Skip to content

Terraform module that creates an IAM Role in a new account (useful for bootstrapping)

License

Notifications You must be signed in to change notification settings

plus3it/terraform-aws-org-new-account-iam-role

Repository files navigation

terraform-aws-org-new-account-iam-role

A Terraform module to bootstrap the creation of an IAM Role in an AWS Account when new accounts are created within AWS Organizations.

This module creates a new IAM role, attaches an AWS-managed permission policy, and sets the trust policy to the provided JSON-formatted string.

This module uses CloudWatch Events to identify when new accounts are added or invited to an AWS Organization, and triggers a Lambda function to create the IAM role.

Testing

To set up and run tests:

# Ensure the dependencies are installed on your system.
make python/deps
make pytest/deps

# Start up a mock AWS stack:
make mockstack/up

# Run unit tests:
make docker/run target=pytest/lambda/tests

# Run tests against the Terraform configuration:
make mockstack/pytest/lambda

# Shut down the mock AWS stack and clean up the docker image:
make mockstack/clean

Requirements

Name Version
terraform >= 1.3
aws >= 4.9
external >= 1.0
local >= 1.0
null >= 2.0
random >= 3.0

Providers

Name Version
aws >= 4.9
random >= 3.0

Resources

Name Type
aws_iam_policy_document.lambda data source
aws_partition.current data source

Inputs

Name Description Type Default Required
assume_role_name Name of IAM role to assume the target account (case sensitive) string n/a yes
role_name Name of the IAM role to create in the target account (case sensitive) string n/a yes
role_permission_policy AWS-managed permission policy name to attach to the role (case sensitive) string n/a yes
trust_policy_json JSON-formatted string containing the role trust policy string n/a yes
event_types Event types that will trigger this lambda set(string)
[
"CreateAccountResult",
"InviteAccountToOrganization"
]
no
lambda Map of any additional arguments for the upstream lambda module. See https://github.com/terraform-aws-modules/terraform-aws-lambda
object({
artifacts_dir = optional(string, "builds")
create_package = optional(bool, true)
ephemeral_storage_size = optional(number)
ignore_source_code_hash = optional(bool, true)
local_existing_package = optional(string)
recreate_missing_package = optional(bool, false)
runtime = optional(string, "python3.11")
s3_bucket = optional(string)
s3_existing_package = optional(map(string))
s3_prefix = optional(string)
store_on_s3 = optional(bool, false)
})
{} no
log_level Log level of the lambda output, one of: debug, info, warning, error, critical string "info" no
tags Tags that are passed to resources map(string) {} no

Outputs

Name Description
aws_cloudwatch_event_rule The cloudwatch event rule object
aws_cloudwatch_event_target The cloudWatch event target object
aws_lambda_permission_events The lambda permission object for cloudwatch event triggers
lambda The lambda module object