{"id":19188787,"url":"https://github.com/miquido/terraform-iam-roles","last_synced_at":"2026-02-27T07:39:50.175Z","repository":{"id":196449603,"uuid":"690899514","full_name":"miquido/terraform-iam-roles","owner":"miquido","description":null,"archived":false,"fork":false,"pushed_at":"2024-01-31T14:06:42.000Z","size":58,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-01-04T06:16:52.298Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/miquido.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2023-09-13T05:36:04.000Z","updated_at":"2023-09-13T05:36:53.000Z","dependencies_parsed_at":null,"dependency_job_id":"20f3ae1e-eacc-410b-823f-e2b4f16c76dd","html_url":"https://github.com/miquido/terraform-iam-roles","commit_stats":null,"previous_names":["miquido/terraform-iam-roles"],"tags_count":31,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/miquido%2Fterraform-iam-roles","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/miquido%2Fterraform-iam-roles/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/miquido%2Fterraform-iam-roles/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/miquido%2Fterraform-iam-roles/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/miquido","download_url":"https://codeload.github.com/miquido/terraform-iam-roles/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":240266843,"owners_count":19774072,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-09T11:26:02.284Z","updated_at":"2026-02-27T07:39:45.140Z","avatar_url":"https://github.com/miquido.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003c!-- This file was automatically generated by the `build-harness`. Make all changes to `README.yaml` and run `make readme` to rebuild this file. --\u003e\n[![Miquido][logo]](https://www.miquido.com/)\n\n# miquido-iam-roles\nRoles provisioned by module:\n\n- `AdministratorAccess`\n\n    administrator access policy to assume from authentication account\n\n- `ReadOnlyAccess`\n\n    read only access policy to assume from authentication account\n\n- `AlexaDeveloper`\n\n    full access policy to: `Lambda`, `Lex` and `Alexa` to assume from authentication account\n\n- `SuperAdministratorAccess`\n\n    same as `AdministratorAccess` with ability to manage CloudTrail resources\n---\n**Terraform Module**\n\n\nGitLab Repository: https://gitlab.com/miquido/terraform/miquido-iam-roles\n\n## Usage\n\n```hcl\nmodule \"iam-roles\" {\n  source = \"git::ssh://git@gitlab.com:miquido/terraform/terraform-iam-roles.git?ref=master\"\n  principals = [\"xxxxx\"]\n}\n```\n\n### Enable only specific roles\n\nNot always all roles are desirable. To enable only one set of roles, use module like bellow.\n\n```hcl\nmodule \"iam-roles\" {\n  source = \"git::ssh://git@gitlab.com:miquido/terraform/terraform-iam-roles.git?ref=master\"\n\n  principals            = [\"xxxxx\"]\n  role_admin_enabled    = true\n  role_readonly_enabled = true\n}\n```\n\n### Multiple accounts\n\n#### To allow assuming roles from different AWS accounts you can provide serveal prinicipals\n\nmodule \"iam-roles\" {\n  source = \"git::ssh://git@gitlab.com:miquido/terraform/terraform-iam-roles.git?ref=master\"\n\n  principals = [\"arn:aws:iam::xxxxone:root\", \"arn:aws:iam::xxxxtwo:root\"]\n}\n\n#### To use multiple IAM roles modules inside one AWS account for different reasons, you can use unique `roles_prefix` and `policies_prefix` to avoid IAM resources' names collisions.\n\n```hcl\nmodule \"iam-roles-account-one\" {\n  source = \"git::ssh://git@gitlab.com:miquido/terraform/terraform-iam-roles.git?ref=master\"\n\n  principals            = [\"xxxxxone\"]\n  policies_prefix       = \"AccountOne\"\n  roles_prefix          = \"AccountOne\"\n  role_admin_enabled    = false\n  role_readonly_enabled = true\n\n  tags = {\n    \"Heritage\" = \"Account One\"\n  }\n}\n\nmodule \"iam-roles-account-two\" {\n  source = \"git::ssh://git@gitlab.com:miquido/terraform/terraform-iam-roles.git?ref=master\"\n\n  principals            = [\"xxxxxtwo\"]\n  policies_prefix       = \"AccountTwo\"\n  roles_prefix          = \"AccountTwo\"\n  role_admin_enabled    = true\n  role_readonly_enabled = true\n\n  tags = {\n    \"Heritage\" = \"Account Two\"\n  }\n}\n```\n\u003c!-- markdownlint-disable --\u003e\n## Makefile Targets\n```text\nAvailable targets:\n\n  help                                Help screen\n  help/all                            Display help for all targets\n  help/short                          This help short screen\n  lint                                Lint Terraform code\n\n```\n\u003c!-- markdownlint-restore --\u003e\n\u003c!-- markdownlint-disable --\u003e\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 0.13 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | ~\u003e 3.0 |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | ~\u003e 3.0 |\n\n## Modules\n\nNo modules.\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [aws_iam_policy.cloudformation-full-access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |\n| [aws_iam_policy.deny-ct-write](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |\n| [aws_iam_policy.iam-role-power-access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |\n| [aws_iam_policy.serverlessrepo-full-access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |\n| [aws_iam_role.administrator-access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |\n| [aws_iam_role.alexa-developer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |\n| [aws_iam_role.analyst-access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |\n| [aws_iam_role.readonly-access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |\n| [aws_iam_role.super-administrator-access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |\n| [aws_iam_role_policy_attachment.administrator-access-attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.alexa-developer-alexa-full-access-attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.alexa-developer-cloudformation-full-access-attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.alexa-developer-iam-role-power-access-attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.alexa-developer-lambda-full-access-attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.alexa-developer-lex-full-access-attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.alexa-developer-serverlessrepo-full-access-attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.analyst-athena-full-access-attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.analyst-readonly-access-attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.deny-ct-write-attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.readonly-access-attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.super-administrator-access-attach](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_policy.administrator-access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source |\n| [aws_iam_policy.alexa-full-access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source |\n| [aws_iam_policy.athena-full-access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source |\n| [aws_iam_policy.lambda-full-access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source |\n| [aws_iam_policy.lex-full-access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source |\n| [aws_iam_policy.readonly-access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source |\n| [aws_iam_policy_document.assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n| [aws_iam_policy_document.cloudformation-full-access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n| [aws_iam_policy_document.deny-ct-write](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n| [aws_iam_policy_document.iam-role-power-access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n| [aws_iam_policy_document.serverlessrepo-full-access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_assume_role_external_id\"\u003e\u003c/a\u003e [assume\\_role\\_external\\_id](#input\\_assume\\_role\\_external\\_id) | Specify external ID required to assume enabled roles. Disabled if empty. See: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html#cli-configure-role-xaccount | `string` | `\"\"` | no |\n| \u003ca name=\"input_assume_role_mfa_enabled\"\u003e\u003c/a\u003e [assume\\_role\\_mfa\\_enabled](#input\\_assume\\_role\\_mfa\\_enabled) | Whether to require MFA to assume enabled roles. See: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html#cli-configure-role-mfa | `bool` | `true` | no |\n| \u003ca name=\"input_policies_prefix\"\u003e\u003c/a\u003e [policies\\_prefix](#input\\_policies\\_prefix) | Prefix added to created roles | `string` | `\"\"` | no |\n| \u003ca name=\"input_principals\"\u003e\u003c/a\u003e [principals](#input\\_principals) | List of AWS Prinicpals to allow assuming created IAM roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html) | `list(string)` | n/a | yes |\n| \u003ca name=\"input_role_admin_enabled\"\u003e\u003c/a\u003e [role\\_admin\\_enabled](#input\\_role\\_admin\\_enabled) | Whether to enable AdministratorAccess IAM Role | `bool` | `true` | no |\n| \u003ca name=\"input_role_alexa_enabled\"\u003e\u003c/a\u003e [role\\_alexa\\_enabled](#input\\_role\\_alexa\\_enabled) | Whether to enable AlexaDeveloper IAM Role | `bool` | `false` | no |\n| \u003ca name=\"input_role_analyst_enabled\"\u003e\u003c/a\u003e [role\\_analyst\\_enabled](#input\\_role\\_analyst\\_enabled) | Whether to enable Analyst IAM Role (ReadOnly + AmazonAthenaFullAccess) | `bool` | `false` | no |\n| \u003ca name=\"input_role_readonly_enabled\"\u003e\u003c/a\u003e [role\\_readonly\\_enabled](#input\\_role\\_readonly\\_enabled) | Whether to enable ReadOnlyAccess IAM Role | `bool` | `true` | no |\n| \u003ca name=\"input_role_superadmin_enabled\"\u003e\u003c/a\u003e [role\\_superadmin\\_enabled](#input\\_role\\_superadmin\\_enabled) | Whether to enable SuperAdministratorAccess IAM Role (Administrator with ability to manage CloudTrail) | `bool` | `false` | no |\n| \u003ca name=\"input_roles_max_session_duration\"\u003e\u003c/a\u003e [roles\\_max\\_session\\_duration](#input\\_roles\\_max\\_session\\_duration) | The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours. | `number` | `3600` | no |\n| \u003ca name=\"input_roles_prefix\"\u003e\u003c/a\u003e [roles\\_prefix](#input\\_roles\\_prefix) | Prefix added to created roles | `string` | `\"\"` | no |\n| \u003ca name=\"input_tags\"\u003e\u003c/a\u003e [tags](#input\\_tags) | Additional tags to apply on all created resources | `map(string)` | `{}` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_role_admin_access_arn\"\u003e\u003c/a\u003e [role\\_admin\\_access\\_arn](#output\\_role\\_admin\\_access\\_arn) | ARN of Administrator Access IAM Role |\n| \u003ca name=\"output_role_admin_access_id\"\u003e\u003c/a\u003e [role\\_admin\\_access\\_id](#output\\_role\\_admin\\_access\\_id) | Name of Administrator Access IAM Role |\n| \u003ca name=\"output_role_alexa_developer_arn\"\u003e\u003c/a\u003e [role\\_alexa\\_developer\\_arn](#output\\_role\\_alexa\\_developer\\_arn) | ARN of Administrator Access IAM Role |\n| \u003ca name=\"output_role_alexa_developer_id\"\u003e\u003c/a\u003e [role\\_alexa\\_developer\\_id](#output\\_role\\_alexa\\_developer\\_id) | Name of Administrator Access IAM Role |\n| \u003ca name=\"output_role_analyst_developer_arn\"\u003e\u003c/a\u003e [role\\_analyst\\_developer\\_arn](#output\\_role\\_analyst\\_developer\\_arn) | ARN of Analyst Access IAM Role |\n| \u003ca name=\"output_role_analyst_developer_id\"\u003e\u003c/a\u003e [role\\_analyst\\_developer\\_id](#output\\_role\\_analyst\\_developer\\_id) | Name of Analyst Access IAM Role |\n| \u003ca name=\"output_role_names\"\u003e\u003c/a\u003e [role\\_names](#output\\_role\\_names) | All created roles by module |\n| \u003ca name=\"output_role_readonly_access_arn\"\u003e\u003c/a\u003e [role\\_readonly\\_access\\_arn](#output\\_role\\_readonly\\_access\\_arn) | ARN of Read Only Access IAM Role |\n| \u003ca name=\"output_role_readonly_access_id\"\u003e\u003c/a\u003e [role\\_readonly\\_access\\_id](#output\\_role\\_readonly\\_access\\_id) | Name of Read Only Access IAM Role |\n| \u003ca name=\"output_role_superadmin_access_arn\"\u003e\u003c/a\u003e [role\\_superadmin\\_access\\_arn](#output\\_role\\_superadmin\\_access\\_arn) | ARN of Administrator Access IAM Role (ability to manage CloudTrail) |\n| \u003ca name=\"output_role_superadmin_access_id\"\u003e\u003c/a\u003e [role\\_superadmin\\_access\\_id](#output\\_role\\_superadmin\\_access\\_id) | Name of Administrator Access IAM Role (ability to manage CloudTrail) |\n\u003c!-- markdownlint-restore --\u003e\n\n\n## Developing\n\n1. Make changes in terraform files\n\n2. Regenerate documentation\n\n    ```bash\n    bash \u003c(git archive --remote=git@gitlab.com:miquido/terraform/terraform-readme-update.git master update.sh | tar -xO)\n    ```\n\n3. Run lint\n\n    ```\n    make lint\n    ```\n\n## Copyright\n\nCopyright © 2017-2022 [Miquido](https://miquido.com)\n\n\n\n### Contributors\n\n|  [![Konrad Obal][k911_avatar]][k911_homepage]\u003cbr/\u003e[Konrad Obal][k911_homepage] |\n|---|\n\n  [k911_homepage]: https://github.com/k911\n  [k911_avatar]: https://github.com/k911.png?size=150\n\n\n\n  [logo]: https://www.miquido.com/img/logos/logo__miquido.svg\n  [website]: https://www.miquido.com/\n  [gitlab]: https://gitlab.com/miquido\n  [github]: https://github.com/miquido\n  [bitbucket]: https://bitbucket.org/miquido\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmiquido%2Fterraform-iam-roles","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmiquido%2Fterraform-iam-roles","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmiquido%2Fterraform-iam-roles/lists"}