salesforce / terraform-provider-policyguru

Terraform provider for Policy Sentry (IAM least privilege generator and auditor)

terraform-provider-policyguru

This is the Terraform Provider for Policy Sentry - the IAM Least Privilege Policy Generator.

We have Policy Sentry hosted as a REST API and this Terraform provider points to the REST API.

Using this Terraform provider, you can write Least Privilege IAM Policies without ever leaving your code editor!

Requirements

• This requires Terraform >= v0.13.0

Example

Consider the following example Terraform code:

terraform {
  required_providers {
    policyguru = {
      source  = "salesforce/policyguru"
      version = "2.0.4"
    }
    aws = {
      source  = "hashicorp/aws"
      version = "~> 3.0"
    }
  }
}

# Configure the AWS Provider
provider "aws" {
  region = "us-east-1"
}

# This creates the policy document.
data "policyguru_document" "example" {
  actions_for_resources_at_access_level {
    write = list("arn:aws:kms:us-east-1:123456789012:key/aaaa-bbbb-cccc")
    read = list("arn:aws:s3:::mybucket/*")
  }

  actions_for_service_without_resource_constraint_support {
    include_single_actions = ["ssm:GetParameter"]
  }
  exclude_actions = list("kms:Decrypt*", "kms:Delete*", "kms:Disable", "kms:Schedule*")
}

# This creates an IAM Policy leveraging policyguru
resource "aws_iam_policy" "policy" {
  name        = "policyguru-example"
  path        = "/"
  description = "this uses the policyguru document data source"
  policy      = data.policyguru_document.example.json
}

# This shows you the output value
output "policy_document_json" {
  value = data.policyguru_document.example.json
}

That will create an IAM Policy titled policyguru-example which will contain the following policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "S3ReadObject",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:GetObjectLegalHold",
                "s3:GetObjectRetention",
                "s3:GetObjectTagging",
                "s3:GetObjectTorrent",
                "s3:GetObjectVersion",
                "s3:GetObjectVersionAcl",
                "s3:GetObjectVersionForReplication",
                "s3:GetObjectVersionTagging",
                "s3:GetObjectVersionTorrent"
            ],
            "Resource": [
                "arn:aws:s3:::mybucket/*"
            ]
        },
        {
            "Sid": "KmsWriteKey",
            "Effect": "Allow",
            "Action": [
                "kms:CancelKeyDeletion",
                "kms:CreateAlias",
                "kms:DisableKey",
                "kms:DisableKeyRotation",
                "kms:EnableKey",
                "kms:EnableKeyRotation",
                "kms:Encrypt",
                "kms:GenerateDataKey",
                "kms:GenerateDataKeyPair",
                "kms:GenerateDataKeyPairWithoutPlaintext",
                "kms:GenerateDataKeyWithoutPlaintext",
                "kms:ImportKeyMaterial",
                "kms:ReEncryptFrom",
                "kms:ReEncryptTo",
                "kms:Sign",
                "kms:UpdateAlias",
                "kms:UpdateKeyDescription",
                "kms:Verify"
            ],
            "Resource": [
                "arn:aws:kms:us-east-1:123456789012:key/aaaa-bbbb-cccc"
            ]
        },
        {
            "Sid": "SkipResourceConstraints",
            "Effect": "Allow",
            "Action": [
                "ssm:GetParameter"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

Contributing

Command	Description
make build	Build
make install	Build and install
make fmt	Format code
make lint	Run golint
make terraform-demo	Install and run terraform apply for file under examples folder
make clean	Clean terraform state files created under examples folder

For documentation on using provider, check https://registry.terraform.io/providers/salesforce/policyguru/latest/docs

terraform-provider-policyguru's Issues

add documentation for overrides

Add unit tests

add unit tests for files under policyguru and policyguru_rest package

NOTE: We haven't published this as a Terraform provider to the registry yet - but we are adding this in the next day or so

Just an FYI to the people who are starring and forking this already

Add enhancement for doing IAM conditionals or document it if capability already exists

Currently the documentation says nothing about adding in conditionals to your IAM policy which is a tad of a downside if your project needs them. There is an overrides argument but there is no documentation for it and the ticket for the documentation request has been open since December Reference: #3

add go report card badge in Readme

https://goreportcard.com/report/github.com/salesforce/terraform-provider-policyguru

provider throwing internal server error

make: *** [terraform-demo] Error 1
reetasingh-ltm8:terraform-provider-policyguru reetasingh$ make clean
make: *** No rule to make target `clean'.  Stop.
reetasingh-ltm8:terraform-provider-policyguru reetasingh$ make terraform-demo
go build -o terraform-provider-policyguru
mv terraform-provider-policyguru ~/.terraform.d/plugins
cd examples && terraform init && terraform apply

Initializing the backend...

Initializing provider plugins...
- Using previously-installed hashicorp/aws v3.21.0
- Using previously-installed salesforce/policyguru v2.0.0

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.
data.policyguru_document.example: Refreshing state...

Error: status: 500, body: {"message":"Internal Server Error"}


make: *** [terraform-demo] Error 1
reetasingh-ltm8:terraform-provider-policyguru reetasingh$ 

500 error trying to run example

I'm trying to run the example code but get a 500 error. I can curl https://api.policyguru.io/docs using the sample POST request generated at https://api.policyguru.io/docs#/default/write_iam_policy_write_iam_policy_post from the same terminal session where I am trying to run terraform plan. Details are below.

terraform {
  required_providers {
    policyguru = {
      source  = "salesforce/policyguru"
      version = "~>2.0.5"
    }
    aws = {
      source  = "hashicorp/aws"
      version = "~> 3.0"
    }
  }
}

# Configure the AWS Provider
provider "aws" {
  region = "us-east-1"
}

# This creates the policy document.
data "policyguru_document" "example" {
  actions_for_resources_at_access_level {
    read = tolist(["arn:aws:s3:::mybucket/*"])
  }

  actions_for_service_without_resource_constraint_support {
    include_single_actions = ["ssm:GetParameter"]
  }
  exclude_actions = tolist(["kms:Decrypt*", "kms:Delete*", "kms:Disable", "kms:Schedule*"])
}

# This creates an IAM Policy leveraging policyguru
resource "aws_iam_policy" "policy" {
  name        = "policyguru-example"
  path        = "/"
  description = "this uses the policyguru document data source"
  policy      = data.policyguru_document.example.json
}

# This shows you the output value
output "policy_document_json" {
  value = data.policyguru_document.example.json
}

➜ terraform --version            
Terraform v1.1.3
on darwin_amd64
+ provider registry.terraform.io/hashicorp/aws v3.71.0
+ provider registry.terraform.io/salesforce/policyguru v2.0.5

➜ terraform plan                      
╷
│ Error: status: 500, body: {"message":"Internal Server Error"}
│ 
│   with data.policyguru_document.example,
│   on main.tf line 29, in data "policyguru_document" "example":
│   29: data "policyguru_document" "example" {
│ 
╵