Extra information from devops sharing on scaling IAM management

config

[profile ops-developer]
source_profile=ops-account
mfa_serial=arn:aws:iam::ops-account-id:mfa/foo_cli
role_arn=arn:aws:iam::ops-account-id:role/developer
role_session_name=foo_cli
sts_regional_endpoints=regional

[profile ops-uat-developer]
source_profile=ops-developer
role_arn=arn:aws:iam::uat-account-id:role/developer
role_session_name=foo_cli

DevOps Sharing 04-2022 IAM.md

User Management

• https://github.com/GovTechSG/terraform-iam-users-gcc
• https://github.com/GovTechSG/terraform-iam-group-gcc
• https://github.com/GovTechSG/terraform-iam-group-role-gcc

These are the modules related to the sharing. If you're just looking for the modules required to refactor your team's users, you can start from here.

Something that was alluded in the sharing is that policies should always be applied to group instead of users itself. Users itself shouldn't have any policy applied, so all the pre-made policies are on the group level; this includes the permission to assume your base role, as well as forcing MFA, and allowing your users to rotate their own access keys.

The order of creation should be.

1. Users
2. Groups (for you to add users)
3. Roles (sky's the limit)

Example folder structure

• /account-1
  • /iam
    • /users
    • /groups
    • /roles
• /account-2
  • /iam
    • /roles
• /account-3
  • /iam
    • /roles

Service / External Management

• https://github.com/GovTechSG/terraform-iam-service-user-gcc
• https://github.com/GovTechSG/terraform-iam-service-role-gcc

This is a more loose module where most of the "hand-holding" is disabled and you have to write your own trust-policy (conditions and all). This is useful for cases where you're writing service role for AWS services (e.g. lambda, cloudwatch). This is honestly where the more advanced use cases lie after the team users have been settled.

Slides from the sharing

If you have any questions, feel free to reach out to me on
Telegram: ACE devops group
Slack: @Kai Hong

trust-policy.json

{
 "Version": "2012-10-17",
 "Statement": [
   {
     "Effect": "Allow",
     "Action": "sts:AssumeRole",
     "Principal": {
       "AWS": "arn:aws:iam::account-id:root"
     },
     "Condition": {
       "StringLike": [
         "arn:aws:iam::a-account-id:role/developer",
         "arn:aws:iam::b-account-id:role/developer"
       ],
       "StringEquals": {
         "sts:ExternalId": "pushchair-aggregate-otter-playhouse-subscript"
       }
     }
   }
 ]
}