Skip to content

Commit 0452d23

Browse files
andresb39andresb39
committed
Add module code
1 parent a2b2a79 commit 0452d23

File tree

9 files changed

+318
-3
lines changed

9 files changed

+318
-3
lines changed

‎.github/workflows/pre-commit.yaml

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
name: Run Pre-Commit
2+
3+
on:
4+
pull_request:
5+
push:
6+
branches: [main]
7+
8+
permissions: read-all
9+
10+
env:
11+
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
12+
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
13+
14+
jobs:
15+
pre-commit:
16+
runs-on: ubuntu-latest
17+
steps:
18+
- uses: actions/checkout@v3
19+
with:
20+
fetch-depth: 0
21+
- uses: actions/setup-python@v2
22+
name: Setup Python
23+
- run: |
24+
pip3 install --no-cache-dir pre-commit
25+
pip3 install --no-cache-dir checkov
26+
curl -L "$(curl -s https://api.github.com/repos/terraform-docs/terraform-docs/releases/latest | grep -o -E -m 1 "https://.+?-linux-amd64.tar.gz")" > terraform-docs.tgz && tar -xzf terraform-docs.tgz terraform-docs && rm terraform-docs.tgz && chmod +x terraform-docs && sudo mv terraform-docs /usr/bin/
27+
curl -L "$(curl -s https://api.github.com/repos/tenable/terrascan/releases/latest | grep -o -E -m 1 "https://.+?_Linux_x86_64.tar.gz")" > terrascan.tar.gz && tar -xzf terrascan.tar.gz terrascan && rm terrascan.tar.gz && sudo mv terrascan /usr/bin/ && terrascan init
28+
curl -L "$(curl -s https://api.github.com/repos/terraform-linters/tflint/releases/latest | grep -o -E -m 1 "https://.+?_linux_amd64.zip")" > tflint.zip && unzip tflint.zip && rm tflint.zip && sudo mv tflint /usr/bin/
29+
curl -L "$(curl -s https://api.github.com/repos/aquasecurity/tfsec/releases/latest | grep -o -E -m 1 "https://.+?tfsec-linux-amd64")" > tfsec && chmod +x tfsec && sudo mv tfsec /usr/bin/
30+
sudo apt install -y jq && \
31+
curl -L "$(curl -s https://api.github.com/repos/minamijoyo/tfupdate/releases/latest | grep -o -E -m 1 "https://.+?_linux_amd64.tar.gz")" > tfupdate.tar.gz && tar -xzf tfupdate.tar.gz tfupdate && rm tfupdate.tar.gz && sudo mv tfupdate /usr/bin/
32+
curl -L "$(curl -s https://api.github.com/repos/minamijoyo/hcledit/releases/latest | grep -o -E -m 1 "https://.+?_linux_amd64.tar.gz")" > hcledit.tar.gz && tar -xzf hcledit.tar.gz hcledit && rm hcledit.tar.gz && sudo mv hcledit /usr/bin/
33+
name: Install prerequisites
34+
- uses: pre-commit/[email protected]
35+
name: Run pre-commit
36+
with:
37+
extra_args: --all-files
38+
checkov:
39+
runs-on: ubuntu-latest
40+
41+
steps:
42+
- uses: actions/checkout@v3
43+
with:
44+
fetch-depth: 0
45+
46+
- name: run checkov
47+
uses: bridgecrewio/checkov-action@master
48+
with:
49+
directory: .
50+
soft_fail: true
51+
framework: terraform
52+
53+
terraform:
54+
needs: checkov
55+
name: 'Terraform'
56+
runs-on: ubuntu-latest
57+
58+
steps:
59+
- name: Checkout
60+
uses: actions/checkout@v3
61+
62+
- name: Install Terraform
63+
env:
64+
TERRAFORM_VERSION: "1.1.7"
65+
run: |
66+
tf_version=$TERRAFORM_VERSION
67+
wget https://releases.hashicorp.com/terraform/"$tf_version"/terraform_"$tf_version"_linux_amd64.zip
68+
unzip terraform_"$tf_version"_linux_amd64.zip
69+
sudo mv terraform /usr/local/bin/
70+
71+
- name: Terraform Format
72+
run: terraform fmt
73+
74+
- name: Terraform Init
75+
run: terraform init
76+
77+
- name: Terraform Plan and validate
78+
run: |
79+
terraform plan -var target_id=["111111111111"] -var display_name="AWSAccountFactory" -var group_name="AWSAccountFactory" -var description="AWSAccountFactory" -var description_identity="AWSAccountFactory" -out tfplan
80+
terraform show -json tfplan | jq '.' > tfplan.json
81+
docker run --volume "${{ github.workspace }}:/tf" -w /tf bridgecrew/checkov -f tfplan.json --soft-fail

‎.gitignore

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
11
# Local .terraform directories
22
**/.terraform/*
3-
3+
.idea
44
# .tfstate files
55
*.tfstate
66
*.tfstate.*
7+
*.lock.*
78

89
# Crash log files
910
crash.log
@@ -27,3 +28,5 @@ override.tf.json
2728

2829
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
2930
# example: *tfplan*
31+
.terraform.lock.hcl
32+
TFDOC.md

‎.pre-commit-config.yaml

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
repos:
2+
- repo: https://github.com/commitizen-tools/commitizen
3+
rev: v2.39.1
4+
hooks:
5+
- id: commitizen
6+
stages:
7+
- commit-msg
8+
9+
- repo: https://github.com/antonbabenko/pre-commit-terraform
10+
rev: v1.77.0
11+
hooks:
12+
- id: terraform_fmt
13+
- id: terraform_validate
14+
args:
15+
- --args=-json
16+
- id: terraform_docs
17+
args:
18+
- --hook-config=--path-to-file=./TFDOC.md # Valid UNIX path. I.e. ../TFDOC.md or docs/README.md etc.
19+
- --hook-config=--add-to-exiting-file=true # Boolean. true or false
20+
- --hook-config=--create-file-if-not-exist=true # Boolean. true or false
21+
- id: terraform_tflint
22+
args:
23+
- --args=--enable-rule=terraform_documented_variables
24+
- id: terraform_checkov
25+
args:
26+
- --args=--quiet
27+
- --args=--compact
28+
- id: terraform_tfsec
29+
args:
30+
- >
31+
--args=--format json
32+
--no-color
33+
34+
- repo: https://github.com/pre-commit/pre-commit-hooks
35+
rev: v4.4.0 # Use the ref you want to point at
36+
hooks:
37+
- id: check-merge-conflict
38+
- id: trailing-whitespace
39+
args: [--markdown-linebreak-ext=md]
40+
- id: mixed-line-ending
41+
args: ['--fix=auto']
42+
- id: check-json
43+
- id: check-yaml
44+
45+
#With bridgecrew
46+
- repo: https://github.com/bridgecrewio/checkov.git
47+
rev: '2.2.299' # change to tag or sha
48+
hooks:
49+
- id: checkov
50+
verbose: true
51+
args: [
52+
"-d", ".",
53+
"--skip-check", "CKV2_GHA_1",
54+
]
55+
56+
- repo: https://github.com/pre-commit/pre-commit-hooks
57+
rev: v4.4.0
58+
hooks:
59+
- id: trailing-whitespace
60+
- id: end-of-file-fixer
61+
- id: check-yaml
62+
- id: check-added-large-files

‎README.md

Lines changed: 56 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,56 @@
1-
# terraform-aws-sso-permissions-set
2-
Terraform module for AWS SSO Permissions Set
1+
[![Run Pre-Commit](https://github.com/andresb39/aws_sso_permission_set/actions/workflows/pre-commit.yaml/badge.svg?branch=main)](https://github.com/andresb39/aws_sso_permission_set/actions/workflows/pre-commit.yaml)
2+
# Amazon SSO Permission set
3+
4+
This module create identity groups and attachment policies inlines/managed and associated this groups with the accounts
5+
6+
7+
<!-- BEGIN_TF_DOCS -->
8+
## Requirements
9+
10+
| Name | Version |
11+
|------|---------|
12+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
13+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.50.0 |
14+
15+
## Providers
16+
17+
| Name | Version |
18+
|------|---------|
19+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.50.0 |
20+
21+
## Modules
22+
23+
No modules.
24+
25+
## Resources
26+
27+
| Name | Type |
28+
|------|------|
29+
| [aws_identitystore_group.identitystore_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/identitystore_group) | resource |
30+
| [aws_ssoadmin_account_assignment.account_assignment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssoadmin_account_assignment) | resource |
31+
| [aws_ssoadmin_managed_policy_attachment.sso_policy_attachment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssoadmin_managed_policy_attachment) | resource |
32+
| [aws_ssoadmin_permission_set.sso_permission_set](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssoadmin_permission_set) | resource |
33+
| [aws_ssoadmin_permission_set_inline_policy.sso_inline_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssoadmin_permission_set_inline_policy) | resource |
34+
| [aws_identitystore_group.identitystore_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/identitystore_group) | data source |
35+
| [aws_ssoadmin_instances.sso](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssoadmin_instances) | data source |
36+
37+
## Inputs
38+
39+
| Name | Description | Type | Default | Required |
40+
|------|-------------|------|---------|:--------:|
41+
| <a name="input_description"></a> [description](#input\_description) | Permissions set group description | `string` | `""` | no |
42+
| <a name="input_description_identity"></a> [description\_identity](#input\_description\_identity) | (Optional) A string containing the description of the group. | `string` | `""` | no |
43+
| <a name="input_display_name"></a> [display\_name](#input\_display\_name) | (Optional) A string containing the name of the group. This value is commonly displayed when the group is referenced | `string` | `""` | no |
44+
| <a name="input_group_name"></a> [group\_name](#input\_group\_name) | Group name | `string` | `""` | no |
45+
| <a name="input_inline_policy"></a> [inline\_policy](#input\_inline\_policy) | Inline policies JSON to attach to SSO Permissions Set | `string` | `""` | no |
46+
| <a name="input_policy_attachment"></a> [policy\_attachment](#input\_policy\_attachment) | ARN of the policy attachment | `list(string)` | `[]` | no |
47+
| <a name="input_session_duration"></a> [session\_duration](#input\_session\_duration) | The length of time that the application user sessions are valid in the ISO-8601 standard. Default: PT1H | `string` | `"PT2H"` | no |
48+
| <a name="input_tags"></a> [tags](#input\_tags) | A map of tags to add to all resources. | `map(string)` | `{}` | no |
49+
| <a name="input_target_id"></a> [target\_id](#input\_target\_id) | (Required, Forces new resource) An AWS account identifier, typically a 10-12 digit string. | `string` | n/a | yes |
50+
51+
## Outputs
52+
53+
| Name | Description |
54+
|------|-------------|
55+
| <a name="output_group_id"></a> [group\_id](#output\_group\_id) | Group ID |
56+
<!-- END_TF_DOCS -->

‎data.tf

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
data "aws_ssoadmin_instances" "sso" {}
2+
3+
data "aws_identitystore_group" "identitystore_group" {
4+
identity_store_id = tolist(data.aws_ssoadmin_instances.sso.identity_store_ids)[0]
5+
alternate_identifier {
6+
unique_attribute {
7+
attribute_path = "DisplayName"
8+
attribute_value = var.display_name
9+
}
10+
}
11+
depends_on = [aws_ssoadmin_permission_set.sso_permission_set]
12+
}

‎main.tf

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
resource "aws_ssoadmin_permission_set" "sso_permission_set" {
2+
name = var.group_name
3+
instance_arn = tolist(data.aws_ssoadmin_instances.sso.arns)[0]
4+
description = var.description
5+
session_duration = var.session_duration
6+
tags = var.tags
7+
}
8+
resource "aws_ssoadmin_managed_policy_attachment" "sso_policy_attachment" {
9+
count = length(var.policy_attachment)
10+
instance_arn = aws_ssoadmin_permission_set.sso_permission_set.instance_arn
11+
managed_policy_arn = var.policy_attachment[count.index]
12+
permission_set_arn = aws_ssoadmin_permission_set.sso_permission_set.arn
13+
}
14+
resource "aws_ssoadmin_permission_set_inline_policy" "sso_inline_policy" {
15+
count = length(var.inline_policy) > 0 ? 1 : 0
16+
inline_policy = var.inline_policy
17+
instance_arn = aws_ssoadmin_permission_set.sso_permission_set.instance_arn
18+
permission_set_arn = aws_ssoadmin_permission_set.sso_permission_set.arn
19+
}
20+
21+
resource "aws_identitystore_group" "identitystore_group" {
22+
display_name = var.display_name
23+
description = var.description_identity
24+
identity_store_id = tolist(data.aws_ssoadmin_instances.sso.identity_store_ids)[0]
25+
}
26+
27+
resource "aws_ssoadmin_account_assignment" "account_assignment" {
28+
for_each = length(var.target_id) > 0 ? toset(var.target_id) : []
29+
instance_arn = aws_ssoadmin_permission_set.sso_permission_set.instance_arn
30+
permission_set_arn = aws_ssoadmin_permission_set.sso_permission_set.arn
31+
principal_id = data.aws_identitystore_group.identitystore_group.group_id
32+
principal_type = "GROUP"
33+
target_id = each.value
34+
target_type = "AWS_ACCOUNT"
35+
}

‎output.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
output "group_id" {
2+
value = data.aws_identitystore_group.identitystore_group.group_id
3+
description = "Group ID"
4+
}

‎provider.tf

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
provider "aws" {
2+
region = "us-east-1"
3+
}
4+
terraform {
5+
required_version = ">= 1.0"
6+
required_providers {
7+
aws = ">= 4.50.0"
8+
}
9+
}

‎variables.tf

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
variable "group_name" {
2+
description = "Group name"
3+
type = string
4+
default = ""
5+
}
6+
7+
variable "description" {
8+
description = "Permissions set group description"
9+
type = string
10+
default = ""
11+
}
12+
13+
variable "session_duration" {
14+
description = "The length of time that the application user sessions are valid in the ISO-8601 standard. Default: PT1H"
15+
type = string
16+
default = "PT2H"
17+
}
18+
19+
variable "policy_attachment" {
20+
description = "ARN of the policy attachment"
21+
type = list(string)
22+
default = []
23+
}
24+
25+
variable "inline_policy" {
26+
description = "Inline policies JSON to attach to SSO Permissions Set"
27+
type = string
28+
default = ""
29+
}
30+
31+
#=== Identity Groups ===#
32+
variable "display_name" {
33+
description = "(Optional) A string containing the name of the group. This value is commonly displayed when the group is referenced"
34+
type = string
35+
default = ""
36+
}
37+
38+
variable "description_identity" {
39+
description = "(Optional) A string containing the description of the group."
40+
type = string
41+
default = ""
42+
}
43+
44+
#=== Account assignment ===#
45+
variable "target_id" {
46+
description = "(Required, Forces new resource) An AWS account identifier, typically a 10-12 digit string."
47+
type = list(string)
48+
}
49+
50+
// Tags
51+
variable "tags" {
52+
description = "A map of tags to add to all resources."
53+
type = map(string)
54+
default = {}
55+
}

0 commit comments

Comments
 (0)