# Assignment

The Nautilus DevOps team is automating IAM role creation using Terraform to streamline permissions management. As part of this task, they need to create an IAM role with specific requirements.

For this task, create an AWS IAM role using Terraform with the following requirements:

The IAM role name iamrole_rose should be stored in a variable named KKE_iamrole.
Note:

1. The configuration values should be stored in a variables.tf file.

2. The Terraform script should be structured with a main.tf file referencing variables.tf.
The Terraform working directory is /home/bob/terraform.

Right-click under the EXPLORER section in VS Code and select Open in Integrated Terminal to launch the terminal.

# Solution

# IAM Role with Variables — `iamrole_rose` (`KKE_iamrole`)

Two-file structure: `variables.tf` holds the config, `main.tf` references it. The IAM
role name must be stored in a variable named exactly `KKE_iamrole`.

## `variables.tf`

```hcl
variable "KKE_iamrole" {
  description = "Name of the IAM role"
  type        = string
  default     = "iamrole_rose"
}
```

## `main.tf`

```hcl
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_iam_role" "rose" {
  name = var.KKE_iamrole

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect    = "Allow"
        Principal = {
          Service = "ec2.amazonaws.com"
        }
        Action = "sts:AssumeRole"
      }
    ]
  })

  tags = {
    Name = var.KKE_iamrole
  }
}
```

## How to run

```bash
cd /home/bob/terraform
terraform init
terraform apply -auto-approve
```

## How it works

### Splitting config from logic

Terraform merges every `.tf` file in the directory into one configuration, so
`variables.tf` and `main.tf` act as a single unit — no imports. `variables.tf` declares
inputs; `main.tf` declares resources that consume them via `var.<name>`.

### The variable

- **`variable "KKE_iamrole"`** — holds the IAM role name, exactly as required. The
  `default` of `iamrole_rose` lets `terraform apply` run without prompting.
- **`type = string`** validates the input type at plan time.

### The IAM role

- **`name = var.KKE_iamrole`** — resolves to `iamrole_rose` via the `var.` prefix.

- **`assume_role_policy` is mandatory.** Unlike a user or group, an IAM role
  **requires** a trust policy at creation — it defines *who* (which principal) is
  allowed to assume the role. Terraform's `aws_iam_role` will error without it. This
  one trusts the EC2 service (`ec2.amazonaws.com`) to assume the role via
  `sts:AssumeRole`, which is the standard trust for a role you'd attach to EC2
  instances. Any valid trust works; EC2 is a sensible, common default.

- **`jsonencode({...})`** builds the trust-policy JSON from an HCL object, keeping it
  readable and correctly escaped rather than hand-writing a raw JSON string.

- **No permission policies attached.** The trust policy governs *who can assume* the
  role; it grants no AWS permissions itself. The task only asks for the role to exist,
  so no `aws_iam_role_policy_attachment` is added — which also keeps the config within
  the sandbox's IAM restrictions (attaching a broad policy could trigger
  `AccessDenied`).

- **IAM is global.** The provider `region` is only for auth; the role is account-wide.

## Verify

```bash
aws iam get-role --role-name iamrole_rose \
  --query 'Role.{Name:RoleName,Id:RoleId,Arn:Arn,Trust:AssumeRolePolicyDocument}'
```

Expected — the role name, a unique ID, an ARN of the form
`arn:aws:iam::<account-id>:role/iamrole_rose`, and the trust policy allowing
`ec2.amazonaws.com` to assume it.