Skip to content

Commit c660bea

Browse files
nozaqnozaq
authored
misc: remove unnecessary IAM roles (nozaq#134)
* misc: remove unnecessary IAM roles CIS benchmark no longer requires master & manager roles in v1.3.0. fixes nozaq#109 * docs: update README
1 parent 4214de4 commit c660bea

File tree

7 files changed

+0
-194
lines changed

7 files changed

+0
-194
lines changed

‎README.md

-3
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@ See [Benchmark Compliance](./compliance.md) to check which items in various benc
1414
### Identity and Access Management
1515

1616
- Set up IAM Password Policy.
17-
- Create separated IAM roles for defining privileges and assigning them to entities such as IAM users and groups.
1817
- Create an IAM role for contacting AWS support for incident handling.
1918
- Enable AWS Config rules to audit root account status.
2019
- Enable IAM Access Analyzer in each region.
@@ -201,8 +200,6 @@ This module is composed of several submodules and each of which can be used inde
201200
| default\_security\_group | The ID of the default security group. |
202201
| default\_vpc | The default VPC. |
203202
| guardduty\_detector | The GuardDuty detector in each region. |
204-
| manager\_iam\_role | The IAM role used for the manager user. |
205-
| master\_iam\_role | The IAM role used for the master user. |
206203
| support\_iam\_role | The IAM role used for the support user. |
207204
| vpc\_flow\_logs\_group | The CloudWatch Logs log group which stores VPC Flow Logs in each region. |
208205
| vpc\_flow\_logs\_iam\_role | The IAM role used for delivering VPC Flow Logs to CloudWatch Logs. |

‎main.tf

-6
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,6 @@ module "iam_baseline" {
1414
source = "./modules/iam-baseline"
1515

1616
aws_account_id = var.aws_account_id
17-
master_iam_role_name = var.master_iam_role_name
18-
master_iam_role_policy_name = var.master_iam_role_policy_name
19-
manager_iam_role_name = var.manager_iam_role_name
20-
manager_iam_role_policy_name = var.manager_iam_role_policy_name
2117
support_iam_role_name = var.support_iam_role_name
2218
support_iam_role_policy_name = var.support_iam_role_policy_name
2319
support_iam_role_principal_arns = var.support_iam_role_principal_arns
@@ -30,8 +26,6 @@ module "iam_baseline" {
3026
allow_users_to_change_password = var.allow_users_to_change_password
3127
max_password_age = var.max_password_age
3228
create_password_policy = var.create_password_policy
33-
create_master_role = var.create_master_role
34-
create_manager_role = var.create_manager_role
3529
create_support_role = var.create_support_role
3630

3731
tags = var.tags

‎modules/iam-baseline/README.md

-8
Original file line numberDiff line numberDiff line change
@@ -24,14 +24,8 @@
2424
|------|-------------|------|---------|:--------:|
2525
| allow\_users\_to\_change\_password | Whether to allow users to change their own password. | `bool` | `true` | no |
2626
| aws\_account\_id | The AWS Account ID number of the account. | `any` | n/a | yes |
27-
| create\_manager\_role | Define if the manager role should be created. | `bool` | `true` | no |
28-
| create\_master\_role | Define if the master role should be created. | `bool` | `true` | no |
2927
| create\_password\_policy | Define if the password policy should be created. | `bool` | `true` | no |
3028
| create\_support\_role | Define if the support role should be created. | `bool` | `true` | no |
31-
| manager\_iam\_role\_name | The name of the IAM Manager role. | `string` | `"IAM-Manager"` | no |
32-
| manager\_iam\_role\_policy\_name | The name of the IAM Manager role policy. | `string` | `"IAM-Manager-Policy"` | no |
33-
| master\_iam\_role\_name | The name of the IAM Master role. | `string` | `"IAM-Master"` | no |
34-
| master\_iam\_role\_policy\_name | The name of the IAM Master role policy. | `string` | `"IAM-Master-Policy"` | no |
3529
| max\_password\_age | The number of days that an user password is valid. | `number` | `90` | no |
3630
| minimum\_password\_length | Minimum length to require for user passwords. | `number` | `14` | no |
3731
| password\_reuse\_prevention | The number of previous passwords that users are prevented from reusing. | `number` | `24` | no |
@@ -48,8 +42,6 @@
4842

4943
| Name | Description |
5044
|------|-------------|
51-
| manager\_iam\_role | The IAM role used for the manager user. |
52-
| master\_iam\_role | The IAM role used for the master user. |
5345
| support\_iam\_role | The IAM role used for the support user. |
5446

5547
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎modules/iam-baseline/main.tf

-124
Original file line numberDiff line numberDiff line change
@@ -14,130 +14,6 @@ resource "aws_iam_account_password_policy" "default" {
1414
count = var.create_password_policy ? 1 : 0
1515
}
1616

17-
# --------------------------------------------------------------------------------------------------
18-
# Manager & Master Role Separation
19-
# --------------------------------------------------------------------------------------------------
20-
data "aws_iam_policy_document" "master_assume_policy" {
21-
statement {
22-
principals {
23-
type = "AWS"
24-
identifiers = ["arn:aws:iam::${var.aws_account_id}:root"]
25-
}
26-
actions = ["sts:AssumeRole"]
27-
}
28-
}
29-
30-
resource "aws_iam_role" "master" {
31-
name = var.master_iam_role_name
32-
assume_role_policy = data.aws_iam_policy_document.master_assume_policy.json
33-
count = var.create_master_role ? 1 : 0
34-
35-
tags = var.tags
36-
}
37-
38-
data "aws_iam_policy_document" "master_policy" {
39-
statement {
40-
actions = [
41-
"iam:CreateGroup", "iam:CreatePolicy", "iam:CreatePolicyVersion", "iam:CreateRole", "iam:CreateUser",
42-
"iam:DeleteGroup", "iam:DeletePolicy", "iam:DeletePolicyVersion", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DeleteUser",
43-
"iam:PutRolePolicy",
44-
"iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy",
45-
"iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser",
46-
"iam:ListPolicies", "iam:ListPoliciesGrantingServiceAccess", "iam:ListPolicyVersions",
47-
"iam:ListRolePolicies", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies",
48-
"iam:ListAttachedUserPolicies", "iam:ListRoles", "iam:ListUsers"
49-
]
50-
resources = ["*"]
51-
condition {
52-
test = "Bool"
53-
variable = "aws:MultiFactorAuthPresent"
54-
values = ["true"]
55-
}
56-
}
57-
58-
statement {
59-
effect = "Deny"
60-
actions = [
61-
"iam:AddUserToGroup",
62-
"iam:AttachGroupPolicy",
63-
"iam:DeleteGroupPolicy", "iam:DeleteUserPolicy",
64-
"iam:DetachGroupPolicy", "iam:DetachRolePolicy", "iam:DetachUserPolicy",
65-
"iam:PutGroupPolicy", "iam:PutUserPolicy",
66-
"iam:RemoveUserFromGroup",
67-
"iam:UpdateGroup", "iam:UpdateAssumeRolePolicy", "iam:UpdateUser"
68-
]
69-
resources = ["*"]
70-
}
71-
}
72-
73-
resource "aws_iam_role_policy" "master_policy" {
74-
name = var.master_iam_role_policy_name
75-
role = aws_iam_role.master[0].id
76-
count = var.create_master_role ? 1 : 0
77-
78-
policy = data.aws_iam_policy_document.master_policy.json
79-
}
80-
81-
data "aws_iam_policy_document" "manager_assume_policy" {
82-
statement {
83-
principals {
84-
type = "AWS"
85-
identifiers = ["arn:aws:iam::${var.aws_account_id}:root"]
86-
}
87-
actions = ["sts:AssumeRole"]
88-
}
89-
}
90-
91-
resource "aws_iam_role" "manager" {
92-
name = var.manager_iam_role_name
93-
assume_role_policy = data.aws_iam_policy_document.manager_assume_policy.json
94-
count = var.create_manager_role ? 1 : 0
95-
96-
tags = var.tags
97-
}
98-
99-
data "aws_iam_policy_document" "manager_policy" {
100-
statement {
101-
actions = [
102-
"iam:AddUserToGroup",
103-
"iam:AttachGroupPolicy",
104-
"iam:DeleteGroupPolicy", "iam:DeleteUserPolicy",
105-
"iam:DetachGroupPolicy", "iam:DetachRolePolicy", "iam:DetachUserPolicy",
106-
"iam:PutGroupPolicy", "iam:PutUserPolicy",
107-
"iam:RemoveUserFromGroup",
108-
"iam:UpdateGroup", "iam:UpdateAssumeRolePolicy", "iam:UpdateUser",
109-
"iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetUser", "iam:GetUserPolicy",
110-
"iam:ListEntitiesForPolicy", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListGroupsForUser",
111-
"iam:ListPolicies", "iam:ListPoliciesGrantingServiceAccess", "iam:ListPolicyVersions",
112-
"iam:ListRolePolicies", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies",
113-
"iam:ListAttachedUserPolicies", "iam:ListRoles", "iam:ListUsers"
114-
]
115-
resources = ["*"]
116-
condition {
117-
test = "Bool"
118-
variable = "aws:MultiFactorAuthPresent"
119-
values = ["true"]
120-
}
121-
}
122-
123-
statement {
124-
effect = "Deny"
125-
actions = [
126-
"iam:CreateGroup", "iam:CreatePolicy", "iam:CreatePolicyVersion", "iam:CreateRole", "iam:CreateUser",
127-
"iam:DeleteGroup", "iam:DeletePolicy", "iam:DeletePolicyVersion", "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DeleteUser",
128-
"iam:PutRolePolicy"
129-
]
130-
resources = ["*"]
131-
}
132-
}
133-
134-
resource "aws_iam_role_policy" "manager_policy" {
135-
name = var.manager_iam_role_policy_name
136-
role = aws_iam_role.manager[0].id
137-
policy = data.aws_iam_policy_document.manager_policy.json
138-
count = var.create_manager_role ? 1 : 0
139-
}
140-
14117
# --------------------------------------------------------------------------------------------------
14218
# Support Role
14319
# --------------------------------------------------------------------------------------------------

‎modules/iam-baseline/outputs.tf

-10
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,3 @@
1-
output "master_iam_role" {
2-
description = "The IAM role used for the master user."
3-
value = aws_iam_role.master
4-
}
5-
6-
output "manager_iam_role" {
7-
description = "The IAM role used for the manager user."
8-
value = aws_iam_role.manager
9-
}
10-
111
output "support_iam_role" {
122
description = "The IAM role used for the support user."
133
value = aws_iam_role.support

‎modules/iam-baseline/variables.tf

-33
Original file line numberDiff line numberDiff line change
@@ -2,26 +2,6 @@ variable "aws_account_id" {
22
description = "The AWS Account ID number of the account."
33
}
44

5-
variable "master_iam_role_name" {
6-
description = "The name of the IAM Master role."
7-
default = "IAM-Master"
8-
}
9-
10-
variable "master_iam_role_policy_name" {
11-
description = "The name of the IAM Master role policy."
12-
default = "IAM-Master-Policy"
13-
}
14-
15-
variable "manager_iam_role_name" {
16-
description = "The name of the IAM Manager role."
17-
default = "IAM-Manager"
18-
}
19-
20-
variable "manager_iam_role_policy_name" {
21-
description = "The name of the IAM Manager role policy."
22-
default = "IAM-Manager-Policy"
23-
}
24-
255
variable "support_iam_role_name" {
266
description = "The name of the the support role."
277
default = "IAM-Support"
@@ -83,25 +63,12 @@ variable "create_password_policy" {
8363
default = true
8464
}
8565

86-
variable "create_master_role" {
87-
type = bool
88-
description = "Define if the master role should be created."
89-
default = true
90-
}
91-
92-
variable "create_manager_role" {
93-
type = bool
94-
description = "Define if the manager role should be created."
95-
default = true
96-
}
97-
9866
variable "create_support_role" {
9967
type = bool
10068
description = "Define if the support role should be created."
10169
default = true
10270
}
10371

104-
10572
variable "tags" {
10673
description = "Specifies object tags key and value. This applies to all resources created by this module."
10774
default = {

‎outputs.tf

-10
Original file line numberDiff line numberDiff line change
@@ -129,16 +129,6 @@ output "guardduty_detector" {
129129
# Outputs from iam-baseline module.
130130
# --------------------------------------------------------------------------------------------------
131131

132-
output "master_iam_role" {
133-
description = "The IAM role used for the master user."
134-
value = module.iam_baseline.master_iam_role
135-
}
136-
137-
output "manager_iam_role" {
138-
description = "The IAM role used for the manager user."
139-
value = module.iam_baseline.manager_iam_role
140-
}
141-
142132
output "support_iam_role" {
143133
description = "The IAM role used for the support user."
144134
value = module.iam_baseline.support_iam_role

0 commit comments

Comments
 (0)