{"id":19107206,"url":"https://github.com/govtechsg/terraform-iam-users-gcc","last_synced_at":"2025-07-20T16:03:25.474Z","repository":{"id":39341389,"uuid":"420350064","full_name":"GovTechSG/terraform-iam-users-gcc","owner":"GovTechSG","description":null,"archived":false,"fork":false,"pushed_at":"2023-04-28T07:54:00.000Z","size":37,"stargazers_count":0,"open_issues_count":3,"forks_count":1,"subscribers_count":55,"default_branch":"master","last_synced_at":"2025-07-10T01:38:51.749Z","etag":null,"topics":["terraform"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/GovTechSG.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-10-23T07:57:26.000Z","updated_at":"2021-10-23T08:26:52.000Z","dependencies_parsed_at":"2024-11-09T04:11:44.076Z","dependency_job_id":null,"html_url":"https://github.com/GovTechSG/terraform-iam-users-gcc","commit_stats":null,"previous_names":[],"tags_count":8,"template":false,"template_full_name":null,"purl":"pkg:github/GovTechSG/terraform-iam-users-gcc","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GovTechSG%2Fterraform-iam-users-gcc","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GovTechSG%2Fterraform-iam-users-gcc/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GovTechSG%2Fterraform-iam-users-gcc/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GovTechSG%2Fterraform-iam-users-gcc/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/GovTechSG","download_url":"https://codeload.github.com/GovTechSG/terraform-iam-users-gcc/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GovTechSG%2Fterraform-iam-users-gcc/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":266152253,"owners_count":23884473,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["terraform"],"created_at":"2024-11-09T04:11:38.260Z","updated_at":"2025-07-20T16:03:25.453Z","avatar_url":"https://github.com/GovTechSG.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# iam-users-gcc\n\nCreates iam user with GCC permission boundary attached automatically\n\n## Usage\n\n```hcl\nmodule 'iam-user-gcc' {\n  name = \"My Name\"\n\n  # official work email\n  mail = \"someone@tech.gov.sg\"\n\n  # create with `gpg --full-generate-key`, list with `gpg --list-secret-keys --keyid-format LONG` and get with `gpg --export %KEY_ID% | base64 -w 0`\n  pgp_key = \"mQINBF6qL/IdKGMQawxsCwUvm3Y4yjhC+WzAP7U7o48IMv0Zi0ichuvtTMJwsTLc6ym4fuBrYquzlu92PvDHb2EZKJNA9kW8t4mNQsVFtU6HQfpnnABSVed+eFBEQjBl89Jj9TlYBRBVqH0QYtPyUmrJcWxfbD7N3yQUPtJ8TLFSda+E/vG146a08eZsoKxMzb3dDCLf7nJ+epwmvIdspiI+/+fNNn7jqJC9RksL8OXrV9w+qN3u7Budxni/ZIecaenBFAs9IRn+4rfplvVlPyXLlb6w==\"\n\n  # add a reason for why this account needs to exist\n  purpose = \"devops usage\"\n\n  # Username in IAM users\n  username = \"my_name_cli\"\n\n}\n```\n\n## Prerequisites\n\nThis module assumes you, and the users that you are helping to create access tokens for have knowledge of aws cli,\notherwise please read [aws cli docs](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-welcome.html) prior to\nthis so as to familiarise yourself with the various commands\n\nFor simplifying the shell script we use `jq`, therefore please\ninstall [jq](https://github.com/stedolan/jq/wiki/Installation)\n\n## Access token\n\n### Generating your GPG key\n\nExpected output: **Base64-encoded, non-ASCII-armored GPG public key**\n\n1. Check if you have any existing GPG keys using `gpg --list-secret-keys --keyid-format LONG`\n2. IF you don't have any, create one using `gpg --full-gen-key`\n    1. Select **(1) RSA and RSA (default)**\n    2. Enter a keysize of **4096**\n    3. Enter a key validity of **1y** (1 year)\n    4. Enter your **real name** when asked for it\n    5. Enter your **official work email address** when asked for it\n    6. Enter in a comment if you want\n    7. Verify the **USER-ID** reflected back to you is correct (\n       eg. `\"someone (no comments)  \u003csomeone@tech.gov.sg\u003e\"`)\n    8. Use **O** to indicate okay\n    9. Enter in a key password and enter it in again to verify it\n    10. Generate the random bytes the `gpg` program needs by surfing the web (if needed)\n    11. You should see a key signature with `pub`, `uid`, and `sub` in the first column\n3. If you completed step 2, run step 1 again and find the key you wish to use. The ID of they is on the same line as the\n   row of information starting with **`sec   rsaXXXX/%KEY_ID% YYYY-MM-DD [SC] ....`**. Extract the `%KEY_ID%`.\n4. Export your selected key by running:\n    1. On Linux: `gpg --export %KEY_ID% | base64 -w 0`\n    2. On MacOS: `gpg --export %KEY_ID% | base64 -b 0`\n5. Pass this base64-encoded public key to the operations fella\n\n### Receiving your access keys\n\nYou will need the following information to proceed:\n\n* `AWS_ACCOUNT_ID`\n* `ACCESS_KEY_ID`\n* `ENCRYPTED_SECRET_ACCESS_KEY`\n* `AWS_USER` - Most likely your username, e.g xxx_cli\n* `ROLE` - Retrieve this from your admin, e.g developer, great-power\n* `ROLE_ARN`: `arn:aws:iam::${AWS_ACCOUNT_ID}:role/${ROLE}`\n* `MFA_SERIAL`: `arn:aws:iam::${AWS_ACCOUNT_ID}:mfa/${AWS_USER}`\n\n1. The secret access key you will receive is base64-encoded and encrypted with your public key. To decrypt it,\n   run `echo ${ENCRYPTED_SECRET_ACCESS_KEY} | base64 -d \u003e ./aws_secret_access_key.enc`\n2. Decrypt the file by running `gpg --decrypt ./aws_secret_access_key.enc \u003e ./aws_secret_access_key`\n3. Install [aws-vault](https://github.com/99designs/aws-vault) and run `aws-vault add my-project-my-username`. You'll be\n   prompted to for your AWS Access Key ID and also your AWS Secret Access Key.\n\n### Setup ~/.aws/config\n\n\u003e see https://github.com/99designs/aws-vault#roles-and-mfa\n\n1. Create a file called ~/.aws/config with the following information\n\nIf you are using, aws-vault 6.6.x\n\n```yaml\n[ profile my-project-my-username ]\n  credential_process=env AWS_SDK_LOAD_CONFIG=0 aws-vault exec my-project-my-username --no-session --duration=1h --json\n```\n\nIf you are using, aws-vault 7.x.x and using terraform EKS module, you will need the following to allow assuming of eks admin role\n\n```yaml\n[ profile my-project-my-username ]\n  credential_process=env aws-vault exec my-project-my-username --no-session --duration=1h --json\n```\n\nIf you are using, aws-vault 7.x.x\n\n```yaml\n[ profile my-project-my-username ]\n  aws-vault exec my-project-my-username --no-session --duration=1h --json\n```\n\n### Creating your virtual MFA\n\nBefore we assume a role, you'll need to create a virtual MFA via the [AWS CLI tool](https://aws.amazon.com/cli/) on your\nlocal machine. This is because we have enabled MFA for all user access tokens on the group level, if your policy does\nnot require MFA, you may skip this step.\n\n1. Install the [AWS CLI tool](https://aws.amazon.com/cli/).\n2. Set the AWS cli to use the profile you defined above: `export AWS_PROFILE=${PROFILE}`\n3. Run the following your terminal to create the virtual MFA:\n    ```sh\n    aws iam create-virtual-mfa-device --virtual-mfa-device-name ${AWS_USER} --outfile ~/mfa_${AWS_USER}.png --bootstrap-method QRCodePNG;\n    ```\n   A JSON response will be shown - note down the `MFA_SERIAL` returned. You will need this later.\n4. Open the file at `~/mfa_${AWS_USER}.png` and scan it with your authenticator application, note two consecutive codes\n   it generates.\n5. Run the following in your terminal to enable the virtual MFA (replace `000000` and `111111` with the two generated\n   codes):\n    ```sh\n    aws iam enable-mfa-device --user-name ${AWS_USER} --serial-number ${MFA_SERIAL} --authentication-code1 000000 --authentication-code2 111111\n    ```\n6. Your MFA set up is done!\n\n   Add the MFA into your ~/.aws/config:\n   If you are using, aws-vault 6.6.x\n   ```yaml\n   [profile my-project-my-username]\n   mfa_serial=arn:aws:iam::123456789012:mfa/my-username # Add this line\n   credential_process=env AWS_SDK_LOAD_CONFIG=0 aws-vault exec my-project-my-username --no-session --duration=1h --json\n   ```\n   If you are using, aws-vault 7.x.x and using terraform EKS module, you will need the following to allow assuming of eks admin role\n   ```yaml\n   [profile my-project-my-username]\n   mfa_serial=arn:aws:iam::123456789012:mfa/my-username # Add this line\n   credential_process=env aws-vault exec my-project-my-username --no-session --duration=1h --json\n   ```\n\n   If you are using, aws-vault 7.x.x\n   ```yaml\n   [profile my-project-my-username]\n   mfa_serial=arn:aws:iam::123456789012:mfa/my-username # Add this line\n   aws-vault exec my-project-my-username --no-session --duration=1h --json\n   ```\n\n*Note* `MFA_SERIAL` is arn:aws:iam::${ACCOUNT_ID}:mfa/${AWS_USER}\n\n### Configuring AWS cli to assume roles\n\nTo access roles you are granted, you'll need to assume an IAM Role. IAM Roles which you can assume are based on the IAM\nGroups you are in, and the IAM Roles affect your permissions on the various AWS resources.\n\n1. Update your ~/.aws/config with the following information\n\nIf you are using, aws-vault 6.6.x\n\n```yaml\n[ profile my-project-my-username ]\n  mfa_serial=arn:aws:iam::123456789012:mfa/my-username\n  credential_process=env AWS_SDK_LOAD_CONFIG=0 aws-vault exec my-project-my-username --no-session --duration=1h --json\n\n  [ profile my-project-my-role ]\n  mfa_serial=arn:aws:iam::123456789012:mfa/my-username\n  role_arn=arn:aws:iam::{ACCOUNTID}:role/role-to-assume\n  source_profile=my-project-my-username\n```\n\nIf you are using, aws-vault 7.x.x and using terraform EKS module, you will need the following to allow assuming of eks admin role\n\n```yaml\n[ profile my-project-my-username ]\n  mfa_serial=arn:aws:iam::123456789012:mfa/my-username\n  credential_process=env aws-vault exec my-project-my-username --no-session --duration=1h --json\n\n  [ profile eks-admin-role ]\n  mfa_serial=arn:aws:iam::123456789012:mfa/my-username\n  role_arn=arn:aws:iam::{ACCOUNTID}:role/role-to-assume\n  source_profile=my-project-my-username\n```\n\nIf you are using, aws-vault 7.x.x\n\n```yaml\n[ profile my-project-my-username ]\n  mfa_serial=arn:aws:iam::123456789012:mfa/my-username\n  aws-vault exec my-project-my-username --no-session --duration=1h --json\n\n  [ profile my-project-my-role ]\n  mfa_serial=arn:aws:iam::123456789012:mfa/my-username\n  role_arn=arn:aws:iam::{ACCOUNTID}:role/role-to-assume\n  source_profile=my-project-my-username\n```\n\n2. run `aws-vault exec my-project-my-role` and type in your 2fa when requested\n3. Check that you have assumed the role correctly by testing `aws` commands that is allowed with your role.\n\n### Troubleshooting\n\n#### `SignatureDoesNotMatch` errors\n\nThis error occurs when the secret key provided to `aws-vault` was corrupted in the `aws-vault add` process.\nThis might be due to the shell interferring with the secret key value (which might have escape characters).\n\n```\nAn error occurred (SignatureDoesNotMatch) when calling the CreateVirtualMFADevice operation: The request signature we calculated does not match the signature you provided.\n```\n\n1. Remove the existing, invalid credentials - `aws-vault remove my-project-my-username`\n2. Follow the guide above to add the credentials via environment variables instead.\n\n#### `ExpiredToken` errors\n\nIf during the MFA creation process, you get the following error:\n\n```\nAn error occurred (ExpiredToken) when calling the CreateVirtualMFADevice operation: The security token included in the request is expired\n```\n\nThere might be an issue with your `aws-vault` setup - try using a **new, unpolluted terminal session**, and define your\nAWS access key and secret as environment vars:\n\n```sh\nexport AWS_ACCESS_KEY_ID=XXXXXXXXXXX\nexport AWS_SECRET_ACCESS_KEY=XXXXXXXXXXXXXX\n```\n\nAnd try the command again.\n\n## Requirements\n\nNo requirements.\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| aws  | \u003e 2.7.0 |\n\n## Inputs\n\n| Name        | Description                                                               | Type                           | Default                 | Required |\n|-------------|---------------------------------------------------------------------------|--------------------------------|-------------------------|:--------:|\n| aws\\_region | aws region                                                                | `string`                       | n/a                     |   yes    |\n| email       | official work email of the user                                           | `string`                       | `\"someone@tech.gov.sg\"` |    no    |\n| name        | real name of the user                                                     | `string`                       | `\"Monica Zheng\"`        |    no    |\n| pgp\\_key    | pgp key to use to encrypt the access keys - use 'gpg --export %KEY\\_ID% \\ | base64 -w 0' to get this value | `string`                |   n/a    |   yes    |\n| purpose     | a reason why this user should exist                                       | `string`                       | n/a                     |   yes    |\n| username    | username for the user                                                     | `string`                       | `\"gcc-default-user\"`    |    no    |\n\n## Outputs\n\n| Name            | Description                                                                                             |\n|-----------------|---------------------------------------------------------------------------------------------------------|\n| access\\_key     | base64-encoded, encrypted access key of the user, use `base64 -d` to decrypt and `gpg -d encrypted.txt` |\n| access\\_key\\_id | id of the access key                                                                                    |\n| arn             | arn of the created iam user                                                                             |\n| id              | id of the created iam user                                                                              |\n| name            | username of the created iam user                                                                        |\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgovtechsg%2Fterraform-iam-users-gcc","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgovtechsg%2Fterraform-iam-users-gcc","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgovtechsg%2Fterraform-iam-users-gcc/lists"}