Skip to content

Commit 37b0914

Browse files
author
Alexander Wiechert
committed
Merge remote-tracking branch 'origin/main'
# Conflicts: # README.md
2 parents 4fb84d4 + 739d7d2 commit 37b0914

File tree

2 files changed

+149
-17
lines changed

2 files changed

+149
-17
lines changed

‎.github/workflows/terraform.yml

Lines changed: 30 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
21
name: Terraform CI
32

43
on:
@@ -11,59 +10,73 @@ on:
1110

1211
jobs:
1312
terraform:
14-
name: Terraform Validate, Format, Plan, Security
13+
name: Terraform and OpenTofu Validate, Format, Plan, Security
1514
runs-on: ubuntu-latest
1615

16+
strategy:
17+
matrix:
18+
cli: [terraform, opentofu]
19+
1720
steps:
1821
- name: Checkout code
1922
uses: actions/checkout@v3
2023

2124
- name: Set up Terraform
25+
if: matrix.cli == 'terraform'
2226
uses: hashicorp/setup-terraform@v2
2327

24-
- name: Terraform Format Check
25-
run: terraform fmt -check -recursive
28+
- name: Set up OpenTofu
29+
if: matrix.cli == 'opentofu'
30+
uses: opentofu/setup-opentofu@v1
31+
with:
32+
tofu_version: latest
33+
34+
- name: Format Check
35+
run: ${{ matrix.cli }} fmt -check -recursive
2636

27-
- name: Terraform Init & Validate (root)
37+
- name: Init & Validate (root)
2838
run: |
29-
terraform init
30-
terraform validate
39+
${{ matrix.cli }} init
40+
${{ matrix.cli }} validate
3141
32-
- name: Terraform Init & Validate (iam-user example)
42+
- name: Init & Validate (iam-user example)
3343
working-directory: examples/iam-user
3444
run: |
35-
terraform init
36-
terraform validate
45+
${{ matrix.cli }} init
46+
${{ matrix.cli }} validate
3747
38-
- name: Terraform Plan (iam-user example)
48+
- name: Plan (iam-user example)
3949
working-directory: examples/iam-user
40-
run: terraform plan -no-color
50+
run: ${{ matrix.cli }} plan -no-color
4151

42-
- name: Terraform Init & Validate (cross-account-role example)
52+
- name: Init & Validate (cross-account-role example)
4353
working-directory: examples/cross-account-role
4454
run: |
45-
terraform init
46-
terraform validate
55+
${{ matrix.cli }} init
56+
${{ matrix.cli }} validate
4757
48-
- name: Terraform Plan (cross-account-role example)
58+
- name: Plan (cross-account-role example)
4959
working-directory: examples/cross-account-role
50-
run: terraform plan -no-color
60+
run: ${{ matrix.cli }} plan -no-color
5161

5262
- name: Run Checkov (root)
63+
if: matrix.cli == 'terraform'
5364
uses: bridgecrewio/checkov-action@v12
5465
with:
5566
directory: .
5667
quiet: true
5768
soft_fail: true
5869

5970
- name: Run Checkov (iam-user example)
71+
if: matrix.cli == 'terraform'
6072
uses: bridgecrewio/checkov-action@v12
6173
with:
6274
directory: examples/iam-user
6375
quiet: true
6476
soft_fail: true
6577

6678
- name: Run Checkov (cross-account-role example)
79+
if: matrix.cli == 'terraform'
6780
uses: bridgecrewio/checkov-action@v12
6881
with:
6982
directory: examples/cross-account-role

‎README.md

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
[![Terraform CI](https://github.com/elastic2ls-com/terraform-aws-finops-costreview-access/actions/workflows/terraform.yml/badge.svg)](https://github.com/elastic2ls-com/terraform-aws-finops-costreview-access/actions)
2+
![License](https://img.shields.io/badge/license-MIT-brightgreen?logo=mit)
3+
![Status](https://img.shields.io/badge/status-active-brightgreen.svg?logo=git)
4+
[![Sponsor](https://img.shields.io/badge/sponsors-AlexanderWiechert-blue.svg?logo=github-sponsors)](https://github.com/sponsors/AlexanderWiechert/)
5+
[![Contact](https://img.shields.io/badge/website-elastic2ls.com-blue.svg?logo=google-chrome)](https://www.elastic2ls.com/)
6+
[![Terraform Registry](https://img.shields.io/badge/download-blue.svg?logo=terraform&style=social)](https://registry.terraform.io/modules/elastic2ls-com/finops-costreview-access/aws/latest)
7+
![OpenTofu Compatible](https://img.shields.io/badge/OpenTofu-Compatible-4E9A06?logo=opentofu)
8+
9+
# terraform-aws-finops-costreview-access
10+
11+
Terraform module to create an IAM user or cross-account IAM role for external FinOps cost reviews in an AWS account.
12+
13+
This module is compatible with both Terraform (>=1.3) and OpenTofu (>=1.3).
14+
15+
---
16+
17+
## Features
18+
19+
- Create **IAM user** with read-only access for Billing, Cost Explorer, CloudWatch.
20+
- Create **cross-account IAM role** with trust policy for a service provider.
21+
- Optional: attach `AWSOrganizationsReadOnlyAccess` policy.
22+
- Flexible naming of user and role, with defaults.
23+
- Includes examples and CI workflow with security checks.
24+
25+
---
26+
27+
## Usage
28+
29+
### IAM User (default mode)
30+
31+
```hcl
32+
module "finops_access" {
33+
source = "github.com/elastic2ls-com/terraform-aws-finops-costreview-access"
34+
mode = "iam-user"
35+
account_id = "123456789012"
36+
user_name = "finops-review-user"
37+
role_name = "finops-review-role"
38+
}
39+
```
40+
41+
### Cross-Account Role
42+
43+
```hcl
44+
module "finops_access" {
45+
source = "github.com/elastic2ls-com/terraform-aws-finops-costreview-access"
46+
mode = "cross-account-role"
47+
service_provider_account_id = "123456789012"
48+
service_provider_role_name = "finops-review-role"
49+
external_id = "your-secure-external-id" # Optional
50+
role_name = "custom-finops-role" # Optional, default: 'FinOpsCostReviewRole'
51+
user_name = "custom-finops-user" # Optional, default: 'finops-review-user' (ignored in this mode)
52+
attach_organizations_policy = true
53+
}
54+
```
55+
56+
## Security Best Practices
57+
58+
- Use `service_provider_role_name` to limit access to a specific role.
59+
- Set `external_id` to prevent the confused-deputy problem.
60+
- Avoid using account root (`arn:aws:iam::<account_id>:root`) as principal.
61+
62+
---
63+
64+
## Examples
65+
66+
- [IAM User Example](./examples/iam-user/main.tf)
67+
- [Cross-Account Role Example](./examples/cross-account-role/main.tf)
68+
69+
---
70+
71+
## Variables
72+
73+
| Name | Description | Type | Default |
74+
|-----------------------------|---------------------------------------------------------------------|---------|--------------------------|
75+
| `mode` | Access mode: `'iam-user'` or `'cross-account-role'` | string | `"iam-user"` |
76+
| `user_name` | IAM user name (for `iam-user` mode). Defaults to `'finops-review-user'`. | string | `"finops-review-user"` |
77+
| `service_provider_account_id` | AWS account ID of the service provider (for role mode) | string | `""` |
78+
| `role_name` | IAM role name (for `cross-account-role` mode). Defaults to `'FinOpsCostReviewRole'`. | string | `"FinOpsCostReviewRole"` |
79+
| `attach_organizations_policy` | Whether to attach `AWSOrganizationsReadOnlyAccess` policy | bool | `false` |
80+
81+
---
82+
83+
## Outputs
84+
85+
| Name | Description |
86+
|------------|----------------------------------|
87+
| `user_name` | IAM user name (if created) |
88+
| `user_arn` | IAM user ARN (if created) |
89+
| `role_name` | IAM role name (if created) |
90+
| `role_arn` | IAM role ARN (if created) |
91+
92+
---
93+
94+
## Requirements
95+
96+
- Terraform ≥ 1.3
97+
- AWS Provider ≥ 5.0
98+
99+
---
100+
101+
## CI/CD
102+
103+
This module uses GitHub Actions to run:
104+
- `terraform fmt`
105+
- `terraform validate`
106+
- `terraform plan` on examples
107+
- `checkov` security scan
108+
109+
---
110+
111+
## License
112+
113+
[MIT](./LICENSE)
114+
115+
---
116+
117+
## Maintainers
118+
119+
[elastic2ls](https://github.com/elastic2ls-com)

0 commit comments

Comments
 (0)