Skip to content

Commit 28d1065

Browse files
chelseykleinchelseyklein
authored
Merge pull request #7 from hackforla/setup-gha-107
Setup gha 107
2 parents 28b6af3 + b32fd04 commit 28d1065

9 files changed

Lines changed: 163 additions & 42 deletions

File tree

‎.github/workflows/terraform-apply.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: Apply Terraform changes on merge
2+
3+
on:
4+
push:
5+
branches:
6+
- main # or any other branch you want to trigger the deployment
7+
8+
jobs:
9+
terraform-apply:
10+
name: Terraform Apply
11+
runs-on: ubuntu-latest
12+
env:
13+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
14+
15+
permissions:
16+
contents: read
17+
pull-requests: write
18+
19+
steps:
20+
- name: Checkout code
21+
uses: actions/checkout@v4
22+
- name: Configure AWS Credentials
23+
uses: aws-actions/configure-aws-credentials@v4
24+
with:
25+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
26+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
27+
aws-region: us-west-2
28+
29+
- name: Terraform Apply
30+
uses: dflook/terraform-apply@v1
31+
with:
32+
path: terraform

.github/terraform-plan.yaml renamed to .github/workflows/terraform-plan.yaml

Lines changed: 11 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,39 +1,32 @@
1-
name: Deploy IAM Resources to AWS with Terraform
1+
name: Write Terraform Plan to Pull Request
22

33
on:
4-
pull-request:
4+
pull_request:
55
branches:
66
- main # or any other branch you want to trigger the deployment
77

88
jobs:
9-
terraform:
10-
name: Terraform
9+
terraform-plan:
10+
name: Terraform Plan
1111
runs-on: ubuntu-latest
1212
env:
1313
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
1414

15+
permissions:
16+
contents: read
17+
pull-requests: write
18+
1519
steps:
1620
- name: Checkout code
17-
uses: actions/checkout@v3
18-
19-
- name: Set up Terraform
20-
uses: hashicorp/setup-terraform@v1
21-
with:
22-
terraform_version: 1.0.0 # Specify the Terraform version
23-
21+
uses: actions/checkout@v4
2422
- name: Configure AWS Credentials
25-
uses: aws-actions/configure-aws-credentials@v1
23+
uses: aws-actions/configure-aws-credentials@v4
2624
with:
2725
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
2826
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
29-
aws-region: us-west-2 # Change to your AWS region
30-
31-
- name: Terraform Init
32-
run: terraform init
27+
aws-region: us-west-2
3328

3429
- name: Terraform Plan
3530
uses: dflook/terraform-plan@v1
3631
with:
3732
path: terraform
38-
39-

‎terraform/aws-custom-policies.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
module "aws_custom_policies" {
2+
source = "./modules/aws-policies"
3+
policies = {
4+
"IAMServicesAdmin" = {
5+
description = "Policy granting IAM services admins permissions to make changes to user accounts"
6+
filename = "level-4-iam-services-admin-policy.json"
7+
}
8+
}
9+
}

‎terraform/aws-custom-policies/level-4-iam-services-admin-policy.json‎

Lines changed: 12 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -2,26 +2,23 @@
22
"Version": "2012-10-17",
33
"Statement": [
44
{
5-
"Sid": "",
6-
"Effect": "",
5+
"Effect": "Allow",
76
"Action": [
8-
"",
9-
"",
10-
"",
11-
""
7+
"iam:CreateAccessKey"
128
],
13-
"Resource": ""
9+
"Resource": "arn:aws:iam::*:user/*"
1410
},
1511
{
16-
"Sid": "",
17-
"Effect": "",
12+
"Effect": "Allow",
1813
"Action": [
19-
"",
20-
"",
21-
"",
22-
""
14+
"iam:UpdateLoginProfile"
2315
],
24-
"Resource": ""
16+
"Resource": "arn:aws:iam::*:user/*",
17+
"Condition": {
18+
"StringEquals": {
19+
"iam:ResourceTag/Access Level": ["1", "2"]
20+
}
21+
}
2522
}
2623
]
27-
}
24+
}

‎terraform/aws-groups.tf‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,19 @@ module "iam_read_only_group" {
33
source = "./modules/aws-groups"
44

55
group_name = "read-only-group"
6-
policy_arn = ["arn:aws:iam::aws:policy/ReadOnlyAccess"]
6+
policy_arn = {
7+
"ReadOnlyAccess" = "arn:aws:iam::aws:policy/ReadOnlyAccess",
8+
"IAMUserChangePassword" = "arn:aws:iam::aws:policy/IAMUserChangePassword"
9+
}
710
}
11+
12+
// Create iam services admin group
13+
module "iam_services_admin_group" {
14+
source = "./modules/aws-groups"
15+
16+
group_name = "iam-services-admin-group"
17+
policy_arn = {
18+
"IAMServicesAdmin" = module.aws_custom_policies.policy_arns["IAMServicesAdmin"]
19+
}
20+
}
21+

‎terraform/aws-users.tf‎

Lines changed: 80 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,87 @@
11
// Create user and assign to group(s)
2-
module "iam_user_gwenstacy" {
2+
module "iam_user_JimmyJuarez10" {
33
source = "./modules/aws-users"
44

5-
user_name = "gwenstacy"
5+
user_name = "JimmyJuarez10"
66
user_tags = {
7-
"Environment" = "Development"
8-
"Project" = "spiderverse"
7+
"Project" = "civic-tech-jobs"
98
}
109
user_groups = ["read-only-group"]
1110
}
11+
12+
module "iam_user_brittanyms" {
13+
source = "./modules/aws-users"
14+
15+
user_name = "brittanyms"
16+
user_tags = {
17+
"Project" = "devops-security"
18+
"Access Level" = "1"
19+
}
20+
user_groups = ["read-only-group"]
21+
}
22+
23+
module "iam_user_freaky4wrld" {
24+
source = "./modules/aws-users"
25+
26+
user_name = "freaky4wrld"
27+
user_tags = {
28+
"Project" = "devops-security"
29+
"Access Level" = "1"
30+
}
31+
user_groups = ["read-only-group"]
32+
}
33+
34+
module "iam_user_shikha0428" {
35+
source = "./modules/aws-users"
36+
37+
user_name = "shikha0428"
38+
user_tags = {
39+
"Project" = "devops-security"
40+
"Access Level" = "1"
41+
}
42+
user_groups = ["read-only-group"]
43+
}
44+
45+
module "iam_user_shinjonathan" {
46+
source = "./modules/aws-users"
47+
48+
user_name = "shinjonathan"
49+
user_tags = {
50+
"Project" = "devops-security"
51+
"Access Level" = "1"
52+
}
53+
user_groups = ["read-only-group"]
54+
}
55+
56+
module "iam_user_samuelusc" {
57+
source = "./modules/aws-users"
58+
59+
user_name = "samuelusc"
60+
user_tags = {
61+
"Project" = "devops-security"
62+
"Access Level" = "1"
63+
}
64+
user_groups = ["read-only-group"]
65+
}
66+
67+
module "iam_user_abbyz123" {
68+
source = "./modules/aws-users"
69+
70+
user_name = "abbyz123"
71+
user_tags = {
72+
"Project" = "devops-security"
73+
"Access Level" = "1"
74+
}
75+
user_groups = ["read-only-group"]
76+
}
77+
78+
module "iam_user_awlFCCamp" {
79+
source = "./modules/aws-users"
80+
81+
user_name = "awlFCCamp"
82+
user_tags = {
83+
"Project" = "devops-security"
84+
"Access Level" = "1"
85+
}
86+
user_groups = ["read-only-group"]
87+
}

‎terraform/modules/aws-groups/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ resource "aws_iam_group" "group" {
66
}
77

88
resource "aws_iam_group_policy_attachment" "group_policy_attachment" {
9-
for_each = toset(var.policy_arn)
9+
for_each = var.policy_arn
1010
group = aws_iam_group.group.name
1111
policy_arn = each.value
1212
}

‎terraform/modules/aws-groups/variables.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,6 @@ variable "group_path" {
1212
}
1313

1414
variable "policy_arn" {
15-
description = "List of policy ARNs to attach to the group"
16-
type = list(string)
15+
description = "Map of policy names to ARNs to attach to the group"
16+
type = map(string)
1717
}

‎terraform/modules/aws-policies/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,5 @@ resource "aws_iam_policy" "custom_policy" {
55

66
name = each.key
77
description = each.value["description"]
8-
policy = file("${path.module}/policies-json/${each.value["filename"]}")
8+
policy = file("aws-custom-policies/${each.value["filename"]}")
99
}

0 commit comments

Comments
 (0)