Assignment

The ammar DevOps team has been creating a couple of services on AWS cloud. They have been breaking down the migration into smaller tasks, allowing for better control, risk mitigation, and optimization of resources throughout the migration process. Recently they came up with requirements mentioned below.

Create an IAM group named iamgroup_ammar using terraform.

The Terraform working directory is /home/bob/terraform. Create the main.tf file (do not create a different .tf file) to accomplish this task.

Note: Right-click under the EXPLORER section in VS Code and select Open in Integrated Terminal to launch the terminal.

Solution

IAM Group — `iamgroup_ammar`

Terraform solution to create a single IAM group named iamgroup_ammar.

`main.tf`

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_iam_group" "ammar" {
  name = "iamgroup_ammar"
}

How to run

cd /home/bob/terraform
terraform init
terraform apply -auto-approve

How it works

`aws_iam_group`

One resource covers the whole task. The name argument sets the group's identifier to iamgroup_ammar exactly as required.

Key points about what's going on:

IAM is global. Like all IAM resources, a group is not tied to a region. The provider still needs a region to initialize and authenticate, but the group is account-wide once created — the region value doesn't affect it.
The iamgroup_ prefix is enforced. In these locked-down sandbox environments, IAM group names must start with iamgroup_. The supplied name already meets that rule, so the create stays inside the login user's permission scope and won't be denied.
No policies attached, no members added. The task asks only for the group to exist. We deliberately skip aws_iam_group_policy_attachment and aws_iam_group_membership, which keeps the config minimal and sidesteps the inline / custom-policy restrictions these sandboxes impose. Attaching a policy the login user can't grant would fail with AccessDenied.

Group vs. user — same pattern, different resource

An IAM group is just a container for users that lets you attach permissions to many people at once. On its own an empty group does nothing until you (a) attach policies and (b) add users — both separate resources added later as requirements dictate. For "create a group named X," a single aws_iam_group block is the complete answer, mirroring the aws_iam_user pattern.

Verify

aws iam get-group --group-name iamgroup_ammar \
  --query 'Group.{Name:GroupName,Id:GroupId,Arn:Arn}'

Expected — the group's name, a unique ID, and an ARN of the form arn:aws:iam::<account-id>:group/iamgroup_ammar.

2.8 KiB Raw Permalink Blame History

Assignment

Solution

IAM Group — iamgroup_ammar

main.tf