| Name | Description | Type | Default | Required |
|------|-------------|:----:|:-----:|:-----:|
| account\_alias | AWS IAM account alias for this account | string | n/a | yes |
| allow\_users\_to\_change\_password | Whether to allow users to change their own password | string | `"true"` | no |
| create\_account\_password\_policy | Whether to create AWS IAM account password policy | string | `"true"` | no |
| get\_caller\_identity | Whether to get AWS account ID, User ID, and ARN in which Terraform is authorized | string | `"true"` | no |
| hard\_expiry | Whether users are prevented from setting a new password after their password has expired (i.e. require administrator reset) | string | `"false"` | no |
| max\_password\_age | The number of days that an user password is valid. | string | `"0"` | no |
| minimum\_password\_length | Minimum length to require for user passwords | string | `"8"` | no |
| password\_reuse\_prevention | The number of previous passwords that users are prevented from reusing | string | `"true"` | no |
| require\_lowercase\_characters | Whether to require lowercase characters for user passwords | string | `"true"` | no |
| require\_numbers | Whether to require numbers for user passwords | string | `"true"` | no |
| require\_symbols | Whether to require symbols for user passwords | string | `"true"` | no |
| require\_uppercase\_characters | Whether to require uppercase characters for user passwords | string | `"true"` | no |
| allow\_users\_to\_change\_password | Whether to allow users to change their own password | bool | `"true"` | no |
| create\_account\_password\_policy | Whether to create AWS IAM account password policy | bool | `"true"` | no |
| get\_caller\_identity | Whether to get AWS account ID, User ID, and ARN in which Terraform is authorized | bool | `"true"` | no |
| hard\_expiry | Whether users are prevented from setting a new password after their password has expired (i.e. require administrator reset) | bool | `"false"` | no |
| max\_password\_age | The number of days that an user password is valid. | number | `"0"` | no |
| minimum\_password\_length | Minimum length to require for user passwords | number | `"8"` | no |
| password\_reuse\_prevention | The number of previous passwords that users are prevented from reusing | number | `"null"` | no |
| require\_lowercase\_characters | Whether to require lowercase characters for user passwords | bool | `"true"` | no |
| require\_numbers | Whether to require numbers for user passwords | bool | `"true"` | no |
| require\_symbols | Whether to require symbols for user passwords | bool | `"true"` | no |
| require\_uppercase\_characters | Whether to require uppercase characters for user passwords | bool | `"true"` | no |
| create\_admin\_role | Whether to create admin role | bool | `"false"` | no |
| create\_poweruser\_role | Whether to create poweruser role | bool | `"false"` | no |
| create\_readonly\_role | Whether to create readonly role | bool | `"false"` | no |
| max\_session\_duration | Maximum CLI/API session duration in seconds between 3600 and 43200 | number | `"3600"` | no |
| poweruser\_role\_name | IAM role with poweruser access | string | `"poweruser"` | no |
| poweruser\_role\_path | Path of poweruser IAM role | string | `"/"` | no |
| poweruser\_role\_permissions\_boundary\_arn | Permissions boundary ARN to use for poweruser role | string | `""` | no |
| poweruser\_role\_policy\_arns | List of policy ARNs to use for poweruser role | list | `[ "arn:aws:iam::aws:policy/PowerUserAccess" ]` | no |
| poweruser\_role\_tags | A map of tags to add to poweruser role resource. | map | `{}` | no |
| poweruser\_role\_policy\_arns | List of policy ARNs to use for poweruser role | list(string) | `[ "arn:aws:iam::aws:policy/PowerUserAccess" ]` | no |
| poweruser\_role\_tags | A map of tags to add to poweruser role resource. | map(string) | `{}` | no |
| provider\_id | ID of the SAML Provider | string | n/a | yes |
| provider\_name | Name of the SAML Provider | string | n/a | yes |
| readonly\_role\_name | IAM role with readonly access | string | `"readonly"` | no |
| readonly\_role\_path | Path of readonly IAM role | string | `"/"` | no |
| readonly\_role\_permissions\_boundary\_arn | Permissions boundary ARN to use for readonly role | string | `""` | no |
| readonly\_role\_policy\_arns | List of policy ARNs to use for readonly role | list | `[ "arn:aws:iam::aws:policy/ReadOnlyAccess" ]` | no |
| readonly\_role\_tags | A map of tags to add to readonly role resource. | map | `{}` | no |
| readonly\_role\_policy\_arns | List of policy ARNs to use for readonly role | list(string) | `[ "arn:aws:iam::aws:policy/ReadOnlyAccess" ]` | no |
| readonly\_role\_tags | A map of tags to add to readonly role resource. | map(string) | `{}` | no |
@@ -12,27 +12,28 @@ Trusted resources can be any [IAM ARNs](https://docs.aws.amazon.com/IAM/latest/U
| admin\_role\_name | IAM role with admin access | string | `"admin"` | no |
| admin\_role\_path | Path of admin IAM role | string | `"/"` | no |
| admin\_role\_permissions\_boundary\_arn | Permissions boundary ARN to use for admin role | string | `""` | no |
| admin\_role\_policy\_arns | List of policy ARNs to use for admin role | list | `[ "arn:aws:iam::aws:policy/AdministratorAccess" ]` | no |
| admin\_role\_requires\_mfa | Whether admin role requires MFA | string | `"true"` | no |
| admin\_role\_tags | A map of tags to add to admin role resource. | map | `{}` | no |
| create\_admin\_role | Whether to create admin role | string | `"false"` | no |
| create\_poweruser\_role | Whether to create poweruser role | string | `"false"` | no |
| create\_readonly\_role | Whether to create readonly role | string | `"false"` | no |
| max\_session\_duration | Maximum CLI/API session duration in seconds between 3600 and 43200 | string | `"3600"` | no |
| mfa\_age | Max age of valid MFA (in seconds) for roles which require MFA | string | `"86400"` | no |
| admin\_role\_policy\_arns | List of policy ARNs to use for admin role | list(string) | `[ "arn:aws:iam::aws:policy/AdministratorAccess" ]` | no |
| admin\_role\_requires\_mfa | Whether admin role requires MFA | bool | `"true"` | no |
| admin\_role\_tags | A map of tags to add to admin role resource. | map(string) | `{}` | no |
| create\_admin\_role | Whether to create admin role | bool | `"false"` | no |
| create\_poweruser\_role | Whether to create poweruser role | bool | `"false"` | no |
| create\_readonly\_role | Whether to create readonly role | bool | `"false"` | no |
| max\_session\_duration | Maximum CLI/API session duration in seconds between 3600 and 43200 | number | `"3600"` | no |
| mfa\_age | Max age of valid MFA (in seconds) for roles which require MFA | number | `"86400"` | no |
| poweruser\_role\_name | IAM role with poweruser access | string | `"poweruser"` | no |
| poweruser\_role\_path | Path of poweruser IAM role | string | `"/"` | no |
| poweruser\_role\_permissions\_boundary\_arn | Permissions boundary ARN to use for poweruser role | string | `""` | no |
| poweruser\_role\_policy\_arns | List of policy ARNs to use for poweruser role | list | `[ "arn:aws:iam::aws:policy/PowerUserAccess" ]` | no |
| poweruser\_role\_requires\_mfa | Whether poweruser role requires MFA | string | `"true"` | no |
| poweruser\_role\_tags | A map of tags to add to power role resource. | map | `{}` | no |
| poweruser\_role\_policy\_arns | List of policy ARNs to use for poweruser role | list(string) | `[ "arn:aws:iam::aws:policy/PowerUserAccess" ]` | no |
| poweruser\_role\_requires\_mfa | Whether poweruser role requires MFA | bool | `"true"` | no |
| poweruser\_role\_tags | A map of tags to add to poweruser role resource. | map(string) | `{}` | no |
| readonly\_role\_name | IAM role with readonly access | string | `"readonly"` | no |
| readonly\_role\_path | Path of readonly IAM role | string | `"/"` | no |
| readonly\_role\_permissions\_boundary\_arn | Permissions boundary ARN to use for readonly role | string | `""` | no |
| readonly\_role\_policy\_arns | List of policy ARNs to use for readonly role | list | `[ "arn:aws:iam::aws:policy/ReadOnlyAccess" ]` | no |
| readonly\_role\_requires\_mfa | Whether readonly role requires MFA | string | `"true"` | no |
| readonly\_role\_tags | A map of tags to add to readonly role resource. | map | `{}` | no |
| trusted\_role\_arns | ARNs of AWS entities who can assume these roles | list | `[]` | no |
| readonly\_role\_policy\_arns | List of policy ARNs to use for readonly role | list(string) | `[ "arn:aws:iam::aws:policy/ReadOnlyAccess" ]` | no |
| readonly\_role\_requires\_mfa | Whether readonly role requires MFA | bool | `"true"` | no |
| readonly\_role\_tags | A map of tags to add to readonly role resource. | map(string) | `{}` | no |
| trusted\_role\_arns | ARNs of AWS entities who can assume these roles | list(string) | `[]` | no |
| trusted\_role\_services | AWS Services that can assume these roles | list(string) | `[]` | no |
@@ -7,12 +7,12 @@ Creates IAM group with specified IAM policies, and add users into a group.
| Name | Description | Type | Default | Required |
|------|-------------|:----:|:-----:|:-----:|
| attach\_iam\_self\_management\_policy | Whether to attach IAM policy which allows IAM users to manage their credentials and MFA | string | `"true"` | no |
| attach\_iam\_self\_management\_policy | Whether to attach IAM policy which allows IAM users to manage their credentials and MFA | bool | `"true"` | no |
| aws\_account\_id | AWS account id to use inside IAM policies. If empty, current AWS account ID will be used. | string | `""` | no |
| create\_group | Whether to create IAM group | string | `"true"` | no |
| custom\_group\_policies | List of maps of inline IAM policies to attach to IAM group. Should have `name` and `policy` keys in each element. | list | `[]` | no |
| custom\_group\_policy\_arns | List of IAM policies ARNs to attach to IAM group | list | `[]` | no |
| group\_users | List of IAM users to have in an IAM group which can assume the role | list | `[]` | no |
| create\_group | Whether to create IAM group | bool | `"true"` | no |
| custom\_group\_policies | List of maps of inline IAM policies to attach to IAM group. Should have `name` and `policy` keys in each element. | list(map(string)) | `[]` | no |
| custom\_group\_policy\_arns | List of IAM policies ARNs to attach to IAM group | list(string) | `[]` | no |
| group\_users | List of IAM users to have in an IAM group which can assume the role | list(string) | `[]` | no |
| iam\_self\_management\_policy\_name\_prefix | Name prefix for IAM policy to create with IAM self-management permissions | string | `"IAMSelfManagement-"` | no |
@@ -23,20 +23,20 @@ This module outputs commands and PGP messages which can be decrypted either usin
| Name | Description | Type | Default | Required |
|------|-------------|:----:|:-----:|:-----:|
| create\_iam\_access\_key | Whether to create IAM access key | string | `"true"` | no |
| create\_iam\_user\_login\_profile | Whether to create IAM user login profile | string | `"true"` | no |
| create\_user | Whether to create the IAM user | string | `"true"` | no |
| force\_destroy | When destroying this user, destroy even if it has non-Terraform-managed IAM access keys, login profile or MFA devices. Without force_destroy a user with non-Terraform-managed access keys and login profile will fail to be destroyed. | string | `"false"` | no |
| create\_iam\_access\_key | Whether to create IAM access key | bool | `"true"` | no |
| create\_iam\_user\_login\_profile | Whether to create IAM user login profile | bool | `"true"` | no |
| create\_user | Whether to create the IAM user | bool | `"true"` | no |
| force\_destroy | When destroying this user, destroy even if it has non-Terraform-managed IAM access keys, login profile or MFA devices. Without force_destroy a user with non-Terraform-managed access keys and login profile will fail to be destroyed. | bool | `"false"` | no |
| name | Desired name for the IAM user | string | n/a | yes |
| password\_length | The length of the generated password | string | `"20"` | no |
| password\_reset\_required | Whether the user should be forced to reset the generated password on first login. | string | `"true"` | no |
| password\_length | The length of the generated password | number | `"20"` | no |
| password\_reset\_required | Whether the user should be forced to reset the generated password on first login. | bool | `"true"` | no |
| path | Desired path for the IAM user | string | `"/"` | no |
| permissions\_boundary | The ARN of the policy that is used to set the permissions boundary for the user. | string | `""` | no |
| pgp\_key | Either a base-64 encoded PGP public key, or a keybase username in the form keybase:username. Used to encrypt password and access key. | string | `""` | no |
| ssh\_key\_encoding | Specifies the public key encoding format to use in the response. To retrieve the public key in ssh-rsa format, use SSH. To retrieve the public key in PEM format, use PEM | string | `"SSH"` | no |
| ssh\_public\_key | The SSH public key. The public key must be encoded in ssh-rsa format or PEM format | string | `""` | no |
| tags | A map of tags to add to all resources. | map | `{}` | no |
| upload\_iam\_user\_ssh\_key | Whether to upload a public ssh key to the IAM user | string | `"false"` | no |
| tags | A map of tags to add to all resources. | map(string) | `{}` | no |
| upload\_iam\_user\_ssh\_key | Whether to upload a public ssh key to the IAM user | bool | `"false"` | no |
