Skip to content

Commit 62bd495

Browse files
ShivaniBankeShivaniBanke
committed
chore: Refactor the module
1 parent 5a5f2cc commit 62bd495

File tree

8 files changed

+140
-27
lines changed

8 files changed

+140
-27
lines changed

‎modules/account_permissions_assignment/.header.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# Terraform AWS Organization Account Permissions Assignment Module
2+
A Terraform module for associating permissions to AWS accounts.

‎modules/account_permissions_assignment/README.md‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
## Requirements
2+
3+
| Name | Version |
4+
|------|---------|
5+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.4.6 |
6+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.65.0 |
7+
| <a name="requirement_null"></a> [null](#requirement\_null) | ~> 3.2.2 |
8+
9+
## Providers
10+
11+
| Name | Version |
12+
|------|---------|
13+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.57.0 |
14+
| <a name="provider_null"></a> [null](#provider\_null) | 3.2.2 |
15+
16+
## Modules
17+
18+
No modules.
19+
20+
## Resources
21+
22+
| Name | Type |
23+
|------|------|
24+
| [aws_ssoadmin_account_assignment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssoadmin_account_assignment) | resource |
25+
| [null_resource.sso_group_dependency](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
26+
| [null_resource.sso_permission_set_dependency](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
27+
| [aws_identitystore_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/identitystore_group) | data source |
28+
| [aws_ssoadmin_instances.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssoadmin_instances) | data source |
29+
| [aws_ssoadmin_permission_set.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssoadmin_permission_set) | data source |
30+
31+
## Inputs
32+
33+
| Name | Description | Type | Default | Required |
34+
|------|-------------|------|---------|:--------:|
35+
| <a name="input_account_assignments"></a> [account\_assignments](#input\_account\_assignments) | A list of objects representing permission assignments for AWS SSO. Each object contains the following attributes:<br> - account\_id: The AWS account ID where the permissions will be applied.<br> - permission\_sets: List of permission-set names to be assigned.<br> - principal\_name: An identifier for an object in AWS SSO, such as the name of an SSO group. | <pre>list(object({<br> account_id = string<br> permission_sets = list(string)<br> principal_name = string<br> }))</pre> | `[]` | no |
36+
| <a name="input_identitystore_group_depends_on"></a> [identitystore\_group\_depends\_on](#input\_identitystore\_group\_depends\_on) | A list of parameters to use for data resources to depend on. This is to avoid module depends\_on as that will unnecessarily create the module resources | `list(string)` | `[]` | no |
37+
| <a name="input_identitystore_permission_set_depends_on"></a> [identitystore\_permission\_set\_depends\_on](#input\_identitystore\_permission\_set\_depends\_on) | A list of parameters to use for data resources to depend on. This is to avoid module depends\_on as that will unnecessarily create the module resources | `list(string)` | `[]` | no |
38+
39+
## Outputs
40+
41+
| Name | Description |
42+
|------|-------------|
43+
| <a name="output_assignments"></a> [assignments](#output\_assignments) | The account assignment resources created for AWS SSO. Each resource includes details about the account, permission set, principal, and the status of the assignment. |

‎modules/account_permissions_assignment/data.tf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@ resource "null_resource" "sso_group_dependency" {
55
}
66

77
data "aws_identitystore_group" "this" {
8-
for_each = local.group_list
8+
for_each = local.group_list
9+
910
identity_store_id = local.identity_store_id
1011

1112
alternate_identifier {

‎modules/account_permissions_assignment/locals.tf‎

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,28 @@
11

22
locals {
3+
flatten_account_group_permission = flatten([
4+
for acc_assignment in var.account_assignments : [
5+
for ps_name in acc_assignment.permission_sets : {
6+
acc_id = acc_assignment.account_id
7+
principal_name = acc_assignment.principal_name
8+
ps_name = ps_name
9+
}
10+
]
11+
])
312
assignment_map = {
4-
for a in var.account_assignments :
5-
format("%v-%v-%v-%v", a.account_id, substr(a.principal_type, 0, 1), a.principal_name, a.permission_set_name) => a
13+
for a in local.flatten_account_group_permission :
14+
format("%v-%v-%v", a.acc_id, a.principal_name, a.ps_name) => a
615
}
716

817
identity_store_id = tolist(data.aws_ssoadmin_instances.this.identity_store_ids)[0]
918
sso_instance_arn = tolist(data.aws_ssoadmin_instances.this.arns)[0]
1019

11-
group_list = toset([for mapping in var.account_assignments : mapping.principal_name])
12-
permission_set_list = toset([for mapping in var.account_assignments : mapping.permission_set_name])
13-
20+
group_list = toset([for mapping in var.account_assignments : mapping.principal_name])
21+
all_permission_sets = flatten([for mapping in var.account_assignments : [
22+
[for ps_name in mapping.permission_sets : ps_name
23+
]
24+
]
25+
])
26+
permission_set_list = toset(local.all_permission_sets)
1427
}
1528

‎modules/account_permissions_assignment/main.tf‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,15 @@
11
locals {
2-
target_type = "AWS_ACCOUNT"
2+
target_type = "AWS_ACCOUNT"
3+
principal_type = "GROUP"
34
}
5+
46
resource "aws_ssoadmin_account_assignment" "this" {
57
for_each = local.assignment_map
68

79
instance_arn = local.sso_instance_arn
8-
permission_set_arn = data.aws_ssoadmin_permission_set.this[each.value.permission_set_name].arn
10+
permission_set_arn = data.aws_ssoadmin_permission_set.this[each.value.ps_name].arn
911
principal_id = data.aws_identitystore_group.this[each.value.principal_name].group_id
10-
principal_type = each.value.principal_type
11-
target_id = each.value.account_id
12+
principal_type = local.principal_type
13+
target_id = each.value.acc_id
1214
target_type = local.target_type
1315
}

‎modules/account_permissions_assignment/outputs.tf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
output "assignments" {
2-
value = aws_ssoadmin_account_assignment.this
2+
description = "The account assignment resources created for AWS SSO. Each resource includes details about the account, permission set, principal, and the status of the assignment."
3+
value = aws_ssoadmin_account_assignment.this
34
}

‎modules/account_permissions_assignment/variables.tf‎

Lines changed: 14 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,26 @@
11
variable "account_assignments" {
22
description = <<EOF
3-
A list of objects representing permission assignments for AWS accounts. Each object contains the following attributes:
3+
A list of objects representing permission assignments for AWS SSO. Each object contains the following attributes:
44
- account_id: The AWS account ID where the permissions will be applied.
5-
- permission_set_name: The name of the permission set to be used.
6-
- permission_set_arn: The Amazon Resource Name (ARN) of the permission set.
5+
- permission_sets: List of permission-set names to be assigned.
76
- principal_name: An identifier for an object in AWS SSO, such as the name of an SSO group.
8-
- principal_type: The type of entity for which the assignment will be created. Should be set to 'GROUP' only. Defaults to 'GROUP'."
9-
EOF
7+
EOF
108
type = list(object({
11-
account_id = string
12-
permission_set_name = string
13-
principal_name = string
14-
principal_type = optional(string, "GROUP")
9+
account_id = string
10+
permission_sets = list(string)
11+
principal_name = string
1512
}))
16-
default = [{
17-
account_id = "471112575944"
18-
permission_set_name = "Core_Dev"
19-
principal_name = "Read_Only"
20-
}]
13+
default = []
2114

2215
validation {
23-
condition = alltrue([for a in var.account_assignments : (a.principal_type == "GROUP")])
16+
condition = alltrue([for a in var.account_assignments : can(regex("^\\d{12}$", a.account_id))])
2417
error_message = "Principal type should be 'GROUP' only"
2518
}
19+
validation {
20+
condition = alltrue([for a in var.account_assignments : length(a.permission_sets) > 0])
21+
error_message = "Permission sets cannot be empty."
22+
}
23+
2624
}
2725

2826
variable "identitystore_group_depends_on" {
@@ -35,4 +33,4 @@ variable "identitystore_permission_set_depends_on" {
3533
description = "A list of parameters to use for data resources to depend on. This is to avoid module depends_on as that will unnecessarily create the module resources"
3634
type = list(string)
3735
default = []
38-
}
36+
}

‎tests/account_permission_assignment_unit-tests.tftest.hcl‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
run "validate_account_id_for_non_digits_value" {
2+
variables {
3+
account_assignments = [{
4+
account_id = "dummyId"
5+
permission_sets = [""]
6+
principal_name = ""
7+
}
8+
]
9+
}
10+
module {
11+
source = "./modules/account_permissions_assignment"
12+
}
13+
command = plan
14+
expect_failures = [
15+
var.account_assignments.this[0].account_id
16+
]
17+
}
18+
19+
run "validate_account_id_digits" {
20+
variables {
21+
account_assignments = [{
22+
account_id = "dummyId"
23+
permission_sets = [""]
24+
principal_name = ""
25+
}
26+
]
27+
}
28+
module {
29+
source = "./modules/account_permissions_assignment"
30+
}
31+
command = plan
32+
expect_failures = [
33+
var.account_assignments.this[0].account_id
34+
]
35+
}
36+
37+
run "validate_empty_permission_sets_list" {
38+
variables {
39+
account_assignments = [{
40+
account_id = "123456789012"
41+
permission_sets = []
42+
principal_name = ""
43+
}
44+
]
45+
}
46+
module {
47+
source = "./modules/account_permissions_assignment"
48+
}
49+
command = plan
50+
expect_failures = [
51+
var.account_assignments.this[0].permission_sets
52+
]
53+
}

0 commit comments

Comments
 (0)