-aws-modules/terraform-aws-iam/tree/master/examples/iam-group-with-assumable-roles-policy) - IAM group with users who are allowed to assume IAM roles in the same or in separate AWS account
206224
* [iam-group-with-policies](https://github.com/terraform-aws-modules/terraform-aws-iam/tree/master/examples/iam-group-with-policies) - IAM group with users who are allowed specified IAM policies (eg, "manage their own IAM user")
207225
* [iam-group-complete](https://github.com/terraform-aws-modules/terraform-aws-iam/tree/master/examples/iam-group-complete) - IAM group with users who are allowed to assume IAM roles in another AWS account and have access to specified IAM policies

‎examples/iam-assumable-roles-with-saml/README.md

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# IAM assumable roles with SAML Identity Provider example
2+
3+
Configuration in this directory creates several IAM roles which can be assumed from Users with a SAML Identity Provider
4+
5+
# Usage
6+
7+
To run this example you need to execute:
8+
9+
```bash
10+
$ terraform init
11+
$ terraform plan
12+
$ terraform apply
13+
```
14+
15+
Run `terraform destroy` when you don't need these resources.
16+
17+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
18+
## Outputs
19+
20+
| Name | Description |
21+
|------|-------------|
22+
| admin\_iam\_role\_arn | ARN of admin IAM role |
23+
| admin\_iam\_role\_name | Name of admin IAM role |
24+
| admin\_iam\_role\_path | Path of admin IAM role |
25+
| poweruser\_iam\_role\_arn | ARN of poweruser IAM role |
26+
| poweruser\_iam\_role\_name | Name of poweruser IAM role |
27+
| poweruser\_iam\_role\_path | Path of poweruser IAM role |
28+
| readonly\_iam\_role\_arn | ARN of readonly IAM role |
29+
| readonly\_iam\_role\_name | Name of readonly IAM role |
30+
| readonly\_iam\_role\_path | Path of readonly IAM role |
31+
32+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/iam-assumable-roles-with-saml/main.tf

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
provider "aws" {
2+
region = "eu-west-1"
3+
}
4+
5+
resource "aws_iam_saml_provider" "idp_saml" {
6+
name = "idp_saml"
7+
saml_metadata_document = "${file("${path.module}/saml-metadata.xml")}"
8+
}
9+
10+
###############################
11+
# IAM assumable roles with SAML
12+
###############################
13+
14+
module "iam_assumable_roles_with_saml" {
15+
source = "../../../terraform-aws-iam/modules/iam-assumable-roles-with-saml"
16+
17+
create_admin_role = true
18+
19+
create_poweruser_role = true
20+
poweruser_role_name = "developer"
21+
22+
create_readonly_role = true
23+
24+
provider_name = "${aws_iam_saml_provider.idp_saml.name}"
25+
provider_id = "${aws_iam_saml_provider.idp_saml.id}"
26+
}

‎examples/iam-assumable-roles-with-saml/outputs.tf

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# Admin
2+
output "admin_iam_role_arn" {
3+
description = "ARN of admin IAM role"
4+
value = "${module.iam_assumable_roles_with_saml.admin_iam_role_arn}"
5+
}
6+
7+
output "admin_iam_role_name" {
8+
description = "Name of admin IAM role"
9+
value = "${module.iam_assumable_roles_with_saml.admin_iam_role_name}"
10+
}
11+
12+
output "admin_iam_role_path" {
13+
description = "Path of admin IAM role"
14+
value = "${module.iam_assumable_roles_with_saml.admin_iam_role_path}"
15+
}
16+
17+
# Poweruser
18+
output "poweruser_iam_role_arn" {
19+
description = "ARN of poweruser IAM role"
20+
value = "${module.iam_assumable_roles_with_saml.poweruser_iam_role_arn}"
21+
}
22+
23+
output "poweruser_iam_role_name" {
24+
description = "Name of poweruser IAM role"
25+
value = "${module.iam_assumable_roles_with_saml.poweruser_iam_role_name}"
26+
}
27+
28+
output "poweruser_iam_role_path" {
29+
description = "Path of poweruser IAM role"
30+
value = "${module.iam_assumable_roles_with_saml.poweruser_iam_role_path}"
31+
}
32+
33+
# Readonly
34+
output "readonly_iam_role_arn" {
35+
description = "ARN of readonly IAM role"
36+
value = "${module.iam_assumable_roles_with_saml.readonly_iam_role_arn}"
37+
}
38+
39+
output "readonly_iam_role_name" {
40+
description = "Name of readonly IAM role"
41+
value = "${module.iam_assumable_roles_with_saml.readonly_iam_role_name}"
42+
}
43+
44+
output "readonly_iam_role_path" {
45+
description = "Path of readonly IAM role"
46+
value = "${module.iam_assumable_roles_with_saml.readonly_iam_role_path}"
47+
}

‎modules/iam-assumable-roles-with-saml/README.md

+54
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# iam-assumable-roles
2+
3+
Creates single IAM role which can be assumed by trusted resources using SAML Federated Users.
4+
5+
6+
[Creating IAM SAML Identity Providers](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml.html)
7+
[Enabling SAML 2.0 Federated Users to Access the AWS Management Console](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-saml.html)
8+
9+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
10+
## Inputs
11+
12+
| Name | Description | Type | Default | Required |
13+
|------|-------------|:----:|:-----:|:-----:|
14+
| admin\_role\_name | IAM role with admin access | string | `"admin"` | no |
15+
| admin\_role\_path | Path of admin IAM role | string | `"/"` | no |
16+
| admin\_role\_permissions\_boundary\_arn | Permissions boundary ARN to use for admin role | string | `""` | no |
17+
| admin\_role\_policy\_arn | Policy ARN to use for admin role | string | `"arn:aws:iam::aws:policy/AdministratorAccess"` | no |
18+
| admin\_role\_requires\_mfa | Whether admin role requires MFA | string | `"true"` | no |
19+
| create\_admin\_role | Whether to create admin role | string | `"false"` | no |
20+
| create\_poweruser\_role | Whether to create poweruser role | string | `"false"` | no |
21+
| create\_readonly\_role | Whether to create readonly role | string | `"false"` | no |
22+
| max\_session\_duration | Maximum CLI/API session duration in seconds between 3600 and 43200 | string | `"3600"` | no |
23+
| poweruser\_role\_name | IAM role with poweruser access | string | `"poweruser"` | no |
24+
| poweruser\_role\_path | Path of poweruser IAM role | string | `"/"` | no |
25+
| poweruser\_role\_permissions\_boundary\_arn | Permissions boundary ARN to use for poweruser role | string | `""` | no |
26+
| poweruser\_role\_policy\_arn | Policy ARN to use for poweruser role | string | `"arn:aws:iam::aws:policy/PowerUserAccess"` | no |
27+
| poweruser\_role\_requires\_mfa | Whether poweruser role requires MFA | string | `"true"` | no |
28+
| readonly\_role\_name | IAM role with readonly access | string | `"readonly"` | no |
29+
| readonly\_role\_path | Path of readonly IAM role | string | `"/"` | no |
30+
| readonly\_role\_permissions\_boundary\_arn | Permissions boundary ARN to use for readonly role | string | `""` | no |
31+
| readonly\_role\_policy\_arn | Policy ARN to use for readonly role | string | `"arn:aws:iam::aws:policy/ReadOnlyAccess"` | no |
32+
| readonly\_role\_requires\_mfa | Whether readonly role requires MFA | string | `"true"` | no |
33+
| provider\_name | Name of the SAML Provider | string | `""` | yes |
34+
| provider\_id | ID of the SAML Provider | string | `""` | yes |
35+
| aws_saml_endpoint | AWS SAML Endpoint | list | `["https://signin.aws.amazon.com/saml"]` | no |
36+
37+
## Outputs
38+
39+
| Name | Description |
40+
|------|-------------|
41+
| admin\_iam\_role\_arn | ARN of admin IAM role |
42+
| admin\_iam\_role\_name | Name of admin IAM role |
43+
| admin\_iam\_role\_path | Path of admin IAM role |
44+
| admin\_iam\_role\_requires\_mfa | Whether admin IAM role requires MFA |
45+
| poweruser\_iam\_role\_arn | ARN of poweruser IAM role |
46+
| poweruser\_iam\_role\_name | Name of poweruser IAM role |
47+
| poweruser\_iam\_role\_path | Path of poweruser IAM role |
48+
| poweruser\_iam\_role\_requires\_mfa | Whether poweruser IAM role requires MFA |
49+
| readonly\_iam\_role\_arn | ARN of readonly IAM role |
50+
| readonly\_iam\_role\_name | Name of readonly IAM role |
51+
| readonly\_iam\_role\_path | Path of readonly IAM role |
52+
| readonly\_iam\_role\_requires\_mfa | Whether readonly IAM role requires MFA |
53+
54+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎modules/iam-assumable-roles-with-saml/main.tf

+78
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
data "aws_iam_policy_document" "assume_role_with_saml" {
2+
statement {
3+
effect = "Allow"
4+
5+
actions = ["sts:AssumeRoleWithSAML"]
6+
7+
principals {
8+
type = "Federated"
9+
identifiers = ["${var.provider_id}"]
10+
}
11+
12+
condition {
13+
test = "StringEquals"
14+
variable = "SAML:aud"
15+
values = ["${var.aws_saml_endpoint}"]
16+
}
17+
}
18+
}
19+
20+
# Admin
21+
resource "aws_iam_role" "admin" {
22+
count = "${var.create_admin_role ? 1 : 0}"
23+
24+
name = "${var.admin_role_name}"
25+
path = "${var.admin_role_path}"
26+
max_session_duration = "${var.max_session_duration}"
27+
28+
permissions_boundary = "${var.admin_role_permissions_boundary_arn}"
29+
30+
assume_role_policy = "${data.aws_iam_policy_document.assume_role_with_saml.json}"
31+
}
32+
33+
resource "aws_iam_role_policy_attachment" "admin" {
34+
count = "${var.create_admin_role ? 1 : 0}"
35+
36+
role = "${aws_iam_role.admin.name}"
37+
policy_arn = "${var.admin_role_policy_arn}"
38+
}
39+
40+
# Poweruser
41+
resource "aws_iam_role_policy_attachment" "poweruser" {
42+
count = "${var.create_poweruser_role ? 1 : 0}"
43+
44+
role = "${aws_iam_role.poweruser.name}"
45+
policy_arn = "${var.poweruser_role_policy_arn}"
46+
}
47+
48+
resource "aws_iam_role" "poweruser" {
49+
count = "${var.create_poweruser_role ? 1 : 0}"
50+
51+
name = "${var.poweruser_role_name}"
52+
path = "${var.poweruser_role_path}"
53+
max_session_duration = "${var.max_session_duration}"
54+
55+
permissions_boundary = "${var.poweruser_role_permissions_boundary_arn}"
56+
57+
assume_role_policy = "${data.aws_iam_policy_document.assume_role_with_saml.json}"
58+
}
59+
60+
# Readonly
61+
resource "aws_iam_role_policy_attachment" "readonly" {
62+
count = "${var.create_readonly_role ? 1 : 0}"
63+
64+
role = "${aws_iam_role.readonly.name}"
65+
policy_arn = "${var.readonly_role_policy_arn}"
66+
}
67+
68+
resource "aws_iam_role" "readonly" {
69+
count = "${var.create_readonly_role ? 1 : 0}"
70+
71+
name = "${var.readonly_role_name}"
72+
path = "${var.readonly_role_path}"
73+
max_session_duration = "${var.max_session_duration}"
74+
75+
permissions_boundary = "${var.readonly_role_permissions_boundary_arn}"
76+
77+
assume_role_policy = "${data.aws_iam_policy_document.assume_role_with_saml.json}"
78+
}

‎modules/iam-assumable-roles-with-saml/outputs.tf

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
#Admin
2+
output "admin_iam_role_arn" {
3+
description = "ARN of admin IAM role"
4+
value = "${element(concat(aws_iam_role.admin.*.arn, list("")), 0)}"
5+
}
6+
7+
output "admin_iam_role_name" {
8+
description = "Name of admin IAM role"
9+
value = "${element(concat(aws_iam_role.admin.*.name, list("")), 0)}"
10+
}
11+
12+
output "admin_iam_role_path" {
13+
description = "Path of admin IAM role"
14+
value = "${element(concat(aws_iam_role.admin.*.path, list("")), 0)}"
15+
}
16+
17+
output "poweruser_iam_role_arn" {
18+
description = "ARN of poweruser IAM role"
19+
value = "${element(concat(aws_iam_role.poweruser.*.arn, list("")), 0)}"
20+
}
21+
22+
output "poweruser_iam_role_name" {
23+
description = "Name of poweruser IAM role"
24+
value = "${element(concat(aws_iam_role.poweruser.*.name, list("")), 0)}"
25+
}
26+
27+
output "poweruser_iam_role_path" {
28+
description = "Path of poweruser IAM role"
29+
value = "${element(concat(aws_iam_role.poweruser.*.path, list("")), 0)}"
30+
}
31+
32+
# Readonly
33+
output "readonly_iam_role_arn" {
34+
description = "ARN of readonly IAM role"
35+
value = "${element(concat(aws_iam_role.readonly.*.arn, list("")), 0)}"
36+
}
37+
38+
output "readonly_iam_role_name" {
39+
description = "Name of readonly IAM role"
40+
value = "${element(concat(aws_iam_role.readonly.*.name, list("")), 0)}"
41+
}
42+
43+
output "readonly_iam_role_path" {
44+
description = "Path of readonly IAM role"
45+
value = "${element(concat(aws_iam_role.readonly.*.path, list("")), 0)}"
46+
}

0 commit comments

Comments
 (0)