103 lines
2.9 KiB
Markdown
103 lines
2.9 KiB
Markdown
# Assignment
|
|
|
|
The Nautilus DevOps team is automating IAM user creation using Terraform for better identity management.
|
|
|
|
For this task, create an AWS IAM User using Terraform with the following requirements:
|
|
|
|
The IAM User name iamuser_mark should be stored in a variable named KKE_user.
|
|
Note:
|
|
|
|
1. The configuration values should be stored in a variables.tf file.
|
|
|
|
2. The Terraform script should be structured with a main.tf file referencing variables.tf.
|
|
The Terraform working directory is /home/bob/terraform.
|
|
|
|
Right-click under the EXPLORER section in VS Code and select Open in Integrated Terminal to launch the terminal.
|
|
|
|
# Solution
|
|
|
|
# IAM User with Variables — `iamuser_mark` (`KKE_user`)
|
|
|
|
Two-file structure: `variables.tf` holds the config, `main.tf` references it. The IAM
|
|
User name must be stored in a variable named exactly `KKE_user`.
|
|
|
|
## `variables.tf`
|
|
|
|
```hcl
|
|
variable "KKE_user" {
|
|
description = "Name of the IAM user"
|
|
type = string
|
|
default = "iamuser_mark"
|
|
}
|
|
```
|
|
|
|
## `main.tf`
|
|
|
|
```hcl
|
|
terraform {
|
|
required_providers {
|
|
aws = {
|
|
source = "hashicorp/aws"
|
|
version = "~> 6.0"
|
|
}
|
|
}
|
|
}
|
|
|
|
provider "aws" {
|
|
region = "us-east-1"
|
|
}
|
|
|
|
resource "aws_iam_user" "mark" {
|
|
name = var.KKE_user
|
|
|
|
tags = {
|
|
Name = var.KKE_user
|
|
}
|
|
}
|
|
```
|
|
|
|
## How to run
|
|
|
|
```bash
|
|
cd /home/bob/terraform
|
|
terraform init
|
|
terraform apply -auto-approve
|
|
```
|
|
|
|
## How it works
|
|
|
|
### Splitting config from logic
|
|
|
|
Terraform merges every `.tf` file in the directory into one configuration, so
|
|
`variables.tf` and `main.tf` act as a single unit — no imports needed. `variables.tf`
|
|
declares inputs; `main.tf` declares resources that consume them via `var.<name>`.
|
|
|
|
### The variable
|
|
|
|
- **`variable "KKE_user"`** — holds the IAM user name, exactly as required. The
|
|
`default` of `iamuser_mark` lets `terraform apply` run without prompting.
|
|
- **`type = string`** validates the input type at plan time.
|
|
|
|
### The IAM user
|
|
|
|
- **`name = var.KKE_user`** — resolves to `iamuser_mark`. The `var.` prefix
|
|
interpolates the variable's value.
|
|
- **`iamuser_` prefix matters.** These locked-down sandboxes require IAM user names to
|
|
start with `iamuser_`. The variable's value already satisfies that, so the create
|
|
stays inside the login user's permission scope and won't be denied.
|
|
- **IAM is global.** The `region` in the provider is needed to initialize and
|
|
authenticate, but IAM resources aren't regional — the user is visible account-wide.
|
|
- **No policies, keys, or login profile.** The task asks only for the user to exist, so
|
|
nothing is attached. This keeps the config minimal and avoids the custom-policy /
|
|
attach restrictions these sandboxes enforce (attaching permissions broader than the
|
|
login user has would fail with `AccessDenied`).
|
|
|
|
## Verify
|
|
|
|
```bash
|
|
aws iam get-user --user-name iamuser_mark \
|
|
--query 'User.{Name:UserName,Id:UserId,Arn:Arn}'
|
|
```
|
|
|
|
Expected — the user's name, a unique ID, and an ARN of the form
|
|
`arn:aws:iam::<account-id>:user/iamuser_mark`. |