More examples using plus3it/terraform-aws-tardigrade-sso-admin

common_sso_permission_sets.tf

# This configuration creates permission sets that will be assigned across many accounts. This
# would be managed centrally, and the provider for this config should be set to the management
# account for AWS Identity Center.

module "sso_admin" {
  source = "git::https://github.com/plus3it/terraform-aws-tardigrade-sso-admin.git?ref=2.0.1"

  sso_admin = {
    permission_sets = local.permission_sets
  }
}

locals {
  permission_sets = [
    {
      name = "Administrator"
      managed_policy_attachments = [
        {
          policy_name = "AdministratorAccess",
        },
      ]
    },
    {
      name = "PowerUser"
      managed_policy_attachments = [
        {
          policy_name = "PowerUserAccess"
        },
      ]
    },
    {
      name = "ReadOnly"
      managed_policy_attachments = [
        {
          policy_name = "SecurityAudit"
        },
        {
          policy_name = "ViewOnlyAccess"
          policy_path = "/job-function/"
        },
      ]
    },
  ]
}

sso_assignment_per_member_account.tf

# This config applies to each member account, and would be part of the member account
# config. The config would use multiple providers, one for the member account, and one 
# for the management account.

module "sso_admin" {
  source = "git::https://github.com/plus3it/terraform-aws-tardigrade-sso-admin.git?ref=2.0.1"
  providers = {
    aws = aws.sso-admin
  }

  sso_admin = {
    account_assignments = local.account_assignments
  }
}
  
locals {
  account_id = data.aws_caller_identity.this.account_id
  
  account_assignments = [
    {
      name                = "Administrator" # This is just a label for the for_each expression; it must be unique in this list, and fully-known before apply (no IDs generated by Provider APIs or outputs from other resources)
      principal_name      = "Administrator" # This is a group name in Identity Center; it must already exist
      permission_set_name = "Administrator" # This needs to match the name of the permission set, created with common_sso_permission_sets.tf
      target_id           = local.account_id
    },
    {
      name                = "PowerUserGroup1"
      principal_name      = "PowerUserGroup1"
      permission_set_name = "PowerUser"
      target_id           = local.account_id
    },
    {
      name                = "PowerUserGroup2"
      principal_name      = "PowerUserGroup2"
      permission_set_name = "PowerUser"
      target_id           = local.account_id
    },
    {
      name                = "ReadOnlyGroup1"
      principal_name      = "ReadOnlyGroup1"
      permission_set_name = "ReadOnly"
      target_id           = local.account_id
    },
    {
      name                = "ReadOnlyGroup2"
      principal_name      = "ReadOnlyGroup2"
      permission_set_name = "ReadOnly"
      target_id           = local.account_id
    },
  ]  
}

data "aws_caller_identity" "this" {} 
 
provider "aws" {
  region = "us-east-1"
}

provider "aws" {
  alias  = "sso-admin"
  region = "us-east-1"

  assume_role {
    role_arn = "arn:{{{partition}}}:iam::{{{sso_account_id}}}:role/{{{role_name}}}"
  }
}