fix tag enabled groups in multi account setup (#136)

widdix · Aug 17, 2018 · d49c103 · d49c103 · evan-ravenelle · Sep 17, 2018
1 parent 2aa0217
commit d49c103
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 3 deletions.
diff --git a/iam_crossaccount_policy.json b/iam_crossaccount_policy.json
@@ -6,5 +6,9 @@
     "Resource": [
       "arn:aws:iam::<YOUR_USERS_ACCOUNT_ID_HERE>:role/<YOUR_USERS_ACCOUNT_ROLE_NAME_HERE>"
     ]
+  },{
+    "Effect": "Allow",
+    "Action": "ec2:DescribeTags",
+    "Resource": "*"
   }]
 }
diff --git a/import_users.sh b/import_users.sh
@@ -234,9 +234,6 @@ function sync_accounts() {
     # Check if local marker group exists, if not, create it
     /usr/bin/getent group "${LOCAL_MARKER_GROUP}" >/dev/null 2>&1 || /usr/sbin/groupadd "${LOCAL_MARKER_GROUP}"
 
-    # setup the aws credentials if needed
-    setup_aws_credentials
-
     # declare and set some variables
     local iam_users
     local sudo_users
@@ -249,6 +246,9 @@ function sync_accounts() {
     get_iam_groups_from_tag
     get_sudoers_groups_from_tag
 
+    # setup the aws credentials if needed
+    setup_aws_credentials
+
     iam_users=$(get_clean_iam_users | sort | uniq)
     if [[ -z "${iam_users}" ]]
     then