Skip to content

Commit 4788af4

Browse files
chelseybeckchelseybeck
authored
Merge pull request #1 from hackforla/cb/example
adding mvp terraform config for aws iam resources
2 parents a093b0f + 3784b59 commit 4788af4

39 files changed

+1006
-395
lines changed

‎.gitignore

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Local .terraform directories
2+
**/.terraform/*
3+
4+
# Ignore variables files
5+
*.auto.tfvars
6+
7+
# Ignore override files
8+
*.tfoverride
9+
10+
# Ignore environment-specific files
11+
.envrc
12+
13+
# Ignore CLI configuration files
14+
.terraformrc
15+
terraform.rc
16+
17+
# Ignore metadata files
18+
*.tfstate.lock.info

‎CONTRIBUTING.md

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
## Local Development/Installation instructions
2+
3+
Step-by-step instructions help new contributors get a development environment up and running quickly.
4+
2. You'll want to find the balance between being specific enough for novices to follow, without being so specific that you reinvent the wheel by providing overly-basic instructions that can be found elsewhere.
5+
3. Feel free to adapt this section and its sub-sections to your own processes.
6+
4. Alternatively, you can move everything from *Installation instructions* through *Testing* to a separate **Contributing.md** file to keep your **ReadMe.md** more succinct.
7+
8+
9+
### Working with issues
10+
11+
- Explain how to contribute to an existing issue.
12+
13+
### Working with forks and branches
14+
15+
- Explain your guidelines here.
16+
17+
18+
### Working with pull requests and reviews
19+
20+
- Explain your process.

‎LICENSE

Lines changed: 21 additions & 339 deletions
Large diffs are not rendered by default.

‎README.md

Lines changed: 9 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -1,73 +1,26 @@
1-
# Project title and description
1+
# DevOps Security | AWS IAM Resources
22

3-
Include a project description that explains **what** your project is and **why** it exists. Aim for no more than 3-5 concise sentences. For example, you might say:
4-
5-
{Project Name} is a project of Hack for LA. Hack for LA is a brigade of a Code for America that exists to {your mission}. {Project Name} helps {target users} accomplish {goal of project}. The {app/site/thing you're building}'s main features include {very brief feature descriptions}.
6-
7-
### Project context
8-
9-
Civic projects often exist within a larger context that may include multiple stakeholders, historic relationships, associated research, or other details that are relevant but not *required* for direct contributions. Gathering these details in one place is useful, but the ReadMe isn't that place. Use this section to [link to a Google Doc](#) or other documentation repository where contributors can dig in if they so choose. This is also a good place to link to your Code of Conduct.
3+
DevOps Security is a code repository used to maintain Hack for L.A.'s AWS Identity Access Management (IAM) resources as code. This includes users, groups, policies, and roles.
104

115
### Technology used
126

13-
- Each platform or framework should get its own bullet.
14-
- Each platform should include an [active link](#) to the official documentation.
15-
16-
7+
- [Terraform](https://www.terraform.io/)
8+
- [Terraform Docs](https://terraform-docs.io/)
9+
- [AWS CLI](https://aws.amazon.com/cli/)
1710

1811
# How to contribute
1912

20-
Explain the different ways people can contribute. For example:
21-
22-
- Join the team {on Slack/at our weekly hack night/etc}.
23-
- To help with user research, {do ABC}.
24-
- To provide design support, {do XYZ}.
25-
- To contribute to the code, follow the instructions below.
26-
27-
Remember to provide direct links to each channel.
28-
29-
30-
31-
## Installation instructions
32-
33-
1. Step-by-step instructions help new contributors get a development environment up and running quickly.
34-
2. You'll want to find the balance between being specific enough for novices to follow, without being so specific that you reinvent the wheel by providing overly-basic instructions that can be found elsewhere.
35-
3. Feel free to adapt this section and its sub-sections to your own processes.
36-
4. Alternatively, you can move everything from *Installation instructions* through *Testing* to a separate **Contributing.md** file to keep your **ReadMe.md** more succinct.
37-
38-
39-
### Working with issues
40-
41-
- Explain how to submit a bug.
42-
- Explain how to submit a feature request.
43-
- Explain how to contribute to an existing issue.
44-
45-
To create a new issue, please use the blank issue template (available when you click New Issue). If you want to create an issue for other projects to use, please create the issue in your own repository and send a slack message to one of your hack night hosts with the link.
46-
47-
48-
### Working with forks and branches
49-
50-
- Explain your guidelines here.
51-
52-
53-
### Working with pull requests and reviews
54-
55-
- Explain your process.
56-
57-
58-
### Testing
59-
60-
- Provide instructions.
61-
13+
- Join the DevOps Community of Practice (CoP).
14+
- To contribute to the codebase, follow the [CONTRIBUTING.md](CONTRIBUTING.md) guide.
6215

6316

6417
# Contact info
6518

66-
Include at least one way (or more, if possible) to reach your team with questions or comments.
19+
This repo is maintained by the DevOps team. Reach out to our [CoP leads](https://github.com/hackforla/ops/wiki/Community#ops-community-of-practice-cop-leads) on Slack with questions or attend a [community meeting](https://github.com/hackforla/ops/wiki/CoP-Meetings)
6720

6821

6922
### Licensing
7023

71-
Include details about the project's open source status.
24+
[MIT License](/LICENSE)
7225

7326
*this readme file sourced from [Jessica Sand](http://jessicasand.com/other-stuff/just-enough-docs/)*

‎terraform/.terraform.docs.yml

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
formatter: "markdown table" # this is required
2+
version: ""
3+
4+
header-from: main.tf
5+
footer-from: ""
6+
7+
recursive:
8+
enabled: false
9+
path: modules
10+
11+
sections:
12+
hide: []
13+
show: []
14+
15+
content: |-
16+
# Overview
17+
Resources created by this code repository.
18+
19+
{{ .Header }}
20+
{{ .Modules }}
21+
{{ .Resources }}
22+
{{ .Inputs }}
23+
{{ .Outputs }}
24+
{{ .Providers }}
25+
{{ .Requirements }}
26+
{{ .Footer }}
27+
28+
# Directory Structure
29+
Terraform directory structure
30+
31+
- 📁 [terraform](https://github.com/hackforla/ops-security/tree/cb/example/terraform)
32+
- 📁 [aws-custom-policies](https://github.com/hackforla/ops-security/tree/cb/example/terraform/aws-custom-policies) - JSON configurations for customer-managed policies (AWS-managed policies are referenced by ARN and not needed here)
33+
- 📁 [existing-policies](https://github.com/hackforla/ops-security/tree/cb/example/terraform/aws-custom-policies/existing-policies) - a few of our current policy configurations for reference
34+
- 📁 [modules](https://github.com/hackforla/ops-security/tree/cb/example/terraform/modules) - reusable Terraform configurations
35+
- 📄 [aws-custom-policies.tf](https://github.com/hackforla/ops-security/tree/cb/example/terraform/modules/aws-groups) - maintain custom policies here
36+
- 📄 [aws-groups.tf](https://github.com/hackforla/ops-security/tree/cb/example/terraform/modules/aws-groups) - maintain groups here
37+
- 📄 [aws-users.tf](https://github.com/hackforla/ops-security/tree/cb/example/terraform/modules/aws-users) - maintain users here
38+
39+
To automatically update this documentation, install terraform-docs on your local machine run the following:
40+
`cd <directory of README location to update>`
41+
`terraform-docs -c .terraform.docs.yml .`
42+
output:
43+
file: README.md
44+
mode: replace
45+
template: |-
46+
<!-- BEGIN_TF_DOCS -->
47+
{{ .Content }}
48+
<!-- END_TF_DOCS -->
49+
50+
output-values:
51+
enabled: false
52+
from: ""
53+
54+
sort:
55+
enabled: true
56+
by: name
57+
58+
settings:
59+
anchor: true
60+
color: true
61+
default: true
62+
description: false
63+
escape: true
64+
hide-empty: true
65+
html: true
66+
indent: 2
67+
lockfile: true
68+
read-comments: true
69+
required: true
70+
sensitive: true
71+
type: true

‎terraform/.terraform.lock.hcl

Lines changed: 24 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎terraform/README.md

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
<!-- BEGIN_TF_DOCS -->
2+
# Overview
3+
Resources created by this code repository.
4+
5+
6+
## Modules
7+
8+
| Name | Source | Version |
9+
|------|--------|---------|
10+
| <a name="module_iam_read_only_group"></a> [iam\_read\_only\_group](#module\_iam\_read\_only\_group) | ./modules/aws-groups | n/a |
11+
| <a name="module_iam_user_gwenstacy"></a> [iam\_user\_gwenstacy](#module\_iam\_user\_gwenstacy) | ./modules/aws-users | n/a |
12+
13+
14+
15+
16+
17+
18+
19+
# Directory Structure
20+
Terraform directory structure
21+
22+
- 📁 [terraform](https://github.com/hackforla/ops-security/tree/cb/example/terraform)
23+
- 📁 [aws-custom-policies](https://github.com/hackforla/ops-security/tree/cb/example/terraform/aws-custom-policies) - JSON configurations for customer-managed policies (AWS-managed policies are referenced by ARN and not needed here)
24+
- 📁 [existing-policies](https://github.com/hackforla/ops-security/tree/cb/example/terraform/aws-custom-policies/existing-policies) - a few of our current policy configurations for reference
25+
- 📁 [modules](https://github.com/hackforla/ops-security/tree/cb/example/terraform/modules) - reusable Terraform configurations
26+
- 📄 [aws-custom-policies.tf](https://github.com/hackforla/ops-security/tree/cb/example/terraform/modules/aws-groups) - maintain custom policies here
27+
- 📄 [aws-groups.tf](https://github.com/hackforla/ops-security/tree/cb/example/terraform/modules/aws-groups) - maintain groups here
28+
- 📄 [aws-users.tf](https://github.com/hackforla/ops-security/tree/cb/example/terraform/modules/aws-users) - maintain users here
29+
30+
To automatically update this documentation, install terraform-docs on your local machine run the following:
31+
`cd <directory of README location to update>`
32+
`terraform-docs -c .terraform.docs.yml .`
33+
<!-- END_TF_DOCS -->

‎terraform/aws-custom-policies/existing-policies/manage-access-keys-policy.json

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Sid": "ListUsersForConsole",
6+
"Effect": "Allow",
7+
"Action": "iam:ListUsers",
8+
"Resource": "arn:aws:iam::*:*"
9+
},
10+
{
11+
"Sid": "ViewAndUpdateAccessKeys",
12+
"Effect": "Allow",
13+
"Action": [
14+
"iam:UpdateAccessKey",
15+
"iam:CreateAccessKey",
16+
"iam:ListAccessKeys"
17+
],
18+
"Resource": "arn:aws:iam::*:user/*"
19+
}
20+
]
21+
}

‎terraform/aws-custom-policies/existing-policies/self-manage-credentials-policy.json

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Sid": "AllowViewAccountInfo",
6+
"Effect": "Allow",
7+
"Action": [
8+
"iam:GetAccountPasswordPolicy",
9+
"iam:GetAccountSummary"
10+
],
11+
"Resource": "*"
12+
},
13+
{
14+
"Sid": "AllowManageOwnPasswords",
15+
"Effect": "Allow",
16+
"Action": [
17+
"iam:ChangePassword",
18+
"iam:GetUser"
19+
],
20+
"Resource": "arn:aws:iam::*:user/${aws:username}"
21+
},
22+
{
23+
"Sid": "AllowManageOwnAccessKeys",
24+
"Effect": "Allow",
25+
"Action": [
26+
"iam:CreateAccessKey",
27+
"iam:DeleteAccessKey",
28+
"iam:ListAccessKeys",
29+
"iam:UpdateAccessKey"
30+
],
31+
"Resource": "arn:aws:iam::*:user/${aws:username}"
32+
},
33+
{
34+
"Sid": "AllowManageOwnSSHPublicKeys",
35+
"Effect": "Allow",
36+
"Action": [
37+
"iam:DeleteSSHPublicKey",
38+
"iam:GetSSHPublicKey",
39+
"iam:ListSSHPublicKeys",
40+
"iam:UpdateSSHPublicKey",
41+
"iam:UploadSSHPublicKey"
42+
],
43+
"Resource": "arn:aws:iam::*:user/${aws:username}"
44+
}
45+
]
46+
}

‎terraform/aws-custom-policies/existing-policies/terraform-policy.json

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Sid": "VisualEditor0",
6+
"Effect": "Allow",
7+
"Action": [
8+
"elasticloadbalancing:DescribeTargetGroupAttributes",
9+
"elasticloadbalancing:DescribeTags",
10+
"s3:ListAllMyBuckets",
11+
"ecr:GetRegistryScanningConfiguration"
12+
],
13+
"Resource": "*"
14+
},
15+
{
16+
"Sid": "RDS",
17+
"Effect": "Allow",
18+
"Action": [
19+
"rds:DescribeDBInstances",
20+
"rds:DescribeDBClusters",
21+
"rds:DescribeGlobalClusters",
22+
"rds:DescribeDBInstances"
23+
],
24+
"Resource": "*"
25+
}
26+
]
27+
}

0 commit comments

Comments
 (0)