86 lines
2.8 KiB
Markdown
86 lines
2.8 KiB
Markdown
# Assignment
|
|
|
|
The ammar DevOps team has been creating a couple of services on AWS cloud. They have been breaking down the migration into smaller tasks, allowing for better control, risk mitigation, and optimization of resources throughout the migration process. Recently they came up with requirements mentioned below.
|
|
|
|
Create an IAM group named iamgroup_ammar using terraform.
|
|
|
|
The Terraform working directory is /home/bob/terraform. Create the main.tf file (do not create a different .tf file) to accomplish this task.
|
|
|
|
Note: Right-click under the EXPLORER section in VS Code and select Open in Integrated Terminal to launch the terminal.
|
|
|
|
# Solution
|
|
|
|
# IAM Group — `iamgroup_ammar`
|
|
|
|
Terraform solution to create a single IAM group named `iamgroup_ammar`.
|
|
|
|
## `main.tf`
|
|
|
|
```hcl
|
|
terraform {
|
|
required_providers {
|
|
aws = {
|
|
source = "hashicorp/aws"
|
|
version = "~> 6.0"
|
|
}
|
|
}
|
|
}
|
|
|
|
provider "aws" {
|
|
region = "us-east-1"
|
|
}
|
|
|
|
resource "aws_iam_group" "ammar" {
|
|
name = "iamgroup_ammar"
|
|
}
|
|
```
|
|
|
|
## How to run
|
|
|
|
```bash
|
|
cd /home/bob/terraform
|
|
terraform init
|
|
terraform apply -auto-approve
|
|
```
|
|
|
|
## How it works
|
|
|
|
### `aws_iam_group`
|
|
|
|
One resource covers the whole task. The `name` argument sets the group's
|
|
identifier to `iamgroup_ammar` exactly as required.
|
|
|
|
Key points about what's going on:
|
|
|
|
- **IAM is global.** Like all IAM resources, a group is not tied to a region. The
|
|
provider still needs a `region` to initialize and authenticate, but the group is
|
|
account-wide once created — the region value doesn't affect it.
|
|
|
|
- **The `iamgroup_` prefix is enforced.** In these locked-down sandbox
|
|
environments, IAM group names must start with `iamgroup_`. The supplied name
|
|
already meets that rule, so the create stays inside the login user's permission
|
|
scope and won't be denied.
|
|
|
|
- **No policies attached, no members added.** The task asks only for the group to
|
|
exist. We deliberately skip `aws_iam_group_policy_attachment` and
|
|
`aws_iam_group_membership`, which keeps the config minimal and sidesteps the
|
|
inline / custom-policy restrictions these sandboxes impose. Attaching a policy the
|
|
login user can't grant would fail with `AccessDenied`.
|
|
|
|
### Group vs. user — same pattern, different resource
|
|
|
|
An IAM group is just a container for users that lets you attach permissions to many
|
|
people at once. On its own an empty group does nothing until you (a) attach policies
|
|
and (b) add users — both separate resources added later as requirements dictate. For
|
|
"create a group named X," a single `aws_iam_group` block is the complete answer,
|
|
mirroring the `aws_iam_user` pattern.
|
|
|
|
## Verify
|
|
|
|
```bash
|
|
aws iam get-group --group-name iamgroup_ammar \
|
|
--query 'Group.{Name:GroupName,Id:GroupId,Arn:Arn}'
|
|
```
|
|
|
|
Expected — the group's name, a unique ID, and an ARN of the form
|
|
`arn:aws:iam::<account-id>:group/iamgroup_ammar`. |