Manage IAM Assume Role creation using Terraform

Question

Problem Statement:

I want to create and manage assume IAM Assume roles for multiple AWS accounts using Terraform.

Goal to achieve

Creation of IAM Assume Roles in all the AWS accounts using Terraform module

Background

The IAM roles will exist in each account, and every account will have a different number of Assume roles given it is going to use by different teams with different size. Access to the account will be granted via a Jump AWS account from where a user will authenticate and then use Assume Role URL to switch accounts.

For, eg.

Account A  has two IAM roles: admin_role and developer_role
Account B has three IAM roles: admin_role, poweruser_role and developer_role
Account C is a jump account, and it also has admin_role, poweruser_role and developer_role  IAM role

User A log into Account C(with poweruser_role attached to them user) then assumes to Account B(this account has a trust relationship with Account C) using the same poweruser_role.

What would a proper Terraform IAM solution for this Multi Account Infrastructure setup?

This solution states how to have unique IAM roles for all the accounts but does not show how to handle when AWS roles are different for each account.

Thanks in advance.

jackops jackops · Accepted Answer · 2020-01-31T22:00:29

Usually, it is a good practice to create an AWS organization. The organisation contains: - infosec account (in which you create the users), - master billing account (for aggregate billing) - Then, you create one account per environment (e.g., staging, production ,dev) and establish trust relationships between them. By doing this, you achieve maximum flexibility. In fact, you can create different groups for different accounts and assign individual users one or more group.

Example:

CTO is part of master billing group, staging admin and production admin
Internal developer is part of staging and production admin
External consultant is part of staging admin

Some reference: https://www.liatrio.com/blog/secure-aws-account-structure-with-terraform-and-terragrunt Corresponding github project: https://github.com/liatrio/aws-accounts-terraform

Manage IAM Assume Role creation using Terraform

1 Answers