Hi Everyone. I'm trying to reproduce your architecture for a test project. I'm succeded in using atmos. Very helfpful tool. But I'm bit struggling to get the differences between the "iam-primary-role" and "iam-delegated-roles" modules in https://github.com/cloudposse/terraform-aws-components . If I correctly understand , the "iam-primary-role" need to be only run on root account and the "iam-delegated-role" on all other account. Is that correct ? Second question related to the first one. In the "iam-primary-role" you two have two variables

delegated_roles_config

and

primary_roles_config

. I've noticed that this two variables are merged together to create roles. My question is when I need to use the first one and when I need to use the second one. I see too that

delegated_roles_config

varaible is use by "iam-delegated-modules" by reading the tfstate output of "iam-primary-role". Thanks for your help and your work

@Mathieu SERRA we have some incoming documentation on this from @Matt Gowie

Ok thanks for your help. It's help a lot. One question regarding variables assume_role_restricted in iam-primary-roles. I need to set to false first when I created all the roles for a cold start. But does I need to relaunch terraform process after creation with this variable to true in the identity account ?

@Jeremy G (Cloud Posse) @Dan Meyers ☝️

Sorry it is so complex, @Mathieu SERRA, but you seem to be getting the hang of it. We recommend creating an

identity

account separate from the

root

account and creating the

primary

roles in that account. When

assume_role_restricted

is

true

, we add limitations on roles to prevent them from assuming other roles in the same account. For example,

identity-observer

is not allowed to assume

identity-ops

. However, we cannot create that restriction until after both

identity-observer

and

identity-ops

have been created, so when first creating the roles you have to set

assume-roles-restricted

to

false

so we do not create rules referencing non-existent roles. Then you need to do

terraform apply

in order to actually create the roles. After the roles are created, you can set

assume-role-restricted

back to

true

and

terraform apply

to create the restrictions.

@Jeremy G (Cloud Posse) Thanks for yor complete answer. I've followed your instruction but I'm facing an issue. I've taken your example and put this in var for the module iam-primary-roles :

delegated_roles_config:
          admin:
            role_policy_arns: [ "arn:aws:iam::aws:policy/AdministratorAccess" ]
            role_description: "Role with AdministratorAccess permissions"
            sso_login_enabled: false
            # list of roles in primary that can assume into this role in delegated accounts
            # primary admin can assume delegated admin
            trusted_primary_roles: [ "admin" ]

I take this configuration from you readme. But I juste disable the sso for the moment I will only use aws user. For the first appliance with assume_role_restricted to false no error the role is correctly created. But when I set assume_role_restricted to true and relaunch terraform apply the assume role policy of the admin role is replace with null:

assume_role_policy    = jsonencode(
          ~ {
              ~ Statement = [
                  - {
                      - Action    = [
                          - "sts:TagSession",
                          - "sts:AssumeRole",
                        ]
                      - Effect    = "Allow"
                      - Principal = {
                          - AWS = "arn:aws:iam::x:root"
                        }
                      - Sid       = "IdentityAccountAssume"
                    },
                ] -> null
                Version   = "2012-10-17"
            }
        )

If we look your code it's seems that you exclude in

trusted_primary_roles

all the role who has the same name that the role to create or update.

Yes, no identity role is allowed to assume the

identity-admin

role. Also, because of the limitations of role chaining, we do not allow any role to assume itself. We would rather have an error if that situation arises so we can fix whatever is causing that to happen.

Thanks for your answer. You said that you not allow any role to assume itself but in readme of

iam-primary-roles

you put the admin as himself trusted primary role:

delegated_roles_config:
          admin:
            role_policy_arns: [ "arn:aws:iam::aws:policy/AdministratorAccess" ]
            role_description: "Role with AdministratorAccess permissions"
            sso_login_enabled: false
            # list of roles in primary that can assume into this role in delegated accounts
            # primary admin can assume delegated admin
            trusted_primary_roles: [ "admin" ]

And how I can correctly configure the admin role with no trusted_primary_roles and sso disable without having a null

assume_role_policy

when I set

assume_role_restricted

to true ? Thanks

admin

is trusted in delegated roles. This is a shorthand for saying

identity-admin

can assume

otherAcct-admin

. When you set

assume_role_restricted = true

then the roles are automatically restricted from assuming themselves as well. This is the point of having

target_role

here

if ! contains([target_role, "cicd"], source_role)

Thanks for your answer. I have know a better view of how it's work. Do you know I can fix my issue when I put

assumed-role-restricted

to true. When I set to true the assume role policy of the root role become null. So terraform raise an error:

assume_role_policy    = jsonencode(
          ~ {
              ~ Statement = [
                  - {
                      - Action    = [
                          - "sts:TagSession",
                          - "sts:AssumeRole",
                        ]
                      - Effect    = "Allow"
                      - Principal = {
                          - AWS = "arn:aws:iam::x:root"
                        }
                      - Sid       = "IdentityAccountAssume"
                    },
                ] -> null
                Version   = "2012-10-17"
            }
        )

I have the following config for the

delegated-role-config

delegated_roles_config:
          admin:
            role_policy_arns:
              - "arn:aws:iam::aws:policy/AdministratorAccess"
            role_description: "Admin role"
            sso_login_enabled: false
            trusted_primary_roles: [admin]
          terraform:
            role_policy_arns:
              - "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess"
              - "delegated_assume_role"
            role_description: "Role with permissions for terraform automation"
            sso_login_enabled: false
            trusted_primary_roles: ["admin", "terraform"]

Thanks

You need to give me more context. I can't find

jsonencode

anywhere. Are you using the latest versions of everything?