WEBVTT 00:00.290 --> 00:06.980 Now that we have seen how to use the IAM service with both the management console and the AWS CLI, 00:07.010 --> 00:10.820 let us see how to provision IAM resources using Terraform. 00:12.140 --> 00:18.890 To do this, let us make use of the documentation from registry.terraform.io for the AWS provider and 00:18.890 --> 00:22.550 in this case resources specifically for IAM. 00:23.390 --> 00:27.140 The resource that we are looking to create is an IAM user. 00:27.140 --> 00:33.170 And just like we saw with the local file and the random pet resources that we worked on earlier, the 00:33.170 --> 00:38.150 resource name begins with the provider name, which in this case is AWS. 00:39.080 --> 00:41.990 So our resource block would look like this. 00:42.590 --> 00:46.160 The resource type is aws, IAM user. 00:46.520 --> 00:49.610 The resource name is set to Admin user. 00:50.450 --> 00:56.060 This resource expects a mandatory argument called name which is the user's name. 00:56.060 --> 00:59.840 And in this case we have chosen Lucy as our example. 01:00.860 --> 01:05.060 We have also used optional tags which is the key value map. 01:05.780 --> 01:11.840 And here the key is description, and to this we have added a value called technical team leader. 01:13.280 --> 01:19.520 The next step is for us to run terraform init for downloading the provider plugin for AWS. 01:20.780 --> 01:26.600 If we try to run Terraform plan now without any other configuration, you should see an error message 01:26.600 --> 01:28.400 displayed like this. 01:29.600 --> 01:35.960 The first thing that you'll notice is that a user input for the AWS region is prompted by this command. 01:36.290 --> 01:43.220 And as we saw in the introduction to AWS and the IAM section, most resources in AWS are deployed within 01:43.220 --> 01:48.230 a region such as the North Virginia region, Oregon or Ohio as an example. 01:48.950 --> 01:54.440 And although I am, resources are an exception and are created globally and not specifically tied on 01:54.470 --> 01:59.150 to a region, Terraform still expects a region to be provided for it to work. 01:59.780 --> 02:06.170 The second error that we see in the Terraform plan command is that it is not able to find valid credentials 02:06.170 --> 02:08.240 to connect to an AWS account. 02:08.810 --> 02:11.240 Let us see how to fix these two issues next. 02:12.410 --> 02:16.320 First, let us add a provider block for AWS. 02:16.830 --> 02:22.470 This is done by making use of the keyword called provider, which is followed by the provider name, 02:22.470 --> 02:25.290 which in this example is AWS. 02:25.980 --> 02:32.850 Inside this block, we can specify the default AWS region, which in this example is set to us West 02:32.880 --> 02:33.480 two. 02:34.200 --> 02:40.410 We have also added the access key ID and the secret access keys, which will allow Terraform to deploy 02:40.410 --> 02:42.660 resources to our AWS account. 02:43.470 --> 02:48.270 Now, if we run Terraform plan, we should be able to see the execution plan. 02:49.440 --> 02:55.140 And after that, once we run Terraform apply, it should create the resources as per the execution plan. 02:56.040 --> 03:01.860 In the example we have seen so far, we have hardcoded the credentials in the main.tf file. 03:02.370 --> 03:07.920 This is not a recommended approach, especially considering the fact that the configuration file is 03:07.920 --> 03:10.980 something that we intend to store in a version control system. 03:11.760 --> 03:17.700 Another way to pass in credentials with Terraform is by configuring the aws CLI on the client, where 03:17.700 --> 03:19.200 we have installed Terraform. 03:19.860 --> 03:23.970 This creates a credentials file in the hidden directory called AWS. 03:24.000 --> 03:25.980 Inside the home directory of the user. 03:26.400 --> 03:31.920 And this is something that we have seen while we checked out the programmatic access in the previous 03:31.920 --> 03:32.640 lecture. 03:33.630 --> 03:39.960 So instead of hard coding credentials within the provider block, we can move the credentials from the 03:39.960 --> 03:45.420 Terraform configuration file into the credentials file by making use of the AWS configure command. 03:45.420 --> 03:48.510 And this is something that we have seen in the previous lecture. 03:49.350 --> 03:54.360 Once it has been set up, Terraform will automatically use the credentials stored in the credentials 03:54.360 --> 03:59.100 file, and we won't need to use credentials within the Terraform configuration file. 04:00.000 --> 04:04.560 One other way to pass in these values is by making use of environment variables. 04:05.640 --> 04:12.690 To do this, we can export the variables called AWS access Key ID and AWS Secret Access key ID like 04:12.690 --> 04:13.350 this. 04:14.940 --> 04:19.890 You may even set the region in the command line parameter like this. 04:19.890 --> 04:23.040 And this will allow us to remove the provider block completely. 04:23.850 --> 04:26.820 Once this is done, the Terraform commands should work.