feat: Added iam-read-only-policy module #174

Andrey9kin · 2021-11-16T13:28:46Z

Description

Added new module to create customizable read only policy

Motivation and Context

As stated in the readme: Creates IAM read-only policy for specified services. Default AWS read-only policies (arn:aws:iam::aws:policy/job-function/ViewOnlyAccess, arn:aws:iam::aws:policy/ReadOnlyAccess), being a one-size-fits-all type of policies, have a lot of things missing as well as something that you might not need. Also, AWS default policies are known for having security issues
Thus this module is an attempt to build a better base for a customizable usable read-only policy.
Module requires a list of allowed services which forces you to compile such a list which will be very useful if you are to create an SCP to forbid usage of not allowed services.
Most of our customers asked for something like that so their developers can login to prod with proper read only access and we had a number of requests to have such module available as open source
We could open source it under fivexl org but here feels like a better place. Hopefully more people will be able to take advantage of it and perhaps contribute back. So win-win all around

Breaking Changes

A new thing. Does not break anything

How Has This Been Tested?

I have tested and validated these changes using one or more of the provided examples/* projects
Battle-tested in a several projects

Signed-off-by: Andrey Devyatkin <andrey.devyatkin@fivexl.io>

Andrey9kin · 2021-11-16T13:30:01Z

@antonbabenko could you please take a look when you have time or ask someone to do so. Thanks!

antonbabenko

Please add relevant updates in the main README in the "Usage" and "Examples" sections.

antonbabenko · 2021-11-17T08:29:17Z

examples/iam-read-only-policy/main.tf

+  )
+}
+
+module "iam_policy" {


Add another example of module call with create_policy = false and update variables defaults accordingly.

examples/iam-read-only-policy/main.tf

antonbabenko · 2021-11-17T08:32:34Z

examples/iam-read-only-policy/versions.tf

@@ -0,0 +1,7 @@
+terraform {
+  required_version = ">= 0.15.0"


Please set >= 0.12.6 as on all other modules. We will bump to >= 0.13.1 in all modules in another PR.

examples/iam-read-only-policy/versions.tf

modules/iam-read-only-policy/README.md

modules/iam-read-only-policy/variables.tf

antonbabenko · 2021-11-17T08:45:48Z

modules/iam-read-only-policy/main.tf

+}
+
+locals {
+  console_services = ["resource-groups", "tag", "health"]


Let's move these from locals to separate variable defaults to allow customizations (if necessary).

modules/iam-read-only-policy/variables.tf

antonbabenko · 2021-11-17T08:50:15Z

modules/iam-read-only-policy/versions.tf

@@ -0,0 +1,7 @@
+terraform {
+  required_version = ">= 0.15.0"


Same version requirements here as in the example.

examples/iam-read-only-policy/README.md

RafPe · 2021-12-28T12:25:41Z

@Andrey9kin any update on completing this resource ? I can see potential on using it.

Andrey9kin · 2021-12-29T12:08:06Z

@RafPe will be looking into it tonight! Got few more people asking for it as well

Co-authored-by: Anton Babenko <anton@antonbabenko.com>

Signed-off-by: Andrey Devyatkin <andrey.devyatkin@fivexl.io>

Andrey9kin · 2021-12-29T21:29:19Z

@antonbabenko sorry for keeping it hanging but end of the year was kind of crazy. Thanks for the great review comments. When you are back from holidays please take a look. Thanks!

Signed-off-by: Andrey Devyatkin <andrey.devyatkin@fivexl.io>

antonbabenko · 2022-01-03T14:39:53Z

modules/iam-read-only-policy/main.tf

+}
+
+data "aws_iam_policy_document" "allowed_services" {
+


Normally, in other terraform-aws-modules, nothing is being created if create_* = false is defined. This way is compatible with situations when users want to control the creation of all or nothing (e.g. still handy with terragrunt).

I see what you mean in this example. Let's leave it as you have done already. I think it makes sense here.

modules/iam-read-only-policy/versions.tf

examples/iam-read-only-policy/README.md

# [4.8.0](v4.7.0...v4.8.0) (2022-01-03) ### Bug Fixes * update CI/CD process to enable auto-release workflow ([#175](#175)) ([9278e6f](9278e6f)) ### Features * Added iam-read-only-policy module ([#174](#174)) ([392756f](392756f))

antonbabenko · 2022-01-03T15:00:19Z

This PR is included in version 4.8.0 🎉

github-actions · 2022-11-09T02:39:15Z

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

feat: new module iam-read-only-policy

a929c68

Signed-off-by: Andrey Devyatkin <andrey.devyatkin@fivexl.io>

antonbabenko requested changes Nov 17, 2021

View reviewed changes

Andrey9kin and others added 7 commits December 29, 2021 21:53

Update examples/iam-read-only-policy/README.md

11b6bd3

Co-authored-by: Anton Babenko <anton@antonbabenko.com>

Update modules/iam-read-only-policy/variables.tf

5d97810

Co-authored-by: Anton Babenko <anton@antonbabenko.com>

Update modules/iam-read-only-policy/variables.tf

9a2f056

Co-authored-by: Anton Babenko <anton@antonbabenko.com>

Update modules/iam-read-only-policy/README.md

d33c7ed

Co-authored-by: Anton Babenko <anton@antonbabenko.com>

apply review comments

1c5c0aa

Signed-off-by: Andrey Devyatkin <andrey.devyatkin@fivexl.io>

additional example

354c17d

Signed-off-by: Andrey Devyatkin <andrey.devyatkin@fivexl.io>

Merge branch 'master' into master

49e6b4a

Andrey9kin requested a review from antonbabenko December 29, 2021 21:30

missed to update version in examples

25a47d6

Signed-off-by: Andrey Devyatkin <andrey.devyatkin@fivexl.io>

antonbabenko approved these changes Jan 3, 2022

View reviewed changes

Apply suggestions from code review

f14d551

antonbabenko changed the title ~~feat: new module iam-read-only-policy~~ feat: Added iam-read-only-policy module Jan 3, 2022

antonbabenko added 2 commits January 3, 2022 15:45

docs: Fixed docs

dc00059

docs: README

75b39c2

antonbabenko merged commit 392756f into terraform-aws-modules:master Jan 3, 2022

github-actions bot locked as resolved and limited conversation to collaborators Nov 9, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Added iam-read-only-policy module #174

feat: Added iam-read-only-policy module #174

Andrey9kin commented Nov 16, 2021

Andrey9kin commented Nov 16, 2021

antonbabenko left a comment

antonbabenko Nov 17, 2021

antonbabenko Nov 17, 2021

Andrey9kin Dec 29, 2021

antonbabenko Nov 17, 2021

Andrey9kin Dec 29, 2021

antonbabenko Nov 17, 2021

Andrey9kin Dec 29, 2021

RafPe commented Dec 28, 2021

Andrey9kin commented Dec 29, 2021

Andrey9kin commented Dec 29, 2021

antonbabenko Jan 3, 2022

antonbabenko commented Jan 3, 2022

github-actions bot commented Nov 9, 2022

feat: Added iam-read-only-policy module #174

feat: Added iam-read-only-policy module #174

Conversation

Andrey9kin commented Nov 16, 2021

Description

Motivation and Context

Breaking Changes

How Has This Been Tested?

Andrey9kin commented Nov 16, 2021

antonbabenko left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

RafPe commented Dec 28, 2021

Andrey9kin commented Dec 29, 2021

Andrey9kin commented Dec 29, 2021

Choose a reason for hiding this comment

antonbabenko commented Jan 3, 2022

github-actions bot commented Nov 9, 2022