User Management

Configures IAM users, groups and roles in three groups: Admin, Basic, and Alumni

• Alumni: Administrator access
• Basic: Change Password and Manage Self Identity
• Alumni: Deny All access

Users of this module should ensure that each set of users is an exclusive group.

Usage

module "user_management" {
  source = "dod-iac/user-management/aws"

  admin_users = {
    "Admin User" = {
      Name  = "Admin User"
      Email = "[email protected]"
    }
  }
  basic_users = {
    "Basic User" = {
      Name  = "Basic User"
      Email = "[email protected]"
    }
  }
  alumni_users = {
    "Alumni User" = {
      Name  = "Alumni User"
      Email = "[email protected]"
    }
  }
}

Terraform Version

Terraform 0.13. Pin module version to ~> 1.0.0 . Submit pull-requests to main branch.

Terraform 0.11 and 0.12 are not supported.

License

This project constitutes a work of the United States Government and is not subject to domestic copyright protection under 17 USC § 105. However, because the project utilizes code licensed from contributors and other third parties, it therefore is licensed under the MIT License. See LICENSE file for more information.

Requirements

Name	Version
terraform	>= 0.13
aws	~> 3.0

Providers

Name	Version
aws	~> 3.0

Modules

No modules.

Resources

Name	Type
aws_iam_group.admin	resource
aws_iam_group.alumni	resource
aws_iam_group.basic	resource
aws_iam_group_policy_attachment.admin_administrator	resource
aws_iam_group_policy_attachment.alumni_deny_all	resource
aws_iam_group_policy_attachment.basic_change_passwd	resource
aws_iam_policy.deny_all	resource
aws_iam_role.admin	resource
aws_iam_role_policy_attachment.admin_administrator	resource
aws_iam_user.user	resource
aws_iam_user_group_membership.user	resource
aws_caller_identity.current	data source
aws_iam_policy_document.assume_role_policy	data source
aws_iam_policy_document.deny_all	data source
aws_partition.current	data source

Inputs

Name	Description	Type	Default	Required
admin_group_name	Name of the Admin Group	string	"admin"	no
admin_users	Set of Admin IAM Users with tags.	map(any)	{}	no
alumni_group_name	Name of the Alumni Group	string	"alumni"	no
alumni_users	Set of Alumni IAM Users with tags.	map(any)	{}	no
basic_group_name	Name of the Basic Group	string	"basic"	no
basic_users	Set of Basic IAM Users with tags.	map(any)	{}	no
tags	Tags for resources	map(string)	{}	no

Outputs

Name	Description
admin_group	Admin Group
admin_role	Admin Role
alumni_group	Alumni Group
basic_group	Basic Group
users	Users