IAM simply with terrafam

Alex Smolen
Jul 19, 2017 · 2 min read
Image for post
Image for post

AWS Identity and Access Management is a powerful tool for isolating AWS resources and enforcing a least privilege architecture. Like many other powerful tools, there’s a steep learning curve that can make getting started tough.

Terrafam allows you to define IAM users, groups, roles and the access policies associated with them in an incredibly terse declarative yml syntax. With a simple python script, you can generate terraform configuration and create the IAM resources in your AWS account.

To use, create any or all of three files (users.yml, roles.yml, and groups.yml) and define the access policies. Here’s some examples of how those access policies can look:

users.yml

You can specify AWS managed policies to grant common groups of permissions. For instance, this configuration creates the example-user IAM user and then grants theAdministratorAccess managed policy.

roles.yml

You can give read, write, or read-and-write access to S3, DynamoDB, or SNS resources. This set of resources is based on what we use most frequently at Clever and is only a start — it should be straightforward to add new AWS resources. The action set used for read and write access for each resource are based on what we have commonly seen services need for each resource type.

groups.yml

Finally, you can define a custom policy for any IAM resource if the existing templates are insufficiently granular. You define the policy as standard IAM policy JSON in {principal-type}/{resource-name}.policy file.

After you’ve defined the policy and run the script, you’ll have json terraform configuration files. With the correct terraform environment definition (e.g. region and profile/credentials defined), you should be able to plan and apply.

The goal of terrafam is not to completely define your IAM resources, but to make the most common IAM policy grants easy to define and review. While we’ve found this useful at Clever, please let me know here, on the Github project, or on Twitter what you think.

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store