Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore: implement basic s3 user (#3) #4

Merged
merged 10 commits into from
May 8, 2022
Merged

chore: implement basic s3 user (#3) #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
4eb2b02
ci: upgrade version pre-commit (#3)
luismayta May 8, 2022
59779e8
chore: implement generator readme (#3)
luismayta May 8, 2022
024d458
chore: implement generator plop (#3)
luismayta May 8, 2022
430a49e
chore: implement module iam system user (#3)
luismayta May 8, 2022
8a5fd4f
chore: implement code internal faker s3 (#3)
luismayta May 8, 2022
404d902
test: implement user basic make (#3)
luismayta May 8, 2022
3a3e429
docs: implement example common (#3)
luismayta May 8, 2022
6e529cc
style: format author user (#3)
luismayta May 8, 2022
edc956a
sample: implement basic make user (#3)
luismayta May 8, 2022
ac7f4e8
build: generate files (#3)
luismayta May 8, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion .nvmrc
View file
Open in desktop

This file was deleted.

2 changes: 1 addition & 1 deletion .pre-commit-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@ repos:
args:
- --config=.ci/linters/.hadolint.yaml
- repo: https://github.com/bridgecrewio/checkov.git
rev: '2.0.1100'
rev: '2.0.1120'
hooks:
- id: checkov
args:
Expand Down
100 changes: 81 additions & 19 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,39 +12,46 @@

-->

[![Latest Release](https://img.shields.io/github/release/hadenlabs/terraform-aws-iam-s3-user)](https://github.com/hadenlabs/terraform-aws-iam-s3-user/releases) [![Lint](https://img.shields.io/github/workflow/status/hadenlabs/terraform-aws-iam-s3-user/lint-code)](https://github.com/hadenlabs/terraform-aws-iam-s3-user/actions?workflow=lint-code) [![CI](https://img.shields.io/github/workflow/status/hadenlabs/terraform-aws-iam-s3-user/ci)](https://github.com/hadenlabs/terraform-aws-iam-s3-user/actions?workflow=ci) [![Test](https://img.shields.io/github/workflow/status/hadenlabs/terraform-aws-iam-s3-user/test)](https://github.com/hadenlabs/terraform-aws-iam-s3-user/actions?workflow=test) [![pre-commit](https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit&logoColor=white)](https://github.com/pre-commit/pre-commit) [![Conventional Commits](https://img.shields.io/badge/Conventional%20Commits-1.0.0-yellow)](https://conventionalcommits.org) [![KeepAChangelog](https://img.shields.io/badge/changelog-Keep%20a%20Changelog%20v1.0.0-orange)](https://keepachangelog.com) [![Terraform Version](https://img.shields.io/badge/terraform-1.x%20|%200.15%20|%200.14%20|%200.13%20|%200.12.20+-623CE4.svg?logo=terraform)](https://github.com/hashicorp/terraform/releases)
[![Latest Release](https://img.shields.io/github/release/hadenlabs/terraform-aws-iam-s3-user)](https://github.com/hadenlabs/terraform-aws-iam-s3-user/releases) [![Lint](https://img.shields.io/github/workflow/status/hadenlabs/terraform-aws-iam-s3-user/lint-code)](https://github.com/hadenlabs/terraform-aws-iam-s3-user/actions?workflow=lint-code) [![CI](https://img.shields.io/github/workflow/status/hadenlabs/terraform-aws-iam-s3-user/ci)](https://github.com/hadenlabs/terraform-aws-iam-s3-user/actions?workflow=ci) [![Test](https://img.shields.io/github/workflow/status/hadenlabs/terraform-aws-iam-s3-user/test)](https://github.com/hadenlabs/terraform-aws-iam-s3-user/actions?workflow=test) [![pre-commit](https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit&logoColor=white)](https://github.com/pre-commit/pre-commit) [![Conventional Commits](https://img.shields.io/badge/Conventional%20Commits-1.0.0-yellow)](https://conventionalcommits.org) [![KeepAChangelog](https://img.shields.io/badge/changelog-Keep%20a%20Changelog%20v1.0.0-orange)](https://keepachangelog.com) [![Terraform Version](https://img.shields.io/badge/terraform-1.x%20|%200.15%20|%200.14%20|%200.13%20|%200.12.20+-623CE4.svg?logo=terraform)](https://github.com/hashicorp/terraform/releases) [![AWS Provider Version](https://img.shields.io/badge/AWS-3%20and%202.0+-F8991D.svg?logo=terraform)](https://github.com/terraform-providers/terraform-provider-aws/releases)

# terraform-aws-iam-s3-user

terraform-aws-iam-s3-user for project

### Replace name project to New Project

```bash
agr 'terraform-aws-iam-s3-user' 'new-project'
```

## Requirements

This is a list of plugins that need to be installed previously to enjoy all the goodies of this configuration:

- [gomplate](https://github.com/hairyhenderson/gomplate)
- [terraform](https://github.com/hashicorp/terraform)
- [python](https://www.python.org)
- [taskfile](https://github.com/go-task/task)

## Usage

# How to use this project

```hcl
module "main" {
source = "hadenlabs/terraform-aws-iam-s3-user/aws"
version = "0.0.0"
}
module "main" {
source = "hadenlabs/iam-s3-user/aws"
version = "0.0.0"

depends_on = []
enabled = var.enabled
name = var.name
stage = var.stage
namespace = var.namespace
tags = var.tags
use_fullname = var.use_fullname
s3_actions = [
"s3:ListAllMyBuckets",
]
s3_resources = [
"arn:aws:s3:::bucket-name/*",
]
}
```

Full working examples can be found in [examples](./examples) folder.

## Examples

<!-- Space: Projects -->
Expand All @@ -59,38 +66,93 @@ Full working examples can be found in [examples](./examples) folder.

```hcl
module "main" {
source = "hadenlabs/terraform-aws-iam-s3-user/aws"
source = "hadenlabs/iam-s3-user/aws"
version = "0.0.0"
}
```

## Basic

### data

```hcl
module "main" {
source = "hadenlabs/iam-s3-user/aws"
version = "0.0.0"
depends_on = []
enabled = var.enabled
name = var.name
stage = var.stage
namespace = var.namespace
tags = var.tags
use_fullname = true
s3_actions = [
"s3:GetObject",
"s3:GetObjectAcl",
"s3:ListObjects",
"s3:ListBucket",
"s3:ListAllMyBuckets",
]
s3_resources = [
"arn:aws:s3:::bucket-name/*",
]
}
```

<!-- BEGIN_TF_DOCS -->

## Requirements

| Name | Version |
| ------------------------------------------------------------------------ | ----------------- |
| <a name="requirement_terraform"></a> [terraform](#requirement_terraform) | >= 0.12.20, < 2.0 |
| <a name="requirement_aws"></a> [aws](#requirement_aws) | >= 2.51, < 4.0 |

## Providers

No providers.
| Name | Version |
| ------------------------------------------------ | -------------- |
| <a name="provider_aws"></a> [aws](#provider_aws) | >= 2.51, < 4.0 |

## Modules

No modules.
| Name | Source | Version |
| -------------------------------------------------------- | ----------------------------- | ------- |
| <a name="module_s3_user"></a> [s3_user](#module_s3_user) | hadenlabs/iam-system-user/aws | 0.1.1 |

## Resources

No resources.
| Name | Type |
| --- | --- |
| [aws_iam_user_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_policy) | resource |
| [aws_iam_policy_document.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

## Inputs

No inputs.
| Name | Description | Type | Default | Required |
| --- | --- | --- | --- | :-: |
| <a name="input_enabled"></a> [enabled](#input_enabled) | Set to false to prevent the module from creating any resources | `bool` | `true` | no |
| <a name="input_force_destroy"></a> [force_destroy](#input_force_destroy) | Destroy even if it has non-Terraform-managed IAM access keys, login profiles or MFA devices | `bool` | `false` | no |
| <a name="input_name"></a> [name](#input_name) | name | `string` | n/a | yes |
| <a name="input_namespace"></a> [namespace](#input_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no |
| <a name="input_path"></a> [path](#input_path) | Path in which to create the user | `string` | `"/"` | no |
| <a name="input_s3_actions"></a> [s3_actions](#input_s3_actions) | Actions to allow in the policy | `list(string)` | <pre>[<br> "s3:GetObject"<br>]</pre> | no |
| <a name="input_s3_resources"></a> [s3_resources](#input_s3_resources) | S3 resources to apply the actions specified in the policy | `list(string)` | n/a | yes |
| <a name="input_stage"></a> [stage](#input_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no |
| <a name="input_tags"></a> [tags](#input_tags) | Additional tags (e.g. `map('BusinessUnit','XYZ')` | `map(string)` | `{}` | no |
| <a name="input_use_fullname"></a> [use_fullname](#input_use_fullname) | If set to 'true' then the full ID for the IAM user name (e.g. `[var.namespace]-[var.stage]-[var.name]`) will be used. | `bool` | `false` | no |

## Outputs

No outputs.
| Name | Description |
| --- | --- |
| <a name="output_access_key_id"></a> [access_key_id](#output_access_key_id) | Access Key ID |
| <a name="output_enabled"></a> [enabled](#output_enabled) | Enabled property of module |
| <a name="output_secret_access_key"></a> [secret_access_key](#output_secret_access_key) | Secret Access Key. This will be written to the state file in plain-text |
| <a name="output_use_fullname"></a> [use_fullname](#output_use_fullname) | return if enabled use fullname |
| <a name="output_user_arn"></a> [user_arn](#output_user_arn) | The ARN assigned by AWS for the user |
| <a name="output_user_name"></a> [user_name](#output_user_name) | Normalized IAM user name |
| <a name="output_user_unique_id"></a> [user_unique_id](#output_user_unique_id) | The user unique ID assigned by AWS |

<!-- END_TF_DOCS -->

Expand Down
9 changes: 9 additions & 0 deletions data.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
data "aws_iam_policy_document" "this" {
count = local.outputs.enabled ? 1 : 0

statement {
actions = local.outputs.s3_actions
resources = local.outputs.s3_resources
effect = "Allow"
}
}
30 changes: 29 additions & 1 deletion docs/examples/common.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,35 @@

```hcl
module "main" {
source = "hadenlabs/terraform-aws-iam-s3-user/aws"
source = "hadenlabs/iam-s3-user/aws"
version = "0.0.0"
}
```

## Basic

### data

```hcl
module "main" {
source = "hadenlabs/iam-s3-user/aws"
version = "0.0.0"
depends_on = []
enabled = var.enabled
name = var.name
stage = var.stage
namespace = var.namespace
tags = var.tags
use_fullname = true
s3_actions = [
"s3:GetObject",
"s3:GetObjectAcl",
"s3:ListObjects",
"s3:ListBucket",
"s3:ListAllMyBuckets",
]
s3_resources = [
"arn:aws:s3:::bucket-name/*",
]
}
```
37 changes: 32 additions & 5 deletions docs/include/terraform.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,24 +4,51 @@
| Name | Version |
|------|---------|
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.20, < 2.0 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 2.51, < 4.0 |

## Providers

No providers.
| Name | Version |
|------|---------|
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 2.51, < 4.0 |

## Modules

No modules.
| Name | Source | Version |
|------|--------|---------|
| <a name="module_s3_user"></a> [s3\_user](#module\_s3\_user) | hadenlabs/iam-system-user/aws | 0.1.1 |

## Resources

No resources.
| Name | Type |
|------|------|
| [aws_iam_user_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_policy) | resource |
| [aws_iam_policy_document.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

## Inputs

No inputs.
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| <a name="input_enabled"></a> [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `true` | no |
| <a name="input_force_destroy"></a> [force\_destroy](#input\_force\_destroy) | Destroy even if it has non-Terraform-managed IAM access keys, login profiles or MFA devices | `bool` | `false` | no |
| <a name="input_name"></a> [name](#input\_name) | name | `string` | n/a | yes |
| <a name="input_namespace"></a> [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no |
| <a name="input_path"></a> [path](#input\_path) | Path in which to create the user | `string` | `"/"` | no |
| <a name="input_s3_actions"></a> [s3\_actions](#input\_s3\_actions) | Actions to allow in the policy | `list(string)` | <pre>[<br> "s3:GetObject"<br>]</pre> | no |
| <a name="input_s3_resources"></a> [s3\_resources](#input\_s3\_resources) | S3 resources to apply the actions specified in the policy | `list(string)` | n/a | yes |
| <a name="input_stage"></a> [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no |
| <a name="input_tags"></a> [tags](#input\_tags) | Additional tags (e.g. `map('BusinessUnit','XYZ')` | `map(string)` | `{}` | no |
| <a name="input_use_fullname"></a> [use\_fullname](#input\_use\_fullname) | If set to 'true' then the full ID for the IAM user name (e.g. `[var.namespace]-[var.stage]-[var.name]`) will be used. | `bool` | `false` | no |

## Outputs

No outputs.
| Name | Description |
|------|-------------|
| <a name="output_access_key_id"></a> [access\_key\_id](#output\_access\_key\_id) | Access Key ID |
| <a name="output_enabled"></a> [enabled](#output\_enabled) | Enabled property of module |
| <a name="output_secret_access_key"></a> [secret\_access\_key](#output\_secret\_access\_key) | Secret Access Key. This will be written to the state file in plain-text |
| <a name="output_use_fullname"></a> [use\_fullname](#output\_use\_fullname) | return if enabled use fullname |
| <a name="output_user_arn"></a> [user\_arn](#output\_user\_arn) | The ARN assigned by AWS for the user |
| <a name="output_user_name"></a> [user\_name](#output\_user\_name) | Normalized IAM user name |
| <a name="output_user_unique_id"></a> [user\_unique\_id](#output\_user\_unique\_id) | The user unique ID assigned by AWS |
<!-- END_TF_DOCS -->
24 changes: 18 additions & 6 deletions docs/usage.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,22 @@
# How to use this project

```hcl
module "main" {
source = "hadenlabs/terraform-aws-iam-s3-user/aws"
version = "0.0.0"
}
```
module "main" {
source = "hadenlabs/iam-s3-user/aws"
version = "0.0.0"

Full working examples can be found in [examples](./examples) folder.
depends_on = []
enabled = var.enabled
name = var.name
stage = var.stage
namespace = var.namespace
tags = var.tags
use_fullname = var.use_fullname
s3_actions = [
"s3:ListAllMyBuckets",
]
s3_resources = [
"arn:aws:s3:::bucket-name/*",
]
}
```
Empty file added examples/basic/data.tf
View file
Open in desktop
Empty file.
24 changes: 21 additions & 3 deletions examples/basic/docs/include/terraform.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,8 @@

| Name | Version |
|------|---------|
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13 |
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.20, < 2.0 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 2.51, < 4.0 |

## Providers

Expand All @@ -21,9 +22,26 @@ No resources.

## Inputs

No inputs.
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| <a name="input_enabled"></a> [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `true` | no |
| <a name="input_name"></a> [name](#input\_name) | name | `string` | n/a | yes |
| <a name="input_namespace"></a> [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no |
| <a name="input_s3_actions"></a> [s3\_actions](#input\_s3\_actions) | Actions to allow in the policy | `list(string)` | <pre>[<br> "s3:GetObject"<br>]</pre> | no |
| <a name="input_s3_resources"></a> [s3\_resources](#input\_s3\_resources) | S3 resources to apply the actions specified in the policy | `list(string)` | n/a | yes |
| <a name="input_stage"></a> [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no |
| <a name="input_tags"></a> [tags](#input\_tags) | Additional tags (e.g. `map('BusinessUnit','XYZ')` | `map(string)` | `{}` | no |
| <a name="input_use_fullname"></a> [use\_fullname](#input\_use\_fullname) | If set to 'true' then the full ID for the IAM user name (e.g. `[var.namespace]-[var.stage]-[var.name]`) will be used. | `bool` | `false` | no |

## Outputs

No outputs.
| Name | Description |
|------|-------------|
| <a name="output_access_key_id"></a> [access\_key\_id](#output\_access\_key\_id) | The access key ID |
| <a name="output_enabled"></a> [enabled](#output\_enabled) | Enabled property of module |
| <a name="output_secret_access_key"></a> [secret\_access\_key](#output\_secret\_access\_key) | The secret access key. This will be written to the state file in plain-text |
| <a name="output_use_fullname"></a> [use\_fullname](#output\_use\_fullname) | return if enabled use fullname |
| <a name="output_user_arn"></a> [user\_arn](#output\_user\_arn) | The ARN assigned by AWS for this user |
| <a name="output_user_name"></a> [user\_name](#output\_user\_name) | Normalized IAM user name |
| <a name="output_user_unique_id"></a> [user\_unique\_id](#output\_user\_unique\_id) | The unique ID assigned by AWS |
<!-- END_TF_DOCS -->
11 changes: 10 additions & 1 deletion examples/basic/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,12 @@
module "main" {
source = "../.."
source = "../.."
depends_on = []
enabled = var.enabled
name = var.name
stage = var.stage
namespace = var.namespace
tags = var.tags
use_fullname = var.use_fullname
s3_actions = var.s3_actions
s3_resources = var.s3_resources
}
36 changes: 36 additions & 0 deletions examples/basic/outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
output "enabled" {
description = "Enabled property of module"
value = module.main.enabled
}

output "user_name" {
description = "Normalized IAM user name"
value = module.main.user_name
}

output "user_arn" {
description = "The ARN assigned by AWS for this user"
value = module.main.user_arn
}

output "user_unique_id" {
description = "The unique ID assigned by AWS"
value = module.main.user_unique_id
}

output "access_key_id" {
sensitive = true
description = "The access key ID"
value = module.main.access_key_id
}

output "secret_access_key" {
sensitive = true
description = "The secret access key. This will be written to the state file in plain-text"
value = module.main.secret_access_key
}

output "use_fullname" {
description = "return if enabled use fullname"
value = module.main.use_fullname
}
Loading