You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -31,7 +32,6 @@ Terraform Module to provision a basic IAM user suitable for humans. It will esta
31
32
32
33
We do not recommend creating IAM users for any other purpose. For external systems (e.g. CI/CD) check out our [`terraform-aws-iam-system-user`](https://github.com/cloudposse/terraform-aws-iam-system-user) module.
33
34
34
-
35
35
---
36
36
37
37
This project is part of our comprehensive ["SweetOps"](https://cpco.io/sweetops) approach towards DevOps.
@@ -62,7 +62,6 @@ We literally have [*hundreds of terraform modules*][terraform_modules] that are
Security scanning is graciously provided by Bridgecrew. Bridgecrew is the leading fully hosted, cloud-native solution providing continuous Terraform security and compliance.
@@ -107,6 +106,7 @@ module "jack" {
107
106
# Cloud Posse recommends pinning every module to a specific version
108
107
# version = "x.x.x"
109
108
name = "jack"
109
+
user_name = "jack@companyname.com"
110
110
pgp_key = "keybase:jack"
111
111
groups = ["admins"]
112
112
}
@@ -124,6 +124,7 @@ module "jill" {
124
124
# Cloud Posse recommends pinning every module to a specific version
|[template_file.keybase_password_decrypt_command](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file)| data source |
178
+
|[template_file.keybase_password_pgp_message](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file)| data source |
162
179
163
180
## Inputs
164
181
165
182
| Name | Description | Type | Default | Required |
| additional\_tag\_map | Additional tags for appending to tags\_as\_list\_of\_maps. Not added to `tags`. |`map(string)`|`{}`| no |
168
-
| attributes | Additional attributes (e.g. `1`) |`list(string)`|`[]`| no |
169
-
| context | Single object for setting entire context at once.<br>See description of individual variables for details.<br>Leave string and numeric variables as `null` to use default value.<br>Individual variable settings (non-null) override settings in context object,<br>except for attributes, tags, and additional\_tag\_map, which are merged. |`any`| <pre>{<br> "additional_tag_map": {},<br> "attributes": [],<br> "delimiter": null,<br> "enabled": true,<br> "environment": null,<br> "id_length_limit": null,<br> "label_key_case": null,<br> "label_order": [],<br> "label_value_case": null,<br> "name": null,<br> "namespace": null,<br> "regex_replace_chars": null,<br> "stage": null,<br> "tags": {}<br>}</pre> | no |
170
-
| delimiter | Delimiter to be used between `namespace`, `environment`, `stage`, `name` and `attributes`.<br>Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. |`string`|`null`| no |
171
-
| enabled | Set to false to prevent the module from creating any resources |`bool`|`null`| no |
172
-
| environment | Environment, e.g. 'uw2', 'us-west-2', OR 'prod', 'staging', 'dev', 'UAT' |`string`|`null`| no |
173
-
| force\_destroy | When destroying this user, destroy even if it has non-Terraform-managed IAM access keys, login profile or MFA devices. Without force\_destroy a user with non-Terraform-managed access keys and login profile will fail to be destroyed. |`bool`|`false`| no |
174
-
| groups | List of IAM user groups this user should belong to in the account |`list(string)`|`[]`| no |
175
-
| id\_length\_limit | Limit `id` to this many characters (minimum 6).<br>Set to `0` for unlimited length.<br>Set to `null` for default, which is `0`.<br>Does not affect `id_full`. |`number`|`null`| no |
176
-
| label\_key\_case | The letter case of label keys (`tag` names) (i.e. `name`, `namespace`, `environment`, `stage`, `attributes`) to use in `tags`.<br>Possible values: `lower`, `title`, `upper`.<br>Default value: `title`. |`string`|`null`| no |
177
-
| label\_order | The naming order of the id output and Name tag.<br>Defaults to ["namespace", "environment", "stage", "name", "attributes"].<br>You can omit any of the 5 elements, but at least one must be present. |`list(string)`|`null`| no |
178
-
| label\_value\_case | The letter case of output label values (also used in `tags` and `id`).<br>Possible values: `lower`, `title`, `upper` and `none` (no transformation).<br>Default value: `lower`. |`string`|`null`| no |
179
-
| login\_profile\_enabled | Whether to create IAM user login profile |`bool`|`true`| no |
180
-
| name | Solution name, e.g. 'app' or 'jenkins' |`string`|`null`| no |
181
-
| namespace | Namespace, which could be your organization name or abbreviation, e.g. 'eg' or 'cp' |`string`|`null`| no |
182
-
| password\_length | The length of the generated password |`number`|`24`| no |
183
-
| password\_reset\_required | Whether the user should be forced to reset the generated password on first login. |`bool`|`true`| no |
184
-
| path | Desired path for the IAM user |`string`|`"/"`| no |
185
-
| permissions\_boundary | The ARN of the policy that is used to set the permissions boundary for the user |`string`|`""`| no |
186
-
| pgp\_key | Provide a base-64 encoded PGP public key, or a keybase username in the form `keybase:username`. Required to encrypt password. |`string`| n/a | yes |
187
-
| regex\_replace\_chars | Regex to replace chars with empty string in `namespace`, `environment`, `stage` and `name`.<br>If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. |`string`|`null`| no |
188
-
| stage | Stage, e.g. 'prod', 'staging', 'dev', OR 'source', 'build', 'test', 'deploy', 'release' |`string`|`null`| no |
189
-
| tags | Additional tags (e.g. `map('BusinessUnit','XYZ')`|`map(string)`|`{}`| no |
190
-
| user\_name | Desired name for the IAM user. We recommend using email addresses. |`string`| n/a | yes |
184
+
|<aname="input_additional_tag_map"></a> [additional\_tag\_map](#input\_additional\_tag\_map)| Additional tags for appending to tags\_as\_list\_of\_maps. Not added to `tags`. |`map(string)`|`{}`| no |
185
+
|<aname="input_attributes"></a> [attributes](#input\_attributes)| Additional attributes (e.g. `1`) |`list(string)`|`[]`| no |
186
+
|<aname="input_context"></a> [context](#input\_context)| Single object for setting entire context at once.<br>See description of individual variables for details.<br>Leave string and numeric variables as `null` to use default value.<br>Individual variable settings (non-null) override settings in context object,<br>except for attributes, tags, and additional\_tag\_map, which are merged. |`any`| <pre>{<br> "additional_tag_map": {},<br> "attributes": [],<br> "delimiter": null,<br> "enabled": true,<br> "environment": null,<br> "id_length_limit": null,<br> "label_key_case": null,<br> "label_order": [],<br> "label_value_case": null,<br> "name": null,<br> "namespace": null,<br> "regex_replace_chars": null,<br> "stage": null,<br> "tags": {}<br>}</pre> | no |
187
+
|<aname="input_delimiter"></a> [delimiter](#input\_delimiter)| Delimiter to be used between `namespace`, `environment`, `stage`, `name` and `attributes`.<br>Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. |`string`|`null`| no |
188
+
|<aname="input_enabled"></a> [enabled](#input\_enabled)| Set to false to prevent the module from creating any resources |`bool`|`null`| no |
189
+
|<aname="input_environment"></a> [environment](#input\_environment)| Environment, e.g. 'uw2', 'us-west-2', OR 'prod', 'staging', 'dev', 'UAT' |`string`|`null`| no |
190
+
|<aname="input_force_destroy"></a> [force\_destroy](#input\_force\_destroy)| When destroying this user, destroy even if it has non-Terraform-managed IAM access keys, login profile or MFA devices. Without force\_destroy a user with non-Terraform-managed access keys and login profile will fail to be destroyed. |`bool`|`false`| no |
191
+
|<aname="input_groups"></a> [groups](#input\_groups)| List of IAM user groups this user should belong to in the account |`list(string)`|`[]`| no |
192
+
|<aname="input_id_length_limit"></a> [id\_length\_limit](#input\_id\_length\_limit)| Limit `id` to this many characters (minimum 6).<br>Set to `0` for unlimited length.<br>Set to `null` for default, which is `0`.<br>Does not affect `id_full`. |`number`|`null`| no |
193
+
|<aname="input_label_key_case"></a> [label\_key\_case](#input\_label\_key\_case)| The letter case of label keys (`tag` names) (i.e. `name`, `namespace`, `environment`, `stage`, `attributes`) to use in `tags`.<br>Possible values: `lower`, `title`, `upper`.<br>Default value: `title`. |`string`|`null`| no |
194
+
|<aname="input_label_order"></a> [label\_order](#input\_label\_order)| The naming order of the id output and Name tag.<br>Defaults to ["namespace", "environment", "stage", "name", "attributes"].<br>You can omit any of the 5 elements, but at least one must be present. |`list(string)`|`null`| no |
195
+
|<aname="input_label_value_case"></a> [label\_value\_case](#input\_label\_value\_case)| The letter case of output label values (also used in `tags` and `id`).<br>Possible values: `lower`, `title`, `upper` and `none` (no transformation).<br>Default value: `lower`. |`string`|`null`| no |
196
+
|<aname="input_login_profile_enabled"></a> [login\_profile\_enabled](#input\_login\_profile\_enabled)| Whether to create IAM user login profile |`bool`|`true`| no |
197
+
|<aname="input_name"></a> [name](#input\_name)| Solution name, e.g. 'app' or 'jenkins' |`string`|`null`| no |
198
+
|<aname="input_namespace"></a> [namespace](#input\_namespace)| Namespace, which could be your organization name or abbreviation, e.g. 'eg' or 'cp' |`string`|`null`| no |
199
+
|<aname="input_password_length"></a> [password\_length](#input\_password\_length)| The length of the generated password |`number`|`24`| no |
200
+
|<aname="input_password_reset_required"></a> [password\_reset\_required](#input\_password\_reset\_required)| Whether the user should be forced to reset the generated password on first login. |`bool`|`true`| no |
201
+
|<aname="input_path"></a> [path](#input\_path)| Desired path for the IAM user |`string`|`"/"`| no |
202
+
|<aname="input_permissions_boundary"></a> [permissions\_boundary](#input\_permissions\_boundary)| The ARN of the policy that is used to set the permissions boundary for the user |`string`|`""`| no |
203
+
|<aname="input_pgp_key"></a> [pgp\_key](#input\_pgp\_key)| Provide a base-64 encoded PGP public key, or a keybase username in the form `keybase:username`. Required to encrypt password. |`string`| n/a | yes |
204
+
|<aname="input_regex_replace_chars"></a> [regex\_replace\_chars](#input\_regex\_replace\_chars)| Regex to replace chars with empty string in `namespace`, `environment`, `stage` and `name`.<br>If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. |`string`|`null`| no |
205
+
|<aname="input_stage"></a> [stage](#input\_stage)| Stage, e.g. 'prod', 'staging', 'dev', OR 'source', 'build', 'test', 'deploy', 'release' |`string`|`null`| no |
206
+
|<aname="input_tags"></a> [tags](#input\_tags)| Additional tags (e.g. `map('BusinessUnit','XYZ')`|`map(string)`|`{}`| no |
207
+
|<aname="input_user_name"></a> [user\_name](#input\_user\_name)| Desired name for the IAM user. We recommend using email addresses. |`string`| n/a | yes |
191
208
192
209
## Outputs
193
210
194
211
| Name | Description |
195
212
|------|-------------|
196
-
| keybase\_password\_decrypt\_command | Command to decrypt the Keybase encrypted password. Returns empty string if pgp\_key is not from keybase |
197
-
| keybase\_password\_pgp\_message | PGP encrypted message (e.g. suitable for email exchanges). Returns empty string if pgp\_key is not from keybase |
198
-
| pgp\_key | PGP key used to encrypt sensitive data for this user |
199
-
| user\_arn | The ARN assigned by AWS for this user |
200
-
| user\_login\_profile\_encrypted\_password | The encrypted password, base64 encoded |
201
-
| user\_login\_profile\_key\_fingerprint | The fingerprint of the PGP key used to encrypt the password |
202
-
| user\_name | IAM user name |
203
-
| user\_unique\_id | The unique ID assigned by AWS |
204
-
213
+
| <aname="output_keybase_password_decrypt_command"></a> [keybase\_password\_decrypt\_command](#output\_keybase\_password\_decrypt\_command)| Command to decrypt the Keybase encrypted password. Returns empty string if pgp\_key is not from keybase |
214
+
| <aname="output_keybase_password_pgp_message"></a> [keybase\_password\_pgp\_message](#output\_keybase\_password\_pgp\_message)| PGP encrypted message (e.g. suitable for email exchanges). Returns empty string if pgp\_key is not from keybase |
215
+
| <aname="output_pgp_key"></a> [pgp\_key](#output\_pgp\_key)| PGP key used to encrypt sensitive data for this user |
216
+
| <aname="output_user_arn"></a> [user\_arn](#output\_user\_arn)| The ARN assigned by AWS for this user |
217
+
| <aname="output_user_login_profile_encrypted_password"></a> [user\_login\_profile\_encrypted\_password](#output\_user\_login\_profile\_encrypted\_password)| The encrypted password, base64 encoded |
218
+
| <aname="output_user_login_profile_key_fingerprint"></a> [user\_login\_profile\_key\_fingerprint](#output\_user\_login\_profile\_key\_fingerprint)| The fingerprint of the PGP key used to encrypt the password |
219
+
| <aname="output_user_name"></a> [user\_name](#output\_user\_name)| IAM user name |
220
+
| <aname="output_user_unique_id"></a> [user\_unique\_id](#output\_user\_unique\_id)| The unique ID assigned by AWS |
205
221
<!-- markdownlint-restore -->
206
222
207
223
@@ -213,6 +229,7 @@ Like this project? Please give it a ★ on [our GitHub](https://github.com/cloud
213
229
Are you using this project or any of our other projects? Consider [leaving a testimonial][testimonial]. =)
214
230
215
231
232
+
216
233
## Related Projects
217
234
218
235
Check out these related projects.
@@ -224,8 +241,6 @@ Check out these related projects.
224
241
-[terraform-aws-iam-chamber-user](https://github.com/cloudposse/terraform-aws-iam-chamber-user) - Terraform module to provision a basic IAM chamber user with access to SSM parameters and KMS key to decrypt secrets, suitable for CI/CD systems (e.g. TravisCI, CircleCI, CodeFresh) or systems which are external to AWS that cannot leverage AWS IAM Instance Profiles
225
242
-[terraform-aws-lb-s3-bucket](https://github.com/cloudposse/terraform-aws-lb-s3-bucket) - Terraform module to provision an S3 bucket with built in IAM policy to allow AWS Load Balancers to ship access logs
0 commit comments