Skip to content

Latest commit

 

History

History
43 lines (34 loc) · 1.65 KB

README.md

File metadata and controls

43 lines (34 loc) · 1.65 KB
Raw

organization-assume-role

After creating an account in the organization, follow the following steps to grant access to a group in the root account.

export AWS_DEFAULT_REGION=us-east-1
export AWS_PROFILE=xxx
SOURCE_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text --profile $AWS_PROFILE)
# enter the account id to which access is needed
TARGET_ACCOUNT_ID=xxx
#Group which will be allowed to assume role/login
IAM_GROUP=Admin

Initialize terraform, plan and apply

terraform init

Run terraform plan

terraform plan \
  -var "profile=$AWS_PROFILE"\
  -var "iam_group=$IAM_GROUP"\
  -var "source_account_id=$SOURCE_ACCOUNT_ID"\
  -var "target_account_id=$TARGET_ACCOUNT_ID"\
  -var "target_account_role=OrganizationAccountAccessRole"

Apply terraform plan

terraform apply \
  -var "profile=$AWS_PROFILE"\
  -var "iam_group=$IAM_GROUP"\
  -var "source_account_id=$SOURCE_ACCOUNT_ID"\
  -var "target_account_id=$TARGET_ACCOUNT_ID"\
  -var "target_account_role=OrganizationAccountAccessRole"

Inputs

Name Description Type Default Required
iam_group The source AWS group allowed to assume role into string Admin no
profile AWS profile for source account string - yes
region AWS region string us-east-1 no
source_account_id The AWS accounts from where can assume role into string - yes
target_account_id The AWS accounts we can assume role into string - yes
target_account_role The role name in the target account string OrganizationAccountAccessRole no