Terraform: Whats the Aws IAM infrastructure best practice?

[zerolaser]

What is best practice for creating IAM stuff for the whole infrastructure. I was thinking to splitting up into this format:-

├── Modules
├── Dev
│   ├── users
│   │   ├── user1.tf
│   │   ├── user2.tf
│   │   ├── user3.tf
│   │   └── terraform.tfstate
│   ├── groups
│   │   ├── group1.tf
│   │   ├── group2.tf
│   │   ├── group3.tf
│   │   └── terraform.tfstate
│   ├── roles
│   │   ├── role1.tf
│   │   ├── role2.tf
│   │   ├── role3.tf
│   │   └── terraform.tfstate
└── Prod
│   ├── users
│   │   ├── user1.tf
│   │   ├── user2.tf
│   │   ├── user3.tf
│   │   └── terraform.tfstate
│   ├── groups
│   │   ├── group1.tf
│   │   ├── group2.tf
│   │   ├── group3.tf
│   │   └── terraform.tfstate
│   ├── roles
│   │   ├── role1.tf
│   │   ├── role2.tf
│   │   ├── role3.tf
│   │   └── terraform.tfstate
└──

This way whenever user/group/role no longer required i could simply delete the tf file and terraform apply will remove the exisiting IAM resource. I would like to know how you guys are implementing it.

[stack72]

Hi @zerolaser

Thanks for checking in with us on this :) Luckily, we have a best-practices repo that may be able to give you some insight :)

Hopefully it helps

Please let us know if it doesn't

Paul

[zerolaser]

@stack72 I have gone through the best-practices and it helped me re-write the module in a better way. But my actual question was how multiple IAM resources are handled? Should all the IAM resources should be handled in a single state file or an individual state file for each application?

1. If Assumed all the iam resources to be in a single state file, and using the iam module repeatedly will create user and groups. but if a particular user is part of more than one group say Admin and Super Admin ,Terraform was throwing an error user already exists.
2. If each application is handled separately how to link the common resources ?

[hashibot[bot]]

I'm going to lock this issue because it has been closed for _30 days_ ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.