cloudhealth / terraform-cloudhealth-iam Goto Github PK

View Code? Open in Web Editor NEW

26.0 105.0 28.0 46 KB

CloudHealth Terraform module for IAM Roles provisioning

Home Page: https://www.cloudhealthtech.com

License: MIT License

HCL 100.00%

terraform-cloudhealth-iam's Introduction

CloudHealth Technologies Terraform module for CloudHealth IAM Role AWS account provisioning.

This module manages installation of CloudHealth IAM Role in your AWS account.

Inputs

Variable	Type	Description
`external-id`	String	IAM Role External ID assigned in CloudHealth platform
`s3-billing-bucket`	String	S3 bucket location for consolidated accounts billing data (optional)
`s3-cur-bucket`	String	S3 bucket location for consolidated accounts cost and usage data (optional)
`s3-cloudtrail-bucket`	String	S3 bucket location for Cloudtrail data (optional)
`s3-config-bucket`	String	S3 bucket location for AWS Config data (optional)
`s3-ecs-bucket`	String	S3 bucket location for Elastic Container Service event stream data (optional)
`automated-ri-modification-enabled`	Boolean	Additional permissions for enabling automated RI modification (default: false)
`automated-actions-enabled`	Boolean	Additional permissions for enabling automated actions (default: false)
`additional-policy`	String	Additional policy to associate with IAM Role (optional)

Outputs

Variable	Type	Description
`cloudhealth-role-arn`	String	IAM Role ARN created by the module
`external-id`	String	IAM Role External ID assigned in CloudHealth platform
`cloudhealth-policy-arn`	String	IAM Policy ARN created by the module

Usage

Obtain your External ID from the CloudHealth platform under new AWS account setup page.

Define invocation of TF module

module "cloudhealth-iam-role" {
    source  = "github.com/CloudHealth/terraform-cloudhealth-iam/role"
    external-id = "1234567890abcdefg"
    s3-billing-bucket = "billing-bucket"
    s3-cloudtrail-bucket = "cloudtrail-bucket"
    automated-ri-modification-enabled = true
    automated-actions-enabled = true
    additional-policy = <<POLICY
{
   "Action": [
     "ec2:CreateTags"
   ],
   "Effect": "Allow",
   "Resource": "*"
}
POLICY
}

NOTE: You can pin a specific Git tagged version of this module using this notation. Here we're pinning to the tag, 0.0.16:

    source  = "git::https://github.com/CloudHealth/terraform-cloudhealth-iam.git//role?ref=tags/0.0.16"

Run terraform plan and apply

terraform plan -target=module.cloudhealth-iam-role
terraform apply -target=module.cloudhealth-iam-role

Get created ARN and External ID to use in CHT portal

terraform output -module=cloudhealth-iam-role

Requirements

terraform-cloudhealth-iam >= v0.1.0 - Requires Terraform >= 0.12
terraform-cloudhealth-iam <= v0.0.18 - Requires Terraform <= 0.11

License and Authors

Authors: CloudHealth Team GSD ([email protected])

terraform-cloudhealth-iam's People

Contributors

Stargazers

Watchers

terraform-cloudhealth-iam's Issues

Terraform variable syntax change

Receiving this warning on role.tf line 87 where name = "${var.role-name}" but should be name = var.role-name per new HCL Terraform 12 syntax.

Warning: Interpolation-only expressions are deprecated

  on .terraform/modules/cloudhealth-iam-role/role/role.tf line 89, in resource "aws_iam_role" "cht_iam_role":
  89:   name = "${var.role-name}"

Please fix IAM policy

Hello guys

We are getting AWS IAM warning because of CloudHealth in our environment.

Take a look at this screenshot:

Affected file: role/inputs.tf
Line to address: "aws-portal:ViewBilling",

Terraform v0.12.7 unsupported block type

When attempting to run my terraform apply, I'm running into unsupported block type issues. I also experienced the issues described in the following PR and was able to make the manual modifications to put POLICY on a new line, which did get me past that initial hurdle.

#21

Here's the logs:

terraform apply

Error: Unsupported block type

on .terraform/modules/cloudhealth-iam-role/role/role.tf line 15, in data "template_file" "default-s3-billing-bucket-policy":
15: vars {