Support creating new IAM users in IAM module

[Hoàng Mirs]

Why

Currently, we are still creating IAM groups & accounts manually from the AWS console. We should support creating them with Terraform.

Typically, the following groups should be created

• Admins: admin access
• Developers:
  • PowerUser access
  • Additional custom policies must be created so the users of this group can
    • Manage their access key: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#access-keys_required-permissions
    • Manage their own MFA: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws_my-sec-creds-self-manage-mfa-only.html
• Bots:
  • No console access
  • Additional Policy to allow manage roles & policies, e.g.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowManageRoleAndPolicy",
            "Effect": "Allow",
            "Action": [
                "iam:UpdateRoleDescription",
                "iam:UpdateRole",
                "iam:UpdateAssumeRolePolicy",
                "iam:UntagUser",
                "iam:UntagServerCertificate",
                "iam:UntagSAMLProvider",
                "iam:UntagRole",
                "iam:UntagPolicy",
                "iam:UntagOpenIDConnectProvider",
                "iam:UntagMFADevice",
                "iam:UntagInstanceProfile",
                "iam:TagUser",
                "iam:TagServerCertificate",
                "iam:TagSAMLProvider",
                "iam:TagRole",
                "iam:TagPolicy",
                "iam:TagOpenIDConnectProvider",
                "iam:TagMFADevice",
                "iam:TagInstanceProfile",
                "iam:SimulatePrincipalPolicy",
                "iam:SimulateCustomPolicy",
                "iam:SetDefaultPolicyVersion",
                "iam:RemoveRoleFromInstanceProfile",
                "iam:PutRolePolicy",
                "iam:PutRolePermissionsBoundary",
                "iam:PassRole",
                "iam:ListVirtualMFADevices",
                "iam:ListUsers",
                "iam:ListUserTags",
                "iam:ListUserPolicies",
                "iam:ListSigningCertificates",
                "iam:ListServiceSpecificCredentials",
                "iam:ListServerCertificates",
                "iam:ListServerCertificateTags",
                "iam:ListSSHPublicKeys",
                "iam:ListSAMLProviders",
                "iam:ListSAMLProviderTags",
                "iam:ListRoles",
                "iam:ListRoleTags",
                "iam:ListRolePolicies",
                "iam:ListPolicyVersions",
                "iam:ListPolicyTags",
                "iam:ListPoliciesGrantingServiceAccess",
                "iam:ListPolicies",
                "iam:ListOpenIDConnectProviders",
                "iam:ListOpenIDConnectProviderTags",
                "iam:ListMFADevices",
                "iam:ListMFADeviceTags",
                "iam:ListInstanceProfilesForRole",
                "iam:ListInstanceProfiles",
                "iam:ListInstanceProfileTags",
                "iam:ListGroupsForUser",
                "iam:ListGroups",
                "iam:ListGroupPolicies",
                "iam:ListEntitiesForPolicy",
                "iam:ListAttachedUserPolicies",
                "iam:ListAttachedRolePolicies",
                "iam:ListAttachedGroupPolicies",
                "iam:ListAccountAliases",
                "iam:ListAccessKeys",
                "iam:GetServiceLinkedRoleDeletionStatus",
                "iam:GetRolePolicy",
                "iam:GetRole",
                "iam:GetPolicyVersion",
                "iam:GetPolicy",
                "iam:GetLoginProfile",
                "iam:GetAccountSummary",
                "iam:DetachRolePolicy",
                "iam:DeleteServiceLinkedRole",
                "iam:DeleteRolePolicy",
                "iam:DeleteRolePermissionsBoundary",
                "iam:DeleteRole",
                "iam:DeletePolicyVersion",
                "iam:DeletePolicy",
                "iam:CreateServiceLinkedRole",
                "iam:CreateRole",
                "iam:CreatePolicyVersion",
                "iam:CreatePolicy",
                "iam:AttachRolePolicy",
                "iam:AddRoleToInstanceProfile"
            ],
            "Resource": "arn:aws:iam::*"
        }
    ]
}

The users should be created and assigned to the appropriate groups.

• The bot account will be used by Terraform Cloud to provide the infrastructure.
• PR for reference: https://github.com/easyhoteluk/aws-infrastructure/pull/107/files (credit to @bterone)

Who Benefits?

Developers