Set Up Amazon IAM & IAM Identity Center (SSO) via Terraform

[dominikvrbic]

Description

Configure AWS IAM and IAM Identity Center (SSO) using Terraform to enable centralized identity and access management. This setup will include:

• IAM users, groups, and roles.
• AWS IAM Identity Center (SSO) configuration.
• Permission sets for role-based access control.

Requirements

1. Create IAM Users, Groups, and Policies

   • Define IAM groups (e.g., Admin, Developers, ReadOnly).
   • Attach appropriate AWS-managed/custom policies.
   • Enforce MFA for IAM users.

2. Configure IAM Identity Center (SSO)

   • Enable AWS IAM Identity Center.
   • Create permission sets for different roles.
   • Assign users and groups to permission sets.
   • Integrate with an external identity provider (IdP) if applicable.

3. Define IAM Roles for AWS Services

   • Create IAM roles with least privilege access.
   • Use IAM policies to restrict actions based on security principles.

4. Automate with Terraform

   • Implement Terraform modules for IAM, Identity Center, and permission sets.
   • Ensure Terraform state is properly managed (e.g., stored in S3 with DynamoDB for locking).
   • Define environment-specific configurations.

Out of Scope

• AWS Organizations setup and account structure (covered in a separate ticket).

Acceptance Criteria

• IAM users, groups, and policies are set up with least privilege.
• IAM Identity Center (SSO) is enabled and configured.
• Permission sets are assigned based on user roles.
• IAM roles for AWS services are created and restricted as needed.
• Terraform successfully provisions IAM and Identity Center configurations.

Technical Details

Terraform Resources to Implement

• IAM User, Groups, and Policies:
  • aws_iam_user
  • aws_iam_group
  • aws_iam_policy
  • aws_iam_role
• IAM Identity Center (SSO):
  • aws_ssoadmin_permission_set
  • aws_identitystore_group
  • aws_identitystore_user
• Terraform Backend (S3 + DynamoDB for state management):
  • aws_s3_bucket
  • aws_dynamodb_table

References

• AWS IAM Documentation
• AWS IAM Identity Center
• Terraform AWS IAM Provider

[petar-INFO]

Done through the console, @dominikvrbic

Lets discuss further as to why and further actions