Browse the Repo

file-type-icon.circleci
file-type-icon_ci
file-type-icon_docs
file-type-iconcodegen
file-type-iconexamples
file-type-iconaccount-baseline-app
file-type-iconaccount-baseline-root
file-type-iconaccount-baseline-security
file-type-iconauto-update
file-type-iconaws-config-multi-region
file-type-iconaws-config
file-type-iconaws-organizations-config-rules
file-type-iconaws-organizations
file-type-iconcloudtrail
file-type-iconcross-account-iam-roles
file-type-iconcustom-iam-entity
file-type-iconfail2ban
file-type-iconguardduty
file-type-iconiam-groups
file-type-iconiam-user-password-policy
file-type-iconiam-users
file-type-iconip-lockdown
file-type-iconkms-master-key-multi-region
file-type-iconkms-master-key
file-type-iconntp
file-type-iconos-hardening
file-type-iconsaml-iam-roles
file-type-iconREADME.md
file-type-iconmain.tf
file-type-iconoutputs.tf
file-type-iconsaml-metadata.xml
file-type-iconvars.tf
file-type-iconssh-grunt
file-type-iconssm-healthchecks-iam-permissions
file-type-iconmodules
file-type-icontest
file-type-icon.editorconfig
file-type-icon.gitignore
file-type-icon.pre-commit-config.yaml
file-type-iconCODEOWNERS
file-type-iconLICENSE.txt
file-type-iconREADME.adoc

Browse the Repo

file-type-icon.circleci
file-type-icon_ci
file-type-icon_docs
file-type-iconcodegen
file-type-iconexamples
file-type-iconaccount-baseline-app
file-type-iconaccount-baseline-root
file-type-iconaccount-baseline-security
file-type-iconauto-update
file-type-iconaws-config-multi-region
file-type-iconaws-config
file-type-iconaws-organizations-config-rules
file-type-iconaws-organizations
file-type-iconcloudtrail
file-type-iconcross-account-iam-roles
file-type-iconcustom-iam-entity
file-type-iconfail2ban
file-type-iconguardduty
file-type-iconiam-groups
file-type-iconiam-user-password-policy
file-type-iconiam-users
file-type-iconip-lockdown
file-type-iconkms-master-key-multi-region
file-type-iconkms-master-key
file-type-iconntp
file-type-iconos-hardening
file-type-iconsaml-iam-roles
file-type-iconREADME.md
file-type-iconmain.tf
file-type-iconoutputs.tf
file-type-iconsaml-metadata.xml
file-type-iconvars.tf
file-type-iconssh-grunt
file-type-iconssm-healthchecks-iam-permissions
file-type-iconmodules
file-type-icontest
file-type-icon.editorconfig
file-type-icon.gitignore
file-type-icon.pre-commit-config.yaml
file-type-iconCODEOWNERS
file-type-iconLICENSE.txt
file-type-iconREADME.adoc
ssh-grunt

ssh-grunt

Manage SSH access to EC2 Instances using groups in AWS IAM or your Identity Provider (e.g., ADFS, Google, Okta, etc).

Code Preview

Preview the Code

mobile file icon

README.md

down

SAML IAM roles example

This is an example of how to use the saml-iam-roles module to create IAM Roles that users authenticated by a SAML Identity Provider (IdP) can assume to get access to this AWS account.

The saml-iam-roles module creates multiple IAM Roles as described in the Resources Created section of the module README. For example, a SAML-authenticated user might assume the allow-full-access-from-saml IAM Role, which grants full access to a given AWS account, or the allow-iam-admin-access-from-saml IAM Role, which grants iam:* access (the ability to manage IAM), or the allow-read-only-access-from-saml IAM Role, which grants read-only access to an AWS account. Ultimately, it will be up to the SAML IdP to assert which users can assume which IAM Roles in which AWS accounts.

Quick start

To try these templates out you must have Terraform installed:

  1. Open vars.tf, specify the environment variables mentioned at the top of the file, and fill in any variables that don't have a default.
  2. Download SAML 2.0 Metadata from your IdP and copy its contents to saml-metadata.xml.
  3. Run terraform init to instruct Terraform to perform initialization steps.
  4. Run terraform apply to create the IAM Roles.
  5. This module will output the ARNs of these IAM Roles.

Questions? Ask away.

We're here to talk about our services, answer any questions, give advice, or just to chat.

Ready to hand off the Gruntwork?