README.md

Browse the Repo

.circleci

.github

.patcher

_ci

_docs

codegen

examples

modules

_deprecated

auto-update

aws-auth

aws-config-bucket

aws-config-multi-region

aws-config-rules

aws-config

aws-organizations

cloudtrail-bucket

cloudtrail

cross-account-iam-roles

custom-iam-entity

ebs-encryption-multi-region

ebs-encryption

fail2ban

github-actions-iam-role

guardduty-multi-region

guardduty

iam-access-analyzer-multi-region

iam-groups

iam-policies

iam-user-password-policy

iam-users

README.md

main.tf

outputs.tf

variables.tf

ip-lockdown

kms-cmk-replica

kms-grant-multi-region

kms-master-key-multi-region

kms-master-key

ntp

os-hardening

private-s3-bucket

saml-iam-roles

secrets-manager-resource-policies

ssh-grunt-selinux-policy

ssh-grunt

ssh-iam

ssm-healthchecks-iam-permissions

tls-cert-private

test

.editorconfig

.gitignore

.pre-commit-config.yaml

CODEOWNERS

LICENSE.txt

README.adoc

terraform-cloud-enterprise-private-module-...

Browse the Repo

.circleci

.github

.patcher

_ci

_docs

codegen

examples

modules

_deprecated

auto-update

aws-auth

aws-config-bucket

aws-config-multi-region

aws-config-rules

aws-config

aws-organizations

cloudtrail-bucket

cloudtrail

cross-account-iam-roles

custom-iam-entity

ebs-encryption-multi-region

ebs-encryption

fail2ban

github-actions-iam-role

guardduty-multi-region

guardduty

iam-access-analyzer-multi-region

iam-groups

iam-policies

iam-user-password-policy

iam-users

README.md

main.tf

outputs.tf

variables.tf

ip-lockdown

kms-cmk-replica

kms-grant-multi-region

kms-master-key-multi-region

kms-master-key

ntp

os-hardening

private-s3-bucket

saml-iam-roles

secrets-manager-resource-policies

ssh-grunt-selinux-policy

ssh-grunt

ssh-iam

ssm-healthchecks-iam-permissions

tls-cert-private

test

.editorconfig

.gitignore

.pre-commit-config.yaml

CODEOWNERS

LICENSE.txt

README.adoc

terraform-cloud-enterprise-private-module-...

IAM Users

Create and manage IAM users, IAM groups, IAM roles, and IAM policies as code.

IAM Users

This is a Terraform module you can use to create and manage IAM users as code.

How do you use this module?

This module allows you to pass in a map of users to create, where the keys in the map are the user names, and the values are properties for that IAM user (all optional). For documentation on the supported properties see variables.tf.

Check out the iam-users example for working sample code.

How do you generate passwords and access keys with this module?

This module can optionally create a password for AWS Web Console access and/or access keys for programmatic access for each IAM user if you set create_login_profile and/or create_access_keys to true for that IAM user, respectively.

To avoid having these secrets stored in plain text in Terraform state, this module will only generate the password or access keys if you specify the pgp_key param for that user. This param can contain either the base-64 encoded PGP public key for that user or the user's Keybase username in the format keybase:<USERNAME>.

We recommend using Keybase, as it makes it easier to manage PGP keys. Have each user at your company:

Install the Keybase app.
Claim a Keybase username.
Use the Keybase app to create a PGP key and add it to their profile.
Send you their username.

Once you have their user name, set pgp_key = "keybase:<USERNAME>" and create_login_profile and/or create_access_keys to true for that user, and this module will generate the password and/or access keys, and export them in the output variables user_passwords and user_access_keys. The output will look something like this:

user_access_keys = {
  "alice" = {
    "access_key_id" = "AKIARIUU2OIYE2APGOYK"
    "secret_access_key" = "wcBMA7E6Kn/t1YPfAQgAjLvUWUES/GeLHr/=="
  }
}
user_passwords = {
  "bob" = "wcBMA7E6Kn/t1YPfAQgAdByWFftehuD3uw="
}

You can see that Alice's secret_access_key and Bob's password are encrypted, so you can safely mail those credentials to each user.

How do I use PGP keys directly?

The module also supports using PGP keys directly, without keybase. To use a raw PGP key, export the public key in binary format and base64 encode it:

# Set KEYID to the ID of the PGP key you would like to use for encrypting
gpg --export $KEYID | base64

You can then set the pgp_key field to the resulting string.

How do you decrypt the generated passwords and access keys?

To decrypt a user's password or access keys, that user can decrypt them on the command-line as follows:

echo "<SECRET>" | base64 --decode | keybase pgp decrypt

Note that this only works if the user has the private key for their PGP key on their local computer (which they will if they used the Keybase app to create the PGP key in the first place).

If you used a raw PGP key, you can use the following command instead:

# Set KEYID to the ID of the PGP key you used for encrypting
echo "<SECRET>" | base64 --decode | gpg -d $KEYID

How do you delete users?

Under the hood, this module uses the aws_iam_user resource, which only allows you to delete an IAM user by doing the following multi-step process:

Set the force_destroy parameter to true on that user. Example:

module "iam_users" {
  source = "git::git@github.com:gruntwork-io/terraform-aws-security.git//modules/iam-users?ref=v0.53.2"

  users = {
    # Set force_destroy to true on the user you want to delete
    "example-user-to-delete" = {
      force_destroy = true
    }
    
    "some-other-user"  = {}
    "yet-another-user" = {}
  }
}

Run apply.

Remove the user you wish to delete from the users input variable. Following on the previous example:

module "iam_users" {
  source = "git::git@github.com:gruntwork-io/terraform-aws-security.git//modules/iam-users?ref=v0.53.2"

  users = {
    # Note that example-user-to-delete has been removed
    
    "some-other-user"  = {}
    "yet-another-user" = {}
  }
}

Run apply again.

Questions? Ask away.

We're here to talk about our services, answer any questions, give advice, or just to chat.

Ready to hand off the Gruntwork?

Buy Now

"https://cdn.gruntwork.io/gruntwork-website/"

{"index":{"js":"https://cdn.gruntwork.io/gruntwork-website/index.bundle.c7884255553b53fbca3a.js","map":"https://cdn.gruntwork.io/gruntwork-website/index.bundle.1b14c1b7d19f1f5eb35d6e118e838255.map"},"styles":{"css":"https://cdn.gruntwork.io/gruntwork-website/styles.bundle.f22938926651ddec7c49.css","js":"https://cdn.gruntwork.io/gruntwork-website/styles.bundle.e782420e74a20dcb8691.js","map":"https://cdn.gruntwork.io/gruntwork-website/styles.bundle.d5e2af49807c6ca33f8367d621ece507.map"},"vendors":{"css":"https://cdn.gruntwork.io/gruntwork-website/vendors.bundle.29f7d0366a0978763f96.css","js":"https://cdn.gruntwork.io/gruntwork-website/vendors.bundle.fa8174a130797d75d12c.js","map":"https://cdn.gruntwork.io/gruntwork-website/vendors.bundle.57243d94deeeb29d5061288a338b4eb6.map"}}

IAM Users

Code Preview

Preview the Code

IAM Users

How do you use this module?

How do you generate passwords and access keys with this module?

How do I use PGP keys directly?

How do you decrypt the generated passwords and access keys?

How do you delete users?

Questions? Ask away.

Ready to hand off the Gruntwork?