Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add IAM user login profile #51

Merged
merged 4 commits into from
Dec 20, 2024
Merged

Conversation

dav3r
Copy link
Member

@dav3r dav3r commented Dec 18, 2024

🗣 Description

This PR adds IAM user login profiles in Terraform.

💭 Motivation and context

This change will eliminate the need to manually login to the AWS web console to enable a new user's console access and create their initial password. Those steps will now be handled automatically when this Terraform is applied.

Note that previously-created users must have their login profiles imported or else re-applying this Terraform will reset the console passwords of those users (see "Post-merge checklist" below).

🧪 Testing

I applied this Terraform in a fresh environment and confirmed that the users were all created along with their initial passwords. I also made sure that once a user changed their initial password, re-applying this Terraform did NOT reset their password.

I also tested the process of importing the user profile for previously created users and confirmed that it worked as expected with a command like this:

terraform import -var-file=my-env.tfvars aws_iam_user_login_profile.users[\"test.user\"] test.user

✅ Pre-approval checklist

  • This PR has an informative and human-readable title.
  • Changes are limited to a single goal - eschew scope creep!
  • All relevant type-of-change labels have been added.
  • I have read the CONTRIBUTING document.
  • These code changes follow cisagov code standards.
  • All relevant repo and/or project documentation has been updated
    to reflect the changes in this PR.
  • All new and existing tests pass.

✅ Post-merge checklist

  • terraform import IAM user profiles for users in all existing environments

This enables console access for the user and creates an initial password, which must be changed the first time they login.  This saves us from having to manually set up their initial password in the AWS console.
@dav3r dav3r added the improvement This issue or pull request will add or improve functionality, maintainability, or ease of use label Dec 18, 2024
@dav3r dav3r requested a review from a team December 18, 2024 19:45
@dav3r dav3r self-assigned this Dec 18, 2024
Copy link
Member

@mcdonnnj mcdonnnj left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM ✔ I have one minor question for you.

users.tf Show resolved Hide resolved
Copy link
Member

@jsf9k jsf9k left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have one minor change request.

README.md Outdated Show resolved Hide resolved
Co-authored-by: Jeremy Frasier <[email protected]>
@dav3r dav3r merged commit 55a490e into develop Dec 20, 2024
4 checks passed
@dav3r dav3r deleted the improvement/iam-user-login-profile branch December 20, 2024 15:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
improvement This issue or pull request will add or improve functionality, maintainability, or ease of use
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants