Skip to content

118 console mngt for new user #120

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sshi100 merged 3 commits into from
Sep 30, 2020
Merged

118 console mngt for new user #120

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7e1e483
enable console mangement for users
sshi100 Sep 29, 2020
2e07721
allow console after MFA and first password change before MFA
sshi100 Sep 30, 2020
73b5261
allow console password to to be accessible...
sshi100 Sep 30, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions templates/terraform/environments/shared/console_allowed.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
# AWS policy documents for allowing console
data "aws_iam_policy_document" "console_allowed" {
statement {
sid = "AllowConsolePasswordDisplay"
effect = "Allow"
actions = [
"iam:ListUsers",
]
resources = ["arn:aws:iam::${local.account_id}:user/*"]
}
statement {
sid = "AllowManageOwnProfile"
effect = "Allow"
actions = [
"iam:GetLoginProfile",
"iam:CreateLoginProfile",
"iam:DeleteLoginProfile",
"iam:UpdateLoginProfile",
]
resources = ["arn:aws:iam::${local.account_id}:user/$${aws:username}"]
}
}

resource "aws_iam_group" "console_allowed" {
Copy link
Copy Markdown
Contributor

@bmonkman bmonkman Sep 30, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This feels like too granular of a group, and something we should just be attaching to users by default but if you want to make it a group that's fine.

name = "console-allowed"
}

resource "aws_iam_group_policy" "console_allowed" {
name = "AllowConsole"
group = aws_iam_group.console_allowed.name
policy = data.aws_iam_policy_document.console_allowed.json
}
12 changes: 11 additions & 1 deletion templates/terraform/environments/shared/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ locals {
## Create users
resource "aws_iam_user" "access_user" {
count = length(local.users)
name = "${local.project}-${local.users[count.index].name}"
name = local.users[count.index].name

tags = {
for r in local.users[count.index].roles : "role:${r.name}" => join("/", r.environments)
Expand All @@ -67,6 +67,16 @@ resource "aws_iam_group_membership" "mfa_required_group" {
group = aws_iam_group.mfa_required.name
}

resource "aws_iam_group_membership" "console_allowed_group" {
name = "console-allowed"

users = [
for user in local.users : user.name
]

group = aws_iam_group.console_allowed.name
}

output "iam_users" {
value = aws_iam_user.access_user
}
Expand Down
6 changes: 4 additions & 2 deletions templates/terraform/environments/shared/mfa_required.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,8 @@ data "aws_iam_policy_document" "mfa_required_policy" {
"iam:CreateAccessKey",
"iam:DeleteAccessKey",
"iam:ListAccessKeys",
"iam:UpdateAccessKey"
"iam:UpdateAccessKey",
"iam:GetAccessKeyLastUsed",
]
resources = [ "arn:aws:iam::${local.account_id}:user/$${aws:username}" ]
}
Expand All @@ -65,6 +66,7 @@ data "aws_iam_policy_document" "mfa_required_policy" {
"iam:ListMFADevices",
"iam:ListVirtualMFADevices",
"iam:ResyncMFADevice",
"iam:ChangePassword",
"sts:GetSessionToken"
]
resources = ["*"]
Expand All @@ -77,7 +79,7 @@ data "aws_iam_policy_document" "mfa_required_policy" {
}

resource "aws_iam_group" "mfa_required" {
name = "mfa_required"
name = "mfa-required"
}

resource "aws_iam_group_policy" "mfa_required" {
Expand Down
6 changes: 3 additions & 3 deletions templates/terraform/environments/stage/user_access.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ data "aws_iam_policy_document" "developer_access" {
statement {
effect = "Allow"
actions = ["eks:DescribeCluster"]
resources = ["arn:aws:eks:${local.region}:${local.account_id}:cluster/${local.project}-prod*"]
resources = ["arn:aws:eks:${local.region}:${local.account_id}:cluster/${local.project}-stage*"]
}

# ECR
Expand Down Expand Up @@ -44,14 +44,14 @@ data "aws_iam_policy_document" "operator_access" {
"iam:ListRoles",
"sts:AssumeRole"
]
resources = ["arn:aws:iam::${local.account_id}:role/${local.project}-kubernetes-operator-prod"]
resources = ["arn:aws:iam::${local.account_id}:role/${local.project}-kubernetes-operator-stage"]
}

# EKS
statement {
effect = "Allow"
actions = ["eks:*"]
resources = ["arn:aws:eks:${local.region}:${local.account_id}:cluster/${local.project}-prod*"]
resources = ["arn:aws:eks:${local.region}:${local.account_id}:cluster/${local.project}-stage*"]
}

# ECR
Expand Down
6 changes: 3 additions & 3 deletions templates/terraform/modules/environment/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,7 +102,7 @@ module "s3_hosting" {

module "db" {
source = "commitdev/zero/aws//modules/database"
version = "0.1.1"
version = "0.1.2"

project = var.project
environment = var.environment
Expand All @@ -125,7 +125,7 @@ module "ecr" {

module "logging" {
source = "commitdev/zero/aws//modules/logging"
version = "0.1.0"
version = "0.1.2"

count = var.logging_type == "kibana" ? 1 : 0

Expand All @@ -152,7 +152,7 @@ module "sendgrid" {

module "user_access" {
source = "commitdev/zero/aws//modules//user_access"
version = "0.1.2"
version = "0.1.3"

project = var.project
environment = var.environment
Expand Down