added terrafrom configs

000000000000/iam/roles/data.tf

@@ -0,0 +1,37 @@
+data "template_file" "policy_a" {
+  template = file("../../templates/role_a_policy.tpl")
+}
+
+data "template_file" "asume_role_policy" {
+  template = file("../../templates/asume_role_policy.tpl")
+  vars = {
+    prod_account_id = var.prod_account_id
+  }
+}
+
+data "template_file" "asume_role" {
+  template = file("../../templates/assume_role.tpl")
+}
+
+
+data "terraform_remote_state" "group_2" {
+  backend = "s3"
+
+  config = {
+    bucket  = "mytesting-tf-states"
+    profile = "terra"
+    region  = "eu-west-1"
+    key     = "000000000000/iam/users_and_groups/normal_users/terraform.tfstate"
+  }
+}
+
+data "terraform_remote_state" "group_1" {
+  backend = "s3"
+
+  config = {
+    bucket  = "mytesting-tf-states"
+    profile = "terra"
+    region  = "eu-west-1"
+    key     = "000000000000/iam/users_and_groups/cli_users/terraform.tfstate"
+  }
+}

000000000000/iam/roles/main.tf

@@ -0,0 +1,72 @@
+terraform {
+  backend "s3" {
+    profile = "terra"
+    bucket  = "mytesting-tf-states"
+    key     = "000000000000/iam/roles/terraform.tfstate"
+    region  = "eu-west-1"
+  }
+}
+
+##########################
+###"A" policy and role 
+##########################
+
+resource "aws_iam_policy" "role_a_policy" {
+  name        = "role_a_policy"
+  path        = "/service-role/"
+  description = "role_a_policy"
+
+  policy = data.template_file.policy_a.rendered
+}
+
+resource "aws_iam_role" "role_a" {
+  name = "role_a"
+
+  assume_role_policy  = data.template_file.asume_role.rendered
+  managed_policy_arns = [aws_iam_policy.role_a_policy.arn]
+}
+
+##########################
+###"B" policy and role 
+##########################
+
+resource "aws_iam_policy" "role_b_policy" {
+  name        = "role_b_policy"
+  path        = "/service-role/"
+  description = ""
+  policy      = data.template_file.asume_role_policy.rendered
+}
+
+
+resource "aws_iam_role" "role_b" {
+  name = "role_b"
+
+  assume_role_policy  = data.template_file.asume_role.rendered
+  managed_policy_arns = [aws_iam_policy.role_b_policy.arn]
+}
+
+#######################################
+### Creating Ec2 instance role for "B" 
+#######################################
+
+resource "aws_iam_instance_profile" "test_profile" {
+  name = "s3_profile"
+  role = aws_iam_role.role_b.name
+}
+
+####################################################
+### Attach "A" role policy to group 1 just for test
+####################################################
+
+resource "aws_iam_group_policy_attachment" "group_1" {
+  group      = data.terraform_remote_state.group_1.outputs.user_group_1_name
+  policy_arn = aws_iam_policy.role_a_policy.arn
+  depends_on = [aws_iam_policy.role_a_policy]
+}
+
+resource "aws_iam_group_policy_attachment" "group_2_role" {
+  group      = data.terraform_remote_state.group_2.outputs.user_group_2_name
+  policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess"
+  depends_on = [aws_iam_policy.role_a_policy]
+}
+

000000000000/iam/roles/provider.tf

@@ -0,0 +1,4 @@
+provider "aws" {
+  region  = var.region
+  profile = "terra"
+} 

000000000000/iam/roles/variables.tf

@@ -0,0 +1,9 @@
+variable "region" {
+  type    = string
+  default = "eu-west-1"
+}
+
+variable "prod_account_id" {
+  type    = string
+  default = "184100688147"
+}

000000000000/iam/users_and_groups/cli_users/main.tf

@@ -0,0 +1,50 @@
+terraform {
+  backend "s3" {
+    profile = "terra"
+    bucket  = "mytesting-tf-states"
+    key     = "000000000000/iam/users_and_groups/cli_users/terraform.tfstate"
+    region  = "eu-west-1"
+  }
+}
+
+locals {
+  cli_users = {
+    "ci" = {
+      name  = "ci"
+      email = "ci@home.co"
+    },
+    "engine" = {
+      name  = "engine"
+      email = "ci@home.co"
+    }
+  }
+}
+
+#######################################
+### creating group 1 and service users
+#######################################
+
+resource "aws_iam_group" "group_1" {
+  name = var.group_name
+}
+
+resource "aws_iam_user" "cli_users" {
+  for_each = local.cli_users
+
+  name          = each.key
+  force_destroy = false
+}
+
+resource "aws_iam_access_key" "user_access_key" {
+  for_each   = local.cli_users
+  user       = each.key
+  depends_on = [aws_iam_user.cli_users]
+}
+
+resource "aws_iam_group_membership" "group_1" {
+  for_each = local.cli_users
+  name     = aws_iam_group.group_1.name
+
+  users = [each.key]
+  group = aws_iam_group.group_1.name
+}

000000000000/iam/users_and_groups/cli_users/outputs.tf

@@ -0,0 +1,13 @@
+output "user_access_keys" {
+  value = {
+    for k, v in local.cli_users : k => {
+      "key"    = aws_iam_access_key.user_access_key[k].id
+      "secret" = aws_iam_access_key.user_access_key[k].secret
+    }
+  }
+  sensitive = true
+}
+
+output "user_group_1_name" {
+  value = aws_iam_group.group_1.name
+}

000000000000/iam/users_and_groups/cli_users/provider.tf

@@ -0,0 +1,4 @@
+provider "aws" {
+  region  = var.region
+  profile = "terra"
+} 

000000000000/iam/users_and_groups/cli_users/variables.tf

@@ -0,0 +1,9 @@
+variable "region" {
+  type    = string
+  default = "eu-west-1"
+}
+
+variable "group_name" {
+  type    = string
+  default = "group_1"
+}

000000000000/iam/users_and_groups/normal_users/main.tf

@@ -0,0 +1,60 @@
+terraform {
+  backend "s3" {
+    profile = "terra"
+    bucket  = "mytesting-tf-states"
+    key     = "000000000000/iam/users_and_groups/normal_users/terraform.tfstate"
+    region  = "eu-west-1"
+  }
+}
+
+
+locals {
+  normal_users = {
+    "Denys_Platon" = {
+      name  = "denys_platon"
+      email = "denys_platon@work.co"
+    },
+    "ivan_petrenko" = {
+      name  = "ivan_petrenko"
+      email = "ivan_petrenko@work.co"
+    }
+  }
+}
+
+#######################################
+### creating group 2 and normal users
+#######################################
+
+resource "aws_iam_group" "group_2" {
+  name = "group_2"
+}
+
+resource "aws_iam_user" "normal_users" {
+  for_each = local.normal_users
+
+  name          = each.key
+  force_destroy = false
+}
+
+resource "aws_iam_access_key" "user_access_key" {
+  for_each   = local.normal_users
+  user       = each.key
+  depends_on = [aws_iam_user.normal_users]
+}
+
+resource "aws_iam_user_login_profile" "normal_user" {
+  for_each = local.normal_users
+  user     = each.key
+  #  password_reset_required = true    
+
+  depends_on = [aws_iam_user.normal_users]
+}
+
+resource "aws_iam_group_membership" "group_2" {
+  for_each = local.normal_users
+  name     = aws_iam_group.group_2.name
+
+  users      = [each.key]
+  group      = aws_iam_group.group_2.name
+  depends_on = [aws_iam_user_login_profile.normal_user]
+}

000000000000/iam/users_and_groups/normal_users/outputs.tf

@@ -0,0 +1,11 @@
+output "password" {
+  value = {
+    for k, v in local.normal_users : k => {
+      "password" = aws_iam_user_login_profile.normal_user[k].password
+    }
+  }
+}
+
+output "user_group_2_name" {
+  value = aws_iam_group.group_2.name
+}

000000000000/iam/users_and_groups/normal_users/provider.tf

@@ -0,0 +1,4 @@
+provider "aws" {
+  region  = var.region
+  profile = "terra"
+} 

000000000000/iam/users_and_groups/normal_users/variables.tf

@@ -0,0 +1,7 @@
+variable "region" {
+  default = "eu-west-1"
+}
+
+variable "group_name" {
+  default = "group_2"
+}