Add examples

* Accounts and permission assignments example
* Existing account example

Author: Stretch96

examples/accounts-and-permission-assignments/README.md

@@ -0,0 +1,59 @@
+# Accounts and permission assignments example
+
+SSO permission sets can be defined with the `sso_permission_sets` parameter. The `managed_policies` items should be the name of the policy within AWS (The last part of the AWS)
+The permission sets can then be assigned to users or groups in an account with `user_assignments` or `group_assigmnets`.
+
+```
+module "aws_organizations_and_sso" {
+  source  = "github.com/chris-qa-org/terraform-aws-organzation-and-sso"
+  version = "0.4.1"
+
+  region = "eu-west-2"
+
+  sso_permission_sets = {
+    "AdministratorAccess" = {
+      description = "Administrator Access",
+      session_duration = "PT2H",
+      managed_policies = [
+        "AdministratorAccess"
+      ]
+    }
+    "Billing" = {
+      description = "Billing access",
+      session_duration = "PT4H",
+      managed_policies = [
+        "job-function/Billing"
+      ]
+    }
+  }
+
+  organization_config = {
+    units = {
+      "my-org-unit" = {
+        accounts = {
+          "my-account-name" = {
+            email                      = "[email protected]"
+            iam_user_access_to_billing = "ALLOW"
+            group_assignments = {
+              "Admins" = {
+                permission_sets = [
+                  "AdministratorAccess"
+                ]
+              }
+            },
+            user_assignments = {
+              "Alex" = {
+                permission_sets = [
+                  "Billing"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    feature_set          = "ALL",
+    enabled_policy_types = []
+  }
+}
+```

examples/accounts-and-permission-assignments/main.tf

@@ -0,0 +1,52 @@
+module "aws_organizations_and_sso" {
+  source  = "github.com/chris-qa-org/terraform-aws-organzation-and-sso"
+  version = "0.4.1"
+
+  region = "eu-west-2"
+
+  sso_permission_sets = {
+    "AdministratorAccess" = {
+      description      = "Administrator Access",
+      session_duration = "PT2H",
+      managed_policies = [
+        "AdministratorAccess"
+      ]
+    }
+    "Billing" = {
+      description      = "Billing access",
+      session_duration = "PT4H",
+      managed_policies = [
+        "job-function/Billing"
+      ]
+    }
+  }
+
+  organization_config = {
+    units = {
+      "my-org-unit" = {
+        accounts = {
+          "my-account-name" = {
+            email                      = "[email protected]"
+            iam_user_access_to_billing = "ALLOW"
+            group_assignments = {
+              "Admins" = {
+                permission_sets = [
+                  "AdministratorAccess"
+                ]
+              }
+            },
+            user_assignments = {
+              "Alex" = {
+                permission_sets = [
+                  "Billing"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    feature_set          = "ALL",
+    enabled_policy_types = []
+  }
+}

examples/existing-account-import/README.md

@@ -0,0 +1,28 @@
+# Existing account example
+
+If an AWS account has been imported, the `iam_user_access_to_billing` setting must be set to "NULL" (`string`)
+This is because it can only be set during account creation
+
+```
+module "aws_organizations_and_sso" {
+  source  = "github.com/chris-qa-org/terraform-aws-organzation-and-sso"
+  version = "0.4.1"
+
+  region = "eu-west-2"
+
+  organization_config = {
+    units = {
+      "my-org-unit" = {
+        accounts = {
+          "my-account-name" = {
+            email                      = "[email protected]"
+            iam_user_access_to_billing = "NULL"
+          }
+        }
+      }
+    },
+    feature_set          = "ALL",
+    enabled_policy_types = []
+  }
+}
+```

examples/existing-account-import/main.tf

@@ -0,0 +1,21 @@
+module "aws_organizations_and_sso" {
+  source  = "github.com/chris-qa-org/terraform-aws-organzation-and-sso"
+  version = "0.4.1"
+
+  region = "eu-west-2"
+
+  organization_config = {
+    units = {
+      "my-org-unit" = {
+        accounts = {
+          "my-account-name" = {
+            email                      = "[email protected]"
+            iam_user_access_to_billing = "NULL"
+          }
+        }
+      }
+    },
+    feature_set          = "ALL",
+    enabled_policy_types = []
+  }
+}