AWS IAM Identity Centerを特定組織にスモールスタート導入してみた #Terraform

group_account_access:
  OrgA-Admins:
    accounts:
      searvice-a-dev:
        - org_a_administrator_access
        - org_a_readonly_access
      searvice-a-prd:
        - org_a_administrator_access
        - org_a_readonly_access
      service-b-stg:
        - org_a_administrator_access
        - org_a_readonly_access
      service-b-prd:
        - org_a_administrator_access
        - org_a_readonly_access
  ServiceA-Developers:
      searvice-a-dev:
        - org_a_power_user_access
        - org_a_readonly_access
      searvice-a-prd:
        - org_a_readonly_access

# Common module for shared resources
module "common" {
  source = "../../modules/common"
}


# 利用範囲が限定的かつ、設定値ではないのでmain.tf上で定義
locals {
  # グループごとのアカウントアクセス定義（YAMLから読み込み）
  group_account_access = yamldecode(file("${path.module}/config/group_permissions.yaml")).group_account_access

  # グループ・アカウント・権限の組み合わせをマップ形式で作成（for_eachで使用するため）
  ## Terraformでは多重ループはネイティブ対応していないので、flattenを噛ませてリストを平坦化してマップに変換
  group_account_permission_map = {
    for combo in flatten([
      for group_name, group_config in local.group_account_access : [
        for account_name, permissions in group_config.accounts : [
          for permission_module in permissions : {
            key               = "${group_name}-${account_name}-${permission_module}"
            group_name        = group_name
            account_name      = account_name
            account_id        = local.all_org_a_aws_accounts[account_name]
            permission_module = permission_module
          }
        ]
      ]
    ]) : combo.key => combo
  }

  # Permission Set ARNのマップ
  permission_set_arns = {
    for key, module_instance in module.permission_sets :
    key => module_instance.permission_set_arn
  }
}

# 設定ファイルに従い、グループ・アカウント・権限の組み合わせを作成
resource "aws_ssoadmin_account_assignment" "group_account_assignments" {
  for_each = local.group_account_permission_map

  instance_arn = module.common.sso_instance_arn

  principal_id   = data.terraform_remote_state.users_and_groups.outputs.groups[each.value.group_name]
  principal_type = "GROUP"

  permission_set_arn = local.permission_set_arns[each.value.permission_module]

  target_id   = each.value.account_id
  target_type = "AWS_ACCOUNT"
}

# 例：IP制限のインラインポリシーを定義
data "aws_iam_policy_document" "ip_restrict" {
  # 特定のIP以外からのアクセスを拒否
  statement {
    effect    = "Deny"
    actions   = ["*"]
    resources = ["*"]

    condition {
      test     = "NotIpAddress"
      variable = "aws:SourceIp"
      values   = local.allowed_ips
    }
  }
}

locals {
  # Permission Set定義
  permission_sets = {
    org_a_administrator_access = {
      name                = "OrgA-AdministratorAccess"
      description         = "AdministratorAccess of OrgA"
      session_duration    = "PT1H"
      managed_policy_arns = [data.aws_iam_policy.administrator_access.arn]
      inline_policy       = data.aws_iam_policy_document.ip_restrict.json
    }
    org_a_power_user_access = {
      name             = "OrgA-PowerUserAccess"
      description      = "PowerUserAccess of OrgA"
      session_duration = local.default_session_duration
      managed_policy_arns = [data.aws_iam_policy.power_user_access.arn]
      inline_policy = data.aws_iam_policy_document.ip_restrict.json
    }
    org_a_read_only_access = {
      name                = "OrgA-ReadOnlyAccess"
      description         = "ReadOnlyAccess of OrgA"
      session_duration    = local.default_session_duration
      managed_policy_arns = [data.aws_iam_policy.read_only_access.arn]
      inline_policy       = data.aws_iam_policy_document.ip_restrict.json
    }
  }

}

# 動的にPermission Setを生成
## モジュール名を共通化することで、accountの割当時に動的にpermission_setを選択できるようにしている
module "permission_sets" {
  for_each = local.permission_sets
  source   = "../../modules/permission_set"

  sso_instance_arn    = module.common.sso_instance_arn
  name                = each.value.name
  description         = each.value.description
  session_duration    = each.value.session_duration
  managed_policy_arns = each.value.managed_policy_arns
  inline_policy       = each.value.inline_policy
}

provider "aws" {
  region  = "ap-northeast-1"
  profile = "identity-center"
  #タグ
  default_tags {
    tags = {
      Organization = local.organization
    }
  }
}