terraform-aws-policy-sentry

Builds secure IAM Policies with resource constraints. For more information on Policy Sentry, see the documentation.

Requirements

• You must have Policy Sentry 0.10.0 installed beforehand and it must be executable from your $PATH. Follow the installation instructions here

Usage

Example

Use the module as below:

• main.tf:

module "policy_sentry_demo" {
  source                              = "github.com/kmcquade/terraform-aws-policy-sentry"
  name                                = var.name
  read_access_level                   = var.read_access_level
  write_access_level                  = var.write_access_level
  list_access_level                   = var.list_access_level
  tagging_access_level                = var.tagging_access_level
  permissions_management_access_level = var.permissions_management_access_level
  wildcard_only_single_actions               = var.wildcard_only_actions
  minimize                            = var.minimize
}

Assuming you have your variables.tf file set properly (redacted from this README for readability), provide the following in your terraform.tfvars file.

• terraform.tfvars:

name = "PolicySentryTest"

list_access_level = [
  "arn:aws:s3:::example-org",
]

read_access_level = [
  "arn:aws:kms:us-east-1:123456789012:key/shaq"
]

write_access_level = [
  "arn:aws:kms:us-east-1:123456789012:key/shaq"
]

Providers

No provider.

Inputs

Name	Description	Type	Default	Required
description	The description to include for the IAM policy.	string	"Generated by Policy Sentry"	no
list_access_level	Provide a list of Amazon Resource Names (ARNs) that your role needs LIST access to.	list	[ "" ]	no
minimize	If set to true, it will minimize the size of the IAM Policy file. Defaults to false.	bool	false	no
name	The name of the rendered policy file (no file extension).	string	n/a	yes
permissions_management_access_level	Provide a list of Amazon Resource Names (ARNs) that your role needs PERMISSIONS MANAGEMENT access to.	list	[ "" ]	no
read_access_level	Provide a list of Amazon Resource Names (ARNs) that your role needs READ access to.	list	[ "" ]	no
region	The AWS region for these resources. Defaults to us-east-1	string	"us-east-1"	no
tagging_access_level	Provide a list of Amazon Resource Names (ARNs) that your role needs TAGGING access to.	list	[ "" ]	no
wildcard_only_list_service	To generate a list of AWS service actions that (1) are at the LIST access level and (2) do not support resource constraints, list the service prefix here.	list	[ "" ]	no
wildcard_only_permissions_management_service	To generate a list of AWS service actions that (1) are at the PERMISSIONS MANAGEMENT access level and (2) do not support resource constraints, list the service prefix here.	list	[ "" ]	no
wildcard_only_read_service	To generate a list of AWS service actions that (1) are at the READ access level and (2) do not support resource constraints, list the service prefix here.	list	[ "" ]	no
wildcard_only_single_actions	Individual actions that do not support resource constraints. For example, s3:ListAllMyBuckets	list	[ "" ]	no
wildcard_only_tagging_service	To generate a list of AWS service actions that (1) are at the TAGGING access level and (2) do not support resource constraints, list the service prefix here.	list	[ "" ]	no
wildcard_only_write_service	To generate a list of AWS service actions that (1) are at the WRITE access level and (2) do not support resource constraints, list the service prefix here.	list	[ "" ]	no
write_access_level	Provide a list of Amazon Resource Names (ARNs) that your role needs WRITE access to.	list	[ "" ]	no

Outputs

Name	Description
iam_policy_arn	The ARN assigned by AWS to this policy.
iam_policy_document	The policy document.
iam_policy_id	The policy's ID.
iam_policy_name	The name of the policy.
iam_policy_path	The path of the policy in IAM

Maintenance

• Pre-commit hook

Run this every time before you push to Git.

pre-commit run -a

Todo

• Update the documentation in the Policy Sentry docs.
• Publish this on Terraform module registry

License

Copyright: © 2020 Kinnaird McQuade