Merge pull request #6 from rafikurnia/develop/add-max-session-duration-support

rafikurnia · web-flow · commit d025bb5f9958 · 2018-04-11T16:25:50.000+07:00
Add `max_session_duration` support
diff --git a/README.md b/README.md
@@ -1,49 +1,63 @@
 terraform-aws-iam-role
 ======================
-
 Terraform module to create AWS IAM Role. 
 Currently supported type of Roles are:
 1. Role for AWS Service
 2. Role for IAM User
 3. Role for External AWS Account
+4. Role for Instance Profile
+
 
 Usage
 -----
-
 This module will only create an IAM Role and its Trust Relationships policy document. You need to attach your own Permission policy document outside the module.
 
 To use a particular type of supported role, you can go into `modules` folder and read `README.md` at each subfolder for more detailed information.
 
 To understand better on how to implement this module, you can go into `examples` folder and try them.
 
+
 Modules
 --------
-
 * [AWS Service](https://github.com/traveloka/terraform-aws-iam-role/tree/master/modules/service)
 * [IAM User](https://github.com/traveloka/terraform-aws-iam-role/tree/master/modules/user)
 * [External AWS Account](https://github.com/traveloka/terraform-aws-iam-role/tree/master/modules/external)
+* [Instance Profile](https://github.com/traveloka/terraform-aws-iam-role/tree/master/modules/instance)
+
 
 Examples
 --------
+* [Service Role for Config](https://github.com/traveloka/terraform-aws-iam-role/tree/master/examples/aws-service-config)
+* [IAM Role for User](https://github.com/traveloka/terraform-aws-iam-role/tree/master/examples/user-iam)
+* [IAM Role for 3rd Party AWS Account](https://github.com/traveloka/terraform-aws-iam-role/tree/master/examples/external-account)
+* [IAM Role for Instance Profile](https://github.com/traveloka/terraform-aws-iam-role/tree/master/examples/instance-profile)
+
 
-* [Service Role for Config](https://github.com/traveloka/terraform-aws-iam-role/tree/master/examples/aws_service_config)
-* [IAM Role for 3rd Party AWS Account](https://github.com/traveloka/terraform-aws-iam-role/tree/master/examples/external_account)
-* [IAM Role for User](https://github.com/traveloka/terraform-aws-iam-role/tree/master/examples/user_iam)
+Tests
+-----
+To run the test:
+1. Install Ruby with version specified in the [Gemfile](https://github.com/traveloka/terraform-aws-iam-role/tree/master/Gemfile).
+2. Install bundler: `gem install bundler`
+3. Install gems: `bundle install`
+4. Run test from the root of the repository: `bundle exec kitchen test`
 
 
 Terraform Version
 -----------------
-
 This module was created using Terraform 0.11.4. 
 So to be more safe, Terraform version 0.11.4 or newer is required to use this module.
 
 
+AWS Provider Version
+--------------------
+Minimum required version for AWS Provider is 1.14.0
+
+
 Authors
 -------
-
 * [Rafi Kurnia Putra](https://github.com/rafikurnia)
 
+
 License
 -------
-
-Apache 2 Licensed. See LICENSE for full details.
+Apache 2 Licensed. See LICENSE for full details.
diff --git a/examples/aws-service-config/README.md b/examples/aws-service-config/README.md
@@ -0,0 +1,4 @@
+example/aws_service_config
+==========================
+
+This example will create an IAM Role for AWS Config.
diff --git a/examples/aws-service-config/main.tf b/examples/aws-service-config/main.tf
@@ -1,15 +1,18 @@
 provider "aws" {
-  version = "~> 1.13.0"
-  region  = "ap-southeast-1"
+  region = "ap-southeast-1"
 }
 
 module "this" {
-  source = "../../modules/service" # In actual use case, you have to replace this line with: source = "github.com/traveloka/terraform-aws-iam-role.git//modules/service?ref=0.0.1"
+  # In actual use case, you have to replace the following line (line 8) with: 
+  # source = "github.com/traveloka/terraform-aws-iam-role.git//modules/service?ref=v0.3.0"
+  source = "../../modules/service"
 
   role_identifier            = "Default Config"
   role_description           = "Service Role for Default AWS Config"
   role_force_detach_policies = false
-  aws_service                = "config.amazonaws.com"
+  role_max_session_duration  = 43200
+
+  aws_service = "config.amazonaws.com"
 }
 
 resource "aws_iam_role_policy_attachment" "this" {
diff --git a/examples/aws-service-config/outputs.tf b/examples/aws-service-config/outputs.tf
diff --git a/examples/aws_service_config/README.md b/examples/aws_service_config/README.md
diff --git a/examples/external-account/README.md b/examples/external-account/README.md
diff --git a/examples/external-account/main.tf b/examples/external-account/main.tf
@@ -1,19 +1,20 @@
-# This example was created using terraform-provider-aws version 1.13.0 at 2018/04/03.
 provider "aws" {
-  version = "~> 1.13.0"
-  region  = "ap-southeast-1"
+  region = "ap-southeast-1"
 }
 
 module "this" {
-  source = "../../modules/external" # In actual use case, you have to replace this line with: source = "github.com/traveloka/terraform-aws-iam-role.git//modules/external?ref=0.0.1"
+  # In actual use case, you have to replace the following line (line 8) with:
+  # source = "github.com/traveloka/terraform-aws-iam-role.git//modules/external?ref=v0.3.0"
+  source = "../../modules/external"
 
   role_name                  = "ThirdPartyName"      # Replace this value with the name given by 3rd party, or define it by yourself with clear and describing name
   role_path                  = "/external/security/"
   role_description           = "Role for ThirdParty"
   role_force_detach_policies = true
+  role_max_session_duration  = 43200
 
   account_id  = "123456789012" # Replace this with 3rd party's AWS Account ID
-  external_id = "ABCDEFGHIJ01" # Only set this value if the 3rd party ask you to
+  external_id = "ABCDEFGHIJ01" # Don't set the value if not needed, only set this value if the 3rd party ask you to specify external_id.
 }
 
 resource "aws_iam_role_policy_attachment" "this" {
diff --git a/examples/external-account/outputs.tf b/examples/external-account/outputs.tf
diff --git a/examples/instance-profile/main.tf b/examples/instance-profile/main.tf
@@ -1,10 +1,11 @@
 provider "aws" {
-  version = "1.13.0"
-  region  = "ap-southeast-1"
+  region = "ap-southeast-1"
 }
 
 module "this" {
-  source = "../../modules/instance" # In actual use case, you have to replace this line with: source = "github.com/traveloka/terraform-aws-iam-role.git//modules/instance?ref=0.2.0"
+  # In actual use case, you have to replace the following line (line 8) with:
+  # source = "github.com/traveloka/terraform-aws-iam-role.git//modules/instance?ref=v0.3.0"
+  source = "../../modules/instance"
 
   service_name = "txtdata"
   cluster_role = "app"
diff --git a/examples/user-iam/README.md b/examples/user-iam/README.md
diff --git a/examples/user-iam/main.tf b/examples/user-iam/main.tf
@@ -1,19 +1,20 @@
-# This example was created using terraform-provider-aws version 1.13.0 at 2018/04/03.
 provider "aws" {
-  version = "~> 1.13.0"
-  region  = "ap-southeast-1"
+  region = "ap-southeast-1"
 }
 
 module "this" {
-  source = "../../modules/user" # In actual use case, you have to replace this line with: source = "github.com/traveloka/terraform-aws-iam-role.git//modules/user?ref=0.0.1"
+  # In actual use case, you have to replace the following line (line 8) with:
+  # source = "github.com/traveloka/terraform-aws-iam-role.git//modules/user?ref=v0.3.0"
+  source = "../../modules/user"
 
   role_name                  = "SuperAdmin"
-  role_path                  = "/mgmt/"                                       # mgmt stands for management. They will have access to manage the entire resources within the account
-  role_description           = "Role for Users with Administrator Privillege"
+  role_path                  = "/mgmt/"                                   # mgmt stands for management. They have access to manage all resources within the account.
+  role_description           = "Role for Users with Administrator Access"
   role_force_detach_policies = true
+  role_max_session_duration  = 43200
 
   trusted_users = [
-    "arn:aws:iam::123456789012:user/rafi.putra", # In actual use case, you have to replace this line with correct IAM User ARN
+    "arn:aws:iam::123456789012:user/rafi.putra", # In actual use case, you have to replace this line with correct IAM User ARN.
   ]
 
   mfa_required = true # Set this value to false only when needed
diff --git a/examples/user-iam/outputs.tf b/examples/user-iam/outputs.tf
diff --git a/main.tf b/main.tf
@@ -1,6 +1,11 @@
 # This module was updated using terraform 0.11.4 at 2018/03/26.
 terraform {
-  required_version = ">= 0.11.4"
+  required_version = "~> 0.11.4"
+}
+
+# Added provider AWS version constraint. `max_session_duration` is supported on 1.14.0
+provider "aws" {
+  version = "~> 1.14"
 }
 
 # Get the access to the effective Account ID, User ID, and ARN in which Terraform is authorized.
@@ -14,4 +19,5 @@ resource "aws_iam_role" "this" {
 
   assume_role_policy    = "${var.role_assume_policy}"
   force_detach_policies = "${var.role_force_detach_policies}"
+  max_session_duration  = "${var.role_max_session_duration}"
 }
diff --git a/modules/external/README.md b/modules/external/README.md
@@ -1,16 +1,15 @@
 terraform-aws-iam-role/external
 ===============================
-
 This module is meant to create IAM Role for 3rd party or another AWS Account.
 
+
 Usage
 -----
-
 You can open this example: [IAM Role for 3rd Party AWS Account](https://github.com/traveloka/terraform-aws-iam-role/tree/master/examples/external_account)
 
+
 Important Notes
 ---------------
-
 * `role_path` should begin and end with a forward slash. Examples:
   * `role_path = "/external/"` -> Valid
   * `role_path = "/external"` -> Invalid
@@ -23,21 +22,3 @@ Important Notes
   * `role_path = "/external/vendors/special/"` -> IAM Role's Path = /external/vendors/special/
   * `role_path = "/vendors/special/"` -> IAM Role's Path = /external/vendors/special/
 * `external_id` is optional. Use this only when the 3rd party provides you an ID.
-
-
-Terraform Version
------------------
-
-This module was created using Terraform 0.11.4. 
-So to be more safe, Terraform version 0.11.4 or newer is required to use this module.
-
-
-Authors
--------
-
-* [Rafi Kurnia Putra](https://github.com/rafikurnia)
-
-License
--------
-
-Apache 2 Licensed. See LICENSE for full details.
diff --git a/modules/external/main.tf b/modules/external/main.tf
@@ -1,5 +1,5 @@
 provider "null" {
-  version = "~> 1.0"
+  version = "1.0.0"
 }
 
 # Work around to throws an exception. 
@@ -54,4 +54,5 @@ module "this" {
 
   role_assume_policy         = "${var.external_id == "" ? data.aws_iam_policy_document.without_external_id.json : data.aws_iam_policy_document.with_external_id.json}"
   role_force_detach_policies = "${var.role_force_detach_policies}"
+  role_max_session_duration  = "${var.role_max_session_duration}"
 }
diff --git a/modules/external/variables.tf b/modules/external/variables.tf
@@ -29,3 +29,8 @@ variable "external_id" {
   type        = "string"
   default     = ""
 }
+
+variable "role_max_session_duration" {
+  description = "The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours."
+  default     = 3600
+}
diff --git a/modules/instance/README.md b/modules/instance/README.md
@@ -1,9 +1,8 @@
 terraform-aws-iam-role/instance
 ===============================
-
 This module allows you to create an IAM Instance Profile with an IAM Role attached to it.
 
+
 Usage
 -----
-
 You can open this example: [Instance Profile](https://github.com/traveloka/terraform-aws-iam-role/tree/master/examples/instance-profile)
diff --git a/modules/instance/main.tf b/modules/instance/main.tf
@@ -44,6 +44,7 @@ module "this" {
 
   role_assume_policy         = "${data.aws_iam_policy_document.this.json}"
   role_force_detach_policies = "${var.role_force_detach_policies}"
+  role_max_session_duration  = "${var.role_max_session_duration}"
 }
 
 # Provides an IAM instance profile.
diff --git a/modules/instance/variables.tf b/modules/instance/variables.tf
@@ -12,3 +12,8 @@ variable "role_force_detach_policies" {
   description = "Specifies to force detaching any policies the role has before destroying it."
   default     = false
 }
+
+variable "role_max_session_duration" {
+  description = "The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours."
+  default     = 3600
+}
diff --git a/modules/service/README.md b/modules/service/README.md
@@ -1,13 +1,13 @@
 terraform-aws-iam-role/service
 ==============================
-
 This module allows you to create an IAM Role for AWS service to perform actions on your behalf.
 
+
 Usage
 -----
-
 You can open this example: [Service Role for Config](https://github.com/traveloka/terraform-aws-iam-role/tree/master/examples/aws_service_config)
 
+
 Important Notes
 ---------------
 * `aws_service` is string variable, this module is able to create IAM Role only for just one service.
@@ -19,20 +19,3 @@ Important Notes
 * IAM Role that is created will have name in this format: "ServiceRoleFor<`aws_service_prefix`>_<`role_identifier`>" (`aws_service_prefix` is `aws_service` without `.amazonaws.com`). `aws_service_prefix` will be capitalized and `role_identifier` will be in lowercase and separated by dash (-). Examples:
   * `ServiceRoleForLambda_example-lambda`
   * `ServiceRoleForEc2_production-backend`
-
-Terraform Version
------------------
-
-This module was created using Terraform 0.11.4. 
-So to be more safe, Terraform version 0.11.4 or newer is required to use this module.
-
-
-Authors
--------
-
-* [Rafi Kurnia Putra](https://github.com/rafikurnia)
-
-License
--------
-
-Apache 2 Licensed. See LICENSE for full details.
diff --git a/modules/service/main.tf b/modules/service/main.tf
@@ -1,5 +1,5 @@
 provider "random" {
-  version = "~> 1.1"
+  version = "1.2.0"
 }
 
 # Contains local values that are used to increase DRYness of the code.
@@ -43,4 +43,5 @@ module "this" {
 
   role_assume_policy         = "${data.aws_iam_policy_document.this.json}"
   role_force_detach_policies = "${var.role_force_detach_policies}"
+  role_max_session_duration  = "${var.role_max_session_duration}"
 }
diff --git a/modules/service/variables.tf b/modules/service/variables.tf
@@ -17,3 +17,8 @@ variable "aws_service" {
   description = "AWS service that are allowed to perform actions granted on your behalf. Example value: 'config.amazonaws.com'"
   type        = "string"
 }
+
+variable "role_max_session_duration" {
+  description = "The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours."
+  default     = 3600
+}
diff --git a/modules/user/README.md b/modules/user/README.md
@@ -1,30 +1,13 @@
 terraform-aws-iam-role/user
 ===========================
-
 This module allows you to create an IAM Role for User.
 
+
 Usage
 -----
-
 You can open this example: [IAM Role for User](https://github.com/traveloka/terraform-aws-iam-role/tree/master/examples/user_iam)
 
+
 Important Notes
 ---------------
 * `mfa_required` is optional variable, default to `true`, and recommended value is also `true`. Only set the value to `false` if the user can not use MFA.
-
-Terraform Version
------------------
-
-This module was created using Terraform 0.11.4. 
-So to be more safe, Terraform version 0.11.4 or newer is required to use this module.
-
-
-Authors
--------
-
-* [Rafi Kurnia Putra](https://github.com/rafikurnia)
-
-License
--------
-
-Apache 2 Licensed. See LICENSE for full details.
diff --git a/modules/user/main.tf b/modules/user/main.tf
@@ -40,4 +40,5 @@ module "this" {
 
   role_assume_policy         = "${var.mfa_required ? data.aws_iam_policy_document.with_mfa.json : data.aws_iam_policy_document.without_mfa.json}"
   role_force_detach_policies = "${var.role_force_detach_policies}"
+  role_max_session_duration  = "${var.role_max_session_duration}"
 }
diff --git a/modules/user/variables.tf b/modules/user/variables.tf
@@ -29,3 +29,8 @@ variable "mfa_required" {
   type        = "string"
   default     = "true"
 }
+
+variable "role_max_session_duration" {
+  description = "The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours."
+  default     = 3600
+}
diff --git a/variables.tf b/variables.tf
