Skip to content

Commit 8997dee

Browse files
kmcquadekmcquade
authored
Terraform: Add support for skip_resource_constraints and exclude_actions - Fixes #278 (#279)
* Clean up variables file and readme in Terraform modules * Fixes #278 - improved IAM policy output format, added exclude_actions and skip_resource_constraints fields
1 parent 390e9c4 commit 8997dee

File tree

12 files changed

+107
-42
lines changed

12 files changed

+107
-42
lines changed

‎.editorconfig‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
# top-most EditorConfig file
2+
root = true
3+
14
[*]
25
indent_style = space
36
indent_size = 4
@@ -16,3 +19,7 @@ max_line_length = 119
1619

1720
[docs/**.txt]
1821
max_line_length = 79
22+
23+
[*.{tf,tfvars}]
24+
indent_size = 2
25+
indent_style = space

‎README.md‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,9 @@ IAM Least Privilege Policy Generator.
1616
* [Step 1: Create the Template](#step-1--create-the-template)
1717
* [Step 2: Copy/paste ARNs](#step-2--copy-paste-arns)
1818
* [Step 3: Write-policy command](#step-3--write-policy-command)
19-
- [Cheat Sheets](#cheat-sheets)
19+
- [Cheat sheets](#cheat-sheets)
2020
* [Policy Writing cheat sheet](#policy-writing-cheat-sheet)
2121
* [IAM Database Query Cheat Sheet](#iam-database-query-cheat-sheet)
22-
* [Local Initialization (Optional)](#local-initialization--optional-)
2322
- [Other Usage](#other-usage)
2423
* [Commands](#commands)
2524
* [Python Library usage](#python-library-usage)

‎terraform_module/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@ module "policy_sentry_demo" {
3939
permissions_management_access_level = var.permissions_management_access_level
4040
wildcard_only_single_actions = var.wildcard_only_actions
4141
minimize = var.minimize
42+
skip_resource_constraints = var.skip_resource_constraints
43+
exclude_actions = var.exclude_actions
4244
}
4345
```
4446

‎terraform_module/demo/main.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,20 @@ module "policy_sentry_demo" {
88
permissions_management_access_level = var.permissions_management_access_level
99
wildcard_only_single_actions = var.wildcard_only_single_actions
1010
minimize = var.minimize
11+
skip_resource_constraints = var.skip_resource_constraints
12+
exclude_actions = var.exclude_actions
1113
}
1214

1315
terraform {
1416
required_version = "~> 0.12.8"
1517
}
18+
19+
output "iam_policy_arn" {
20+
description = "The ARN assigned by AWS to this policy."
21+
value = module.policy_sentry_demo.iam_policy_arn
22+
}
23+
24+
output "iam_policy_document" {
25+
description = "The policy document, decoded."
26+
value = jsondecode(module.policy_sentry_demo.iam_policy_document)
27+
}

‎terraform_module/demo/terraform.tfvars‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,8 @@ read_access_level = [
99
]
1010
write_access_level = [
1111
"arn:aws:kms:us-east-1:123456789012:key/shaq"
12-
]
12+
]
13+
14+
skip_resource_constraints = ["s3:GetObject"]
15+
16+
exclude_actions = ["kms:Delete*"]

‎terraform_module/demo/variables.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,3 +74,15 @@ variable "wildcard_only_permissions_management_service" {
7474
type = list(string)
7575
default = []
7676
}
77+
78+
variable "skip_resource_constraints" {
79+
description = "Skip resource constraint requirements by listing individual actions here, like s3:GetObject."
80+
type = list(string)
81+
default = []
82+
}
83+
84+
variable "exclude_actions" {
85+
description = "Exclude actions from the output by specifying them here. Accepts wildcards, like kms:Delete*"
86+
type = list(string)
87+
default = []
88+
}

‎terraform_module/iam-policies/outputs.tf‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,24 @@
11
output "iam_policy_id" {
22
description = "The policy's ID."
3-
value = aws_iam_policy.policy.*.id
3+
value = aws_iam_policy.policy.id
44
}
55

66
output "iam_policy_arn" {
77
description = "The ARN assigned by AWS to this policy."
8-
value = aws_iam_policy.policy.*.arn
8+
value = aws_iam_policy.policy.arn
99
}
1010

1111
output "iam_policy_name" {
1212
description = "The name of the policy."
13-
value = aws_iam_policy.policy.*.name
13+
value = aws_iam_policy.policy.name
1414
}
1515

1616
output "iam_policy_path" {
1717
description = "The path of the policy in IAM"
18-
value = aws_iam_policy.policy.*.path
18+
value = aws_iam_policy.policy.path
1919
}
2020

2121
output "iam_policy_document" {
2222
description = "The policy document."
23-
value = aws_iam_policy.policy.*.policy
23+
value = aws_iam_policy.policy.policy
2424
}

‎terraform_module/main.tf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ module "create_template" {
88
permissions_management_access_level = var.permissions_management_access_level
99
wildcard_only_single_actions = var.wildcard_only_single_actions
1010
minimize = var.minimize
11+
skip_resource_constraints = var.skip_resource_constraints
12+
exclude_actions = var.exclude_actions
1113
}
1214

1315
module "create_iam" {

‎terraform_module/ps-template/README.md‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -21,19 +21,19 @@ This generates the JSON policy file with Policy Sentry.
2121

2222
| Name | Description | Type | Default | Required |
2323
|------|-------------|------|---------|:--------:|
24-
| list\_access\_level | Provide a list of Amazon Resource Names (ARNs) that your role needs LIST access to. | `list` | <pre>[<br> ""<br>]</pre> | no |
24+
| list\_access\_level | Provide a list of Amazon Resource Names (ARNs) that your role needs LIST access to. | `list(string)` | `[]` | no |
2525
| minimize | If set to true, it will minimize the size of the IAM Policy file. Defaults to false. | `bool` | `false` | no |
2626
| name | The name of the rendered policy file (no file extension). | `string` | n/a | yes |
27-
| permissions\_management\_access\_level | Provide a list of Amazon Resource Names (ARNs) that your role needs PERMISSIONS MANAGEMENT access to. | `list` | <pre>[<br> ""<br>]</pre> | no |
28-
| read\_access\_level | Provide a list of Amazon Resource Names (ARNs) that your role needs READ access to. | `list` | <pre>[<br> ""<br>]</pre> | no |
29-
| tagging\_access\_level | Provide a list of Amazon Resource Names (ARNs) that your role needs TAGGING access to. | `list` | <pre>[<br> ""<br>]</pre> | no |
30-
| wildcard\_only\_list\_service | To generate a list of AWS service actions that (1) are at the LIST access level and (2) do not support resource constraints, list the service prefix here. | `list` | <pre>[<br> ""<br>]</pre> | no |
31-
| wildcard\_only\_permissions\_management\_service | To generate a list of AWS service actions that (1) are at the PERMISSIONS MANAGEMENT access level and (2) do not support resource constraints, list the service prefix here. | `list` | <pre>[<br> ""<br>]</pre> | no |
32-
| wildcard\_only\_read\_service | To generate a list of AWS service actions that (1) are at the READ access level and (2) do not support resource constraints, list the service prefix here. | `list` | <pre>[<br> ""<br>]</pre> | no |
33-
| wildcard\_only\_single\_actions | Individual actions that do not support resource constraints. For example, s3:ListAllMyBuckets | `list` | <pre>[<br> ""<br>]</pre> | no |
34-
| wildcard\_only\_tagging\_service | To generate a list of AWS service actions that (1) are at the TAGGING access level and (2) do not support resource constraints, list the service prefix here. | `list` | <pre>[<br> ""<br>]</pre> | no |
35-
| wildcard\_only\_write\_service | To generate a list of AWS service actions that (1) are at the WRITE access level and (2) do not support resource constraints, list the service prefix here. | `list` | <pre>[<br> ""<br>]</pre> | no |
36-
| write\_access\_level | Provide a list of Amazon Resource Names (ARNs) that your role needs WRITE access to. | `list` | <pre>[<br> ""<br>]</pre> | no |
27+
| permissions\_management\_access\_level | Provide a list of Amazon Resource Names (ARNs) that your role needs PERMISSIONS MANAGEMENT access to. | `list(string)` | `[]` | no |
28+
| read\_access\_level | Provide a list of Amazon Resource Names (ARNs) that your role needs READ access to. | `list(string)` | `[]` | no |
29+
| tagging\_access\_level | Provide a list of Amazon Resource Names (ARNs) that your role needs TAGGING access to. | `list(string)` | `[]` | no |
30+
| wildcard\_only\_list\_service | To generate a list of AWS service actions that (1) are at the LIST access level and (2) do not support resource constraints, list the service prefix here. | `list(string)` | `[]` | no |
31+
| wildcard\_only\_permissions\_management\_service | To generate a list of AWS service actions that (1) are at the PERMISSIONS MANAGEMENT access level and (2) do not support resource constraints, list the service prefix here. | `list(string)` | `[]` | no |
32+
| wildcard\_only\_read\_service | To generate a list of AWS service actions that (1) are at the READ access level and (2) do not support resource constraints, list the service prefix here. | `list(string)` | `[]` | no |
33+
| wildcard\_only\_single\_actions | Individual actions that do not support resource constraints. For example, s3:ListAllMyBuckets | `list(string)` | `[]` | no |
34+
| wildcard\_only\_tagging\_service | To generate a list of AWS service actions that (1) are at the TAGGING access level and (2) do not support resource constraints, list the service prefix here. | `list(string)` | `[]` | no |
35+
| wildcard\_only\_write\_service | To generate a list of AWS service actions that (1) are at the WRITE access level and (2) do not support resource constraints, list the service prefix here. | `list(string)` | `[]` | no |
36+
| write\_access\_level | Provide a list of Amazon Resource Names (ARNs) that your role needs WRITE access to. | `list(string)` | `[]` | no |
3737

3838
## Outputs
3939

‎terraform_module/ps-template/main.tf‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,9 @@ locals {
1818
"service-list" : var.wildcard_only_list_service,
1919
"service-tagging" : var.wildcard_only_tagging_service,
2020
"service-permissions-management" : var.wildcard_only_permissions_management_service,
21-
}
21+
},
22+
"exclude-actions" : var.exclude_actions,
23+
"skip-resource-constraints" : var.skip_resource_constraints
2224
}
2325
rendered_template = jsonencode(local.policy_sentry_template)
2426
decoded_template = jsondecode(jsonencode(local.policy_sentry_template))

0 commit comments

Comments
 (0)