AWS IAM Identity Center ABAC Module

Usage

The following Terraform code will enable ABAC within your IAM Identity Center instance. You can adjust the attributes to suit your needs. If you, instead, wish to enable and configure attributes for access control using the IAM Identity Center console or IAM Identity Center API, you can follow this guide.

data "aws_ssoadmin_instances" "this" {}

locals {
  # Adjust to select the attributes for your ABAC configuration
  attributes = {
    "CostCenter"   = "$${path:enterprise.costCenter}"
    "Organization" = "$${path:enterprise.organization}"
    "Division"     = "$${path:enterprise.division}"
  }
}

resource "aws_ssoadmin_instance_access_control_attributes" "this" {
  instance_arn = tolist(data.aws_ssoadmin_instances.this.arns)[0]

  dynamic "attribute" {
    for_each = local.attributes
    content {
      key = attribute.key
      value {
        source = [attribute.value]
      }
    }
  }
}


module "aws_sso_abac" {
  source = "./modules/aws-sso-abac-access"

  permission_set_name    = "my-permission-set"
  principal_name         = "MyPrincipalName"
  principal_type         = "GROUP"
  aws_account_identifier = ["123456789012"] # change to your account number

  attributes          = local.attributes
  actions_readonly    = ["ec2:DescribeInstances"]
  actions_conditional = ["ec2:StartInstances", "ec2:StopInstances"]
}

Overview

From the AWS IAM Identity Center User Guide (link):

Attribute-based access control (ABAC) is an authorization strategy that defines permissions based on attributes. You can use IAM Identity Center to manage access to your AWS resources across multiple AWS accounts using user attributes that come from any IAM Identity Center identity source. In AWS, these attributes are called tags. Using user attributes as tags in AWS helps you simplify the process of creating fine-grained permissions in AWS and ensures that your workforce gets access only to the AWS resources with matching tags.

Requirements

Providers

Modules

No modules.

Resources

Inputs

Outputs