{"id":18783974,"url":"https://github.com/sparkpost/diyiam","last_synced_at":"2025-06-20T02:36:12.090Z","repository":{"id":138516300,"uuid":"265307046","full_name":"SparkPost/diyiam","owner":"SparkPost","description":"SparkPost Self-Service IAM Tooling","archived":false,"fork":false,"pushed_at":"2020-05-19T16:54:15.000Z","size":19,"stargazers_count":0,"open_issues_count":0,"forks_count":1,"subscribers_count":8,"default_branch":"master","last_synced_at":"2025-06-09T13:52:12.641Z","etag":null,"topics":["team-sre"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-2-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SparkPost.png","metadata":{"files":{"readme":"Readme.adoc","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-05-19T16:53:39.000Z","updated_at":"2021-09-29T18:16:09.000Z","dependencies_parsed_at":null,"dependency_job_id":"e9a1723e-6f7b-43df-8e84-d92f99ef89a9","html_url":"https://github.com/SparkPost/diyiam","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/SparkPost/diyiam","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SparkPost%2Fdiyiam","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SparkPost%2Fdiyiam/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SparkPost%2Fdiyiam/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SparkPost%2Fdiyiam/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SparkPost","download_url":"https://codeload.github.com/SparkPost/diyiam/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SparkPost%2Fdiyiam/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":260866773,"owners_count":23074882,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["team-sre"],"created_at":"2024-11-07T20:41:29.317Z","updated_at":"2025-06-20T02:36:07.078Z","avatar_url":"https://github.com/SparkPost.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"= IAM as code provided by your local friendly SRE.\nifdef::env-github[]\n:tip-caption: :bulb:\n:note-caption: :information_source:\n:important-caption: :heavy_exclamation_mark:\n:caution-caption: :fire:\n:warning-caption: :warning:\nendif::[]\n:toc:\n\nTeams have their permissions defined in directories under (preferrably) 2-3 letter identifiers. Team\nidentifiers must be in all caps, with `/^[-_A-Z]$/` (ALL CAPS plus _ and -) being the only allowable characters.\n\n== Setup\n\n* Modify the following files:\n** /s3_state_account\n** /tf_module_prefix\n** /Global/globals.tf\n** /Global/providers.tf\n* Get started!\n\n== Usage\n\nNOTE: See Global/Readme.adoc for tl;dr on the module which this repository utilizes.\n\n=== Set Team Directory Structure:\n\n.Example Tree\n* Team\n** svc_policies - Each file is a policy to apply to a service role of the same name.\n*** rolename.json, contains policy for particular role.\n** svc_roles - Each file is a service role to be applied to a particular service.\n*** rolename.json, contains config for service role creation.\n** usr_policies - Service files for user level IAM access to various AWS services.\n*** awsservice.json, contains the named service access for users accounts.\n** usr_list - List of users to define who belongs in this team.\n\nIMPORTANT: Each `svc_policies/file.json` must have a corresponding `svc_roles/file.json` (same name).\n\nTIP: You can use the `utils/group_skeleton.sh awsprofile team` utility to create the skeleton structure.\n\n.Full Example Tree\n----\nTEAM\n├── svc_policies\n│   ├── Policy1.json\n│   └── Policy2.json\n├── svc_roles\n│   ├── Role1.json\n│   └── Role2.json\n├── usr_list\n├── usr_policies\n│   └── User_Policy1.json\n\n3 directories, 13 files\n----\n\n== Currently available tooling\n\n=== `utils/group_skeleton.sh`\n* Builds directory structure for team and creates groups matching current design.\n** `utils/group_skeleton.sh awsprofile team`\n\n=== `./apply_perms.sh`\n* Applies permissions for TEAM as defined by the users, policies, and roles in the tree.\n** Linked to the `Global/bin/apply_perms.sh` through a git submodule to `terraform_IAM_shared`.\n** `./apply_perms.sh AWS_PROFILE TEAM`\n\n=== `./import_users.sh`\n* Used to import a user or users into a team module's state file, useful when moving users from team to team\n** Linked to the `Global/bin/import_users.sh` through a git submodule to `terraform_IAM_shared`.\n** `./import_users.sh NEW_TEAM user1@example.com user2@example.com`\n\n=== `./detach_users.sh`\n* The opposite of `./import_users.sh`, used for detaching users from a team.\n** Linked to the `Global/bin/detach_users.sh` through a git submodule to `terraform_IAM_shared`.\n** `./detach_users.sh OLD_TEAM user1@example.com user2@example.com`\n\nCAUTION: Detaching and importing users does _not_ affect the AWS user nor group resources, it only changes the\n         (terraform) module's state data. `./apply_perms PROFILE TEAM` still must be run for both NEW_TEAM and\n         OLD_TEAM to update the resources in AWS (IAM).\n\n         \n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsparkpost%2Fdiyiam","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsparkpost%2Fdiyiam","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsparkpost%2Fdiyiam/lists"}