Skip to content

Commit 47ef687

Browse files
ShivaniBankeShivaniBanke
committed
chore : refactor the sub module
1 parent 23468c2 commit 47ef687

File tree

12 files changed

+246
-80
lines changed

12 files changed

+246
-80
lines changed

‎examples/create-permission-set/locals.tf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
locals {
2+
aws_region = "us-east-1"
3+
}

‎examples/create-permission-set/main.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
module "permission_sets" {
2+
source = "../../modules/permission_sets"
3+
4+
permission_sets = var.permission_sets
5+
}

‎examples/create-permission-set/outputs.tf‎

Whitespace-only changes.

‎examples/create-permission-set/provider.tf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
provider "aws" {
2+
region = local.aws_region
3+
}

‎examples/create-permission-set/variables.tf‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
variable "permission_sets" {
2+
description = <<EOF
3+
(Required)A map of permission set objects with key as the permission set name. Each object contains:
4+
- name: The name of the permission set.
5+
- description: A brief description of the permission set.
6+
- session_duration: Optional session duration for the permission set (default is null).
7+
- relay_state: Optional relay state for the permission set (default is null).
8+
- tags: Optional map of tags to associate with the permission set.
9+
- inline_policy: The inline policy content in JSON format.
10+
- managed_policies: A list of ARNs of managed policies to attach to the permission set.
11+
- customer_managed_policies: A list of customer-managed policies to attach to the permission set. Each policy includes:
12+
- name: The name of the customer-managed policy.
13+
- path: The path of the customer-managed policy (default is "/").
14+
EOF
15+
type = map(object({
16+
name = string
17+
description = string
18+
session_duration = optional(string, null)
19+
relay_state = optional(string, null)
20+
tags = optional(map(string))
21+
inline_policy = string
22+
managed_policies = list(string)
23+
customer_managed_policies = list(object({
24+
name = string
25+
path = optional(string, "/")
26+
}))
27+
}))
28+
}
29+
30+
variable "tags" {
31+
description = "(Optional) Key-value map of resource tags."
32+
type = map(string)
33+
default = null
34+
}

‎modules/permission_sets/README.md‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,3 @@
1-
# Terraform AWS Organizations Permission-Sets Module
2-
A Terraform module for creating and managing AWS SSO (Single Sign-On) Permission Sets within AWS Organizations
3-
41
## Requirements
52

63
| Name | Version |
@@ -12,7 +9,7 @@ A Terraform module for creating and managing AWS SSO (Single Sign-On) Permission
129

1310
| Name | Version |
1411
|------|---------|
15-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.57.0 |
12+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.58.0 |
1613

1714
## Modules
1815

@@ -32,7 +29,7 @@ No modules.
3229

3330
| Name | Description | Type | Default | Required |
3431
|------|-------------|------|---------|:--------:|
35-
| <a name="input_permission_sets"></a> [permission\_sets](#input\_permission\_sets) | n/a | <pre>list(object({<br> name = string<br> description = string<br> session_duration = optional(string, "PT1H")<br> tags = optional(map(string), null)<br> inline_policy = optional(string, null) # Inline policy in JSON format <br> managed_policies = optional(list(string), []) # list of ARN's of managed policies<br> customer_managed_policies = optional(list(object({<br> name = string<br> path = optional(string, "/") # list of customer-managed policies with their names and paths to be attached to each.<br> })), [])<br> }))</pre> | `[]` | no |
32+
| <a name="input_permission_sets"></a> [permission\_sets](#input\_permission\_sets) |(Required) A map of permission set objects with permission set name as the key. Each object contains:<br> - name: The name of the permission set.<br> - description: A brief description of the permission set.<br> - session\_duration: Optional session duration for the permission set (default is PT1H).<br> - relay\_state: Optional relay state for the permission set (default is null).<br> - tags: Optional map of tags to associate with the permission set.<br> - inline\_policy: The inline policy content in JSON format.<br> - managed\_policies: A list of ARNs of managed policies to attach to the permission set.<br> - customer\_managed\_policies: A list of customer-managed policies to attach to the permission set. Each policy includes:<br> - name: The name of the customer-managed policy.<br> - path: The path of the customer-managed policy (default is "/"). | <pre>map(object({<br> name = string<br> description = string<br> session_duration = optional(string, null)<br> relay_state = optional(string, null)<br> tags = optional(map(string))<br> inline_policy = string # Inline policy <br> managed_policies = list(string) # list of ARN's of managed policies<br> customer_managed_policies = list(object({<br> name = string<br> path = optional(string, "/") # list of customer-managed policies with their names and paths to be attached to each.<br> }))<br> }))</pre> | n/a | yes |
3633
| <a name="input_tags"></a> [tags](#input\_tags) | (Optional) Key-value map of resource tags. | `map(string)` | `null` | no |
3734

3835
## Outputs

‎modules/permission_sets/data.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
data "aws_ssoadmin_instances" "default" {}

‎modules/permission_sets/locals.tf‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
locals {
2+
sso_instance_arn = tolist(data.aws_ssoadmin_instances.default.arns)[0]
3+
permission_set_map = { for ps_name, ps in var.permission_sets : ps_name => ps }
4+
inline_policies_map = { for ps_name, ps in var.permission_sets : ps_name => ps.inline_policy if ps.inline_policy != "" }
5+
managed_policy_map = { for ps_name, ps in var.permission_sets : ps_name => ps.managed_policies if length(ps.managed_policies) > 0 }
6+
managed_policy_attachments = flatten([
7+
for ps_name, policy_list in local.managed_policy_map : [
8+
for policy_arn in policy_list : {
9+
ps_name = ps_name
10+
policy_arn = policy_arn
11+
}
12+
]
13+
])
14+
managed_policy_attachments_map = {
15+
for policy in local.managed_policy_attachments : "${policy.ps_name}.${policy.policy_arn}" => policy
16+
}
17+
customer_managed_policy_map = { for ps_name, ps in var.permission_sets : ps_name => ps.customer_managed_policies if length(ps.customer_managed_policies) > 0 }
18+
customer_managed_policy_attachments = flatten([
19+
for ps_name, policy_list in local.customer_managed_policy_map : [
20+
for policy in policy_list : {
21+
ps_name = ps_name
22+
policy_name = policy.name
23+
policy_path = policy.path
24+
}
25+
]
26+
])
27+
customer_managed_policy_attachments_map = {
28+
for policy in local.customer_managed_policy_attachments : "${policy.ps_name}.${policy.policy_path}${policy.policy_name}" => policy
29+
}
30+
}

‎modules/permission_sets/main.tf‎

Lines changed: 11 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,3 @@
1-
locals {
2-
sso_instance_arn = tolist(data.aws_ssoadmin_instances.this.arns)[0]
3-
permission_set_map = { for ps in var.permission_sets : ps.name => ps }
4-
inline_policies_map = { for ps in var.permission_sets : ps.name => ps.inline_policy if ps.inline_policy != null }
5-
managed_policy_map = { for ps in var.permission_sets : ps.name => ps.managed_policies if length(ps.managed_policies) > 0 }
6-
managed_policy_attachments = flatten([
7-
for ps_name, policy_list in local.managed_policy_map : [
8-
for policy_arn in policy_list : {
9-
permission_set = ps_name
10-
policy_arn = policy_arn
11-
}
12-
]
13-
])
14-
managed_policy_attachments_map = {
15-
for policy in local.managed_policy_attachments : "${policy.permission_set}.${policy.policy_arn}" => policy
16-
}
17-
customer_managed_policy_map = { for ps in var.permission_sets : ps.name => ps.customer_managed_policies if length(ps.customer_managed_policies) > 0 }
18-
customer_managed_policy_attachments = flatten([
19-
for ps_name, policy_list in local.customer_managed_policy_map : [
20-
for policy in policy_list : {
21-
permission_set = ps_name
22-
policy_name = policy.name
23-
policy_path = policy.path
24-
}
25-
]
26-
])
27-
customer_managed_policy_attachments_map = {
28-
for policy in local.customer_managed_policy_attachments : "${policy.permission_set}.${policy.policy_path}${policy.policy_name}" => policy
29-
}
30-
}
31-
32-
data "aws_ssoadmin_instances" "this" {}
33-
34-
# CREATE THE PERMISSION SETS
351
resource "aws_ssoadmin_permission_set" "this" {
362
for_each = local.permission_set_map
373

@@ -42,34 +8,37 @@ resource "aws_ssoadmin_permission_set" "this" {
428
tags = merge(each.value.tags, var.tags)
439
}
4410

45-
# ATTACH INLINE POLICIES
4611
resource "aws_ssoadmin_permission_set_inline_policy" "this" {
4712
for_each = local.inline_policies_map
4813

4914
inline_policy = each.value
5015
instance_arn = local.sso_instance_arn
5116
permission_set_arn = aws_ssoadmin_permission_set.this[each.key].arn
52-
depends_on = [aws_ssoadmin_permission_set_inline_policy.this]
17+
18+
#Ensures that this resource waits for the specified permission set to be created or updated before proceeding.
19+
depends_on = [aws_ssoadmin_permission_set.this]
5320
}
5421

55-
# ATTACH MANAGED POLICIES
5622
resource "aws_ssoadmin_managed_policy_attachment" "this" {
5723
for_each = local.managed_policy_attachments_map
5824

5925
instance_arn = local.sso_instance_arn
6026
managed_policy_arn = each.value.policy_arn
61-
permission_set_arn = aws_ssoadmin_permission_set.this[each.value.policy_set].arn
62-
depends_on = [aws_ssoadmin_permission_set_inline_policy.this]
27+
permission_set_arn = aws_ssoadmin_permission_set.this[each.value.ps_name].arn
28+
29+
#Ensures that this resource waits for the specified permission set to be created or updated before proceeding.
30+
depends_on = [aws_ssoadmin_permission_set.this]
6331
}
6432

65-
# ATTACH CUSTOMER MANAGED POLICIES
6633
resource "aws_ssoadmin_customer_managed_policy_attachment" "this" {
6734
for_each = local.customer_managed_policy_attachments_map
6835
instance_arn = local.sso_instance_arn
69-
permission_set_arn = aws_ssoadmin_permission_set.this[each.value.policy_set].arn
36+
permission_set_arn = aws_ssoadmin_permission_set.this[each.value.ps_name].arn
7037
customer_managed_policy_reference {
7138
name = each.value.policy_name
7239
path = each.value.policy_path
7340
}
74-
depends_on = [aws_ssoadmin_permission_set_inline_policy.this]
41+
42+
#Ensures that this resource waits for the specified permission set to be created or updated before proceeding.
43+
depends_on = [aws_ssoadmin_permission_set.this]
7544
}

‎modules/permission_sets/md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
## Requirements
2+
3+
| Name | Version |
4+
|------|---------|
5+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.4.6 |
6+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.65.0 |
7+
8+
## Providers
9+
10+
| Name | Version |
11+
|------|---------|
12+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.58.0 |
13+
14+
## Modules
15+
16+
No modules.
17+
18+
## Resources
19+
20+
| Name | Type |
21+
|------|------|
22+
| [aws_ssoadmin_customer_managed_policy_attachment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssoadmin_customer_managed_policy_attachment) | resource |
23+
| [aws_ssoadmin_managed_policy_attachment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssoadmin_managed_policy_attachment) | resource |
24+
| [aws_ssoadmin_permission_set.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssoadmin_permission_set) | resource |
25+
| [aws_ssoadmin_permission_set_inline_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssoadmin_permission_set_inline_policy) | resource |
26+
| [aws_ssoadmin_instances.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssoadmin_instances) | data source |
27+
28+
## Inputs
29+
30+
| Name | Description | Type | Default | Required |
31+
|------|-------------|------|---------|:--------:|
32+
| <a name="input_permission_sets"></a> [permission\_sets](#input\_permission\_sets) | A map of permission set objects with permission set name as the key. Each object contains:<br> - name: The name of the permission set.<br> - description: A brief description of the permission set.<br> - session\_duration: Optional session duration for the permission set (default is PT1H).<br> - relay\_state: Optional relay state for the permission set (default is null).<br> - tags: Optional map of tags to associate with the permission set.<br> - inline\_policy: The inline policy content in JSON format.<br> - managed\_policies: A list of ARNs of managed policies to attach to the permission set.<br> - customer\_managed\_policies: A list of customer-managed policies to attach to the permission set. Each policy includes:<br> - name: The name of the customer-managed policy.<br> - path: The path of the customer-managed policy (default is "/"). | <pre>map(object({<br> name = string<br> description = string<br> session_duration = optional(string, null)<br> relay_state = optional(string, null)<br> tags = optional(map(string))<br> inline_policy = string # Inline policy <br> managed_policies = list(string) # list of ARN's of managed policies<br> customer_managed_policies = list(object({<br> name = string<br> path = optional(string, "/") # list of customer-managed policies with their names and paths to be attached to each.<br> }))<br> }))</pre> | n/a | yes |
33+
| <a name="input_tags"></a> [tags](#input\_tags) | (Optional) Key-value map of resource tags. | `map(string)` | `null` | no |
34+
35+
## Outputs
36+
37+
| Name | Description |
38+
|------|-------------|
39+
| <a name="output_permission_sets"></a> [permission\_sets](#output\_permission\_sets) | A map of the permission sets that were created. Each key is the name of the permission set, and the value contains the details of the created permission set. |

0 commit comments

Comments
 (0)