WEBVTT

00:00.000 --> 00:01.580
-In this lecture,

00:01.580 --> 00:06.770
we will see how to create IAM policies
with Terraform and attach it to a user.

00:07.590 --> 00:08.770
All right.

00:08.770 --> 00:12.670
We have successfully created an IAM user
called Lucy.

00:12.990 --> 00:17.160
As we learned in the introduction
to the IAM lecture,

00:17.160 --> 00:20.710
all users start
with the least privilege in AWS.

00:21.190 --> 00:25.190
Lucy does not have any permissions
at this point in time.

00:25.190 --> 00:30.260
To add more permissions, we have to attach
IAM policies to the user.

00:30.260 --> 00:32.100
In the IAM section,

00:32.100 --> 00:36.630
we saw that permissions are assigned
by the means of a policy document

00:36.630 --> 00:38.370
which is in a JSON format.

00:38.710 --> 00:43.500
A simple example for an admin access policy
looks like this.

00:44.240 --> 00:46.500
To add permissions, first,

00:46.500 --> 00:50.230
lets create an IAM policy using Terraform
by making use

00:50.230 --> 00:53.650
of the aws_iam_policy resource type.

00:54.610 --> 00:57.970
If we look up the argument reference
for this resource,

00:57.970 --> 01:00.860
we can see that the only mandatory argument
needed

01:00.860 --> 01:03.850
is the policy document in a JSON format.

01:04.220 --> 01:08.140
Let’s first add that resource
to our Terraform configuration file.

01:08.760 --> 01:11.110
Let's name it AdminUsers.

01:11.110 --> 01:14.710
How do we add a policy document here?

01:15.380 --> 01:18.180
Well,
there are multiple ways to do it.

01:18.180 --> 01:21.990
The first way is to provide
the complete JSON document

01:21.990 --> 01:24.300
as the value to the policy argument.

01:24.300 --> 01:28.160
How do we specify the entire JSON file here?

01:28.610 --> 01:31.780
The easiest way
is to make use of something called

01:31.780 --> 01:35.450
as a here document or a heredoc
which is commonly used

01:35.450 --> 01:38.530
in command line scripting languages
such as bash shell script

01:38.530 --> 01:41.680
that allows us to pass in multiple lines
in to a command.

01:42.210 --> 01:46.000
The command in our specific case
is the policy argument

01:46.000 --> 01:49.710
in to which we want to pass in multiple lines
of the JSON document.

01:50.650 --> 01:55.080
Following this is the redirection symbol
which the double left arrows

01:55.080 --> 01:58.920
or the double lesser than symbol
and after this is a delimiter.

01:59.220 --> 02:03.650
The delimiter can be any string
but the most commonly used string

02:03.650 --> 02:06.890
is EOF which stands for end of file.

02:07.650 --> 02:12.540
We can again make use of the same delimiter,
which is EOF, to close the file.

02:12.700 --> 02:16.490
Between the delimiters we can pass
in any number of lines

02:16.490 --> 02:18.330
that we want to pass in to the command.

02:18.330 --> 02:22.000
In our example,
this is the entire JSON document.

02:22.920 --> 02:26.900
We move the entire JSON file
containing the policy document

02:26.900 --> 02:28.700
between these delimiters like this.

02:29.430 --> 02:30.260
All right.

02:30.260 --> 02:33.270
We have successfully created
the IAM policy resources,

02:33.270 --> 02:36.740
but its not attached to a user
at this point in time.

02:37.010 --> 02:38.270
To attach it,

02:38.270 --> 02:43.770
lets make use of another resource block
of type aws_iam_user_policy_attachment.

02:44.380 --> 02:48.410
This resource expects the user name to attach
the policy

02:48.410 --> 02:54.980
to and the policy_arn which is an attribute
exported by the aws_iam_policy resource.

02:55.400 --> 02:59.500
The main.tf can now be modified like this.

03:01.540 --> 03:05.830
The user argument points
to the aws_iam_user resource

03:05.830 --> 03:10.030
and the policy_arn
points to the aws_iam_policy resource.

03:11.090 --> 03:14.050
We have seen this format earlier
when we discussed

03:14.050 --> 03:17.520
about resource dependencies
and reference expressions in Terraform.

03:18.560 --> 03:21.810
With that, our configuration is now complete.

03:21.810 --> 03:26.640
We can now run Terraform plan and then apply
and the IAM policy

03:26.640 --> 03:31.640
should get attached to the user giving her
administrative access to the AWS account.

03:32.490 --> 03:33.920
Before we move on,

03:33.920 --> 03:37.910
let’s look at another way to specify
the policy argument when creating

03:37.910 --> 03:39.400
an IAM policy resource.

03:40.240 --> 03:44.660
Instead of specifying the complete JSON file
within the main.tf file,

03:44.660 --> 03:47.710
we can make use of a JSON file
that can be stored

03:47.710 --> 03:51.570
within the configuration directory
and read within the resource block.

03:52.520 --> 03:53.450
For this,

03:53.450 --> 03:56.900
let’s first create a new file
called admin-policy.json

03:56.900 --> 03:59.440
in the same directory as the main.tf file.

04:00.020 --> 04:03.180
We then move the policy document
into this file.

04:03.810 --> 04:07.960
Once this is done,
to load the policy into the policy section,

04:07.960 --> 04:11.790
we make use of a file function
and pass in the name of the file

04:11.790 --> 04:14.340
containing the policy enclosed
within brackets.

04:14.950 --> 04:19.050
The file function reads a file and returns
the contents of it.

04:19.430 --> 04:23.680
As a result, we no longer need the EOF
which is the delimiters

04:23.680 --> 04:26.800
or the heredoc syntax that we have used
in the previous example.

04:27.710 --> 04:29.750
Once this change has been made,

04:29.750 --> 04:33.900
the rest of the resources can be created
just like we saw in the previous example.

04:35.410 --> 04:37.030
That's it for this lecture.

04:37.030 --> 04:39.730
Let’s head over to the hands-on labs
and practice

04:39.730 --> 04:41.930
working with IAM using Terraform.