AWS Organisation Terraform module

Terraform module which creates Child Accounts and SSO permissions assignements resources on AWS. It will also create a Terraform Backend in Child Accounts. This module is an abstraction of the terraform-aws-sso by @cloudposse.

User Stories for this module

AAOps I can create child AWS account with terraform backend for my organization
AAOps I can give my users rights to all the accounts of my organization

Prerequisites

An organization AWS account
AWS SSO enabled (in the right region)
In AWS SSO settings, MFA configured
AWS SSO Groups created

Usage

module "orga" {
  source = "https://github.com/padok-team/terraform-aws-orga"

  accounts = {
    staging = {
      email           = "aws+staging@company.com"
      tf_admin_groups = ["padok"]
    },
    prod = {
      email           = "aws+prod@company.com"
      tf_admin_groups = ["padok"]
    }
  }

  account_assignements = {
    stagging = {
      settlers = ["padok", "dev"],
    },
    prod = {
      settlers = ["padok"],
      watchers = ["dev"]
    }
  }

  permission_sets = [
    {
      name               = "settlers",
      description        = "Allow Full Access to the account",
      relay_state        = "",
      session_duration   = "",
      tags               = {},
      inline_policy      = "",
      policy_attachments = ["arn:aws:iam::aws:policy/AdministratorAccess"]
    },
    {
      name               = "watchers",
      description        = "Allow ViewOnly access to the account",
      relay_state        = "",
      session_duration   = "",
      tags               = {},
      inline_policy      = "",
      policy_attachments = ["arn:aws:iam::aws:policy/job-function/ViewOnlyAccess"]
    }
  ]
}

Warning : You need to make the terraform apply in two step.

# First create only the accounts
terraform apply -target module.orga.aws_organizations_account.this

# Then everythings else
terrform apply

Examples

Modules

Name	Source	Version
account_assignments	git::https://github.com/cloudposse/terraform-aws-sso.git//modules/account-assignments	0.6.1
permission_sets	git::https://github.com/cloudposse/terraform-aws-sso.git//modules/permission-sets	0.6.1
tf_backend	git::https://github.com/padok-team/terraform-aws-terraformbackend	v1.0.0

Inputs

Name	Description	Type	Default	Required
account_assignements	List of assignements between an account within the organization, a permission set and a group.	`map(map(list(string)))`	n/a	yes
accounts	List of accounts to be created	map(object({ email = string tf_admin_groups = list(string) }))	n/a	yes
permission_sets	List of available permission sets	list(object({ name = string description = string relay_state = string session_duration = string tags = map(string) inline_policy = string policy_attachments = list(string) }))	n/a	yes

Outputs

Name	Description
accounts_information	List of accounts created with terraform backend information

License

See LICENSE for full details.

Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements.  See the NOTICE file
distributed with this work for additional information
regarding copyright ownership.  The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License.  You may obtain a copy of the License at

  https://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied.  See the License for the
specific language governing permissions and limitations
under the License.