Assignment

The Nautilus DevOps team is automating IAM role creation using Terraform to streamline permissions management. As part of this task, they need to create an IAM role with specific requirements.

For this task, create an AWS IAM role using Terraform with the following requirements:

The IAM role name iamrole_rose should be stored in a variable named KKE_iamrole. Note:

The configuration values should be stored in a variables.tf file.
The Terraform script should be structured with a main.tf file referencing variables.tf. The Terraform working directory is /home/bob/terraform.

Right-click under the EXPLORER section in VS Code and select Open in Integrated Terminal to launch the terminal.

Solution

IAM Role with Variables — `iamrole_rose` (`KKE_iamrole`)

Two-file structure: variables.tf holds the config, main.tf references it. The IAM role name must be stored in a variable named exactly KKE_iamrole.

`variables.tf`

variable "KKE_iamrole" {
  description = "Name of the IAM role"
  type        = string
  default     = "iamrole_rose"
}

`main.tf`

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_iam_role" "rose" {
  name = var.KKE_iamrole

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect    = "Allow"
        Principal = {
          Service = "ec2.amazonaws.com"
        }
        Action = "sts:AssumeRole"
      }
    ]
  })

  tags = {
    Name = var.KKE_iamrole
  }
}

How to run

cd /home/bob/terraform
terraform init
terraform apply -auto-approve

How it works

Splitting config from logic

Terraform merges every .tf file in the directory into one configuration, so variables.tf and main.tf act as a single unit — no imports. variables.tf declares inputs; main.tf declares resources that consume them via var.<name>.

The variable

variable "KKE_iamrole" — holds the IAM role name, exactly as required. The default of iamrole_rose lets terraform apply run without prompting.
type = string validates the input type at plan time.

The IAM role

name = var.KKE_iamrole — resolves to iamrole_rose via the var. prefix.
assume_role_policy is mandatory. Unlike a user or group, an IAM role requires a trust policy at creation — it defines who (which principal) is allowed to assume the role. Terraform's aws_iam_role will error without it. This one trusts the EC2 service (ec2.amazonaws.com) to assume the role via sts:AssumeRole, which is the standard trust for a role you'd attach to EC2 instances. Any valid trust works; EC2 is a sensible, common default.
jsonencode({...}) builds the trust-policy JSON from an HCL object, keeping it readable and correctly escaped rather than hand-writing a raw JSON string.
No permission policies attached. The trust policy governs who can assume the role; it grants no AWS permissions itself. The task only asks for the role to exist, so no aws_iam_role_policy_attachment is added — which also keeps the config within the sandbox's IAM restrictions (attaching a broad policy could trigger AccessDenied).
IAM is global. The provider region is only for auth; the role is account-wide.

Verify

aws iam get-role --role-name iamrole_rose \
  --query 'Role.{Name:RoleName,Id:RoleId,Arn:Arn,Trust:AssumeRolePolicyDocument}'

Expected — the role name, a unique ID, an ARN of the form arn:aws:iam::<account-id>:role/iamrole_rose, and the trust policy allowing ec2.amazonaws.com to assume it.

3.7 KiB Raw Blame History