Support AWS IAM Access Analyzer

[ewbankkit]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

IAM Access Analyzer announced.

New or Affected Resource(s)

It looks like an initial set of resources could be:

• aws_accessanalyzer_analyzer
• aws_accessanalyzer_organization_admin_account
• aws_accessanalyzer_archive_rule

References

Announcement.
Blog post.
User guide.
API reference.

Requires AWS SDK v1.25.45:

• Update module aws/aws-sdk-go to v1.25.45 #11097

[bflad]

Submitted the aws_accessanalyzer_analyzer resource: #11169 🎉

I agree with keeping the archive rules as a separate resource even though the analyzers do support inline archive rules as we do not need more security group vs security group rule confusion/trouble. 😄

[lorengordon]

I know I always appreciate having an option to enforce an exclusive configuration of something, where terraform removes anything not specified in the config... Not sure how that would work with separate resources, but maybe a consideration.

[bflad]

@lorengordon noted! We could not enforce exclusive management given Terraform's available functionality. We typically will want to lean towards being flexible for organizational/workflow boundaries (e.g. where rules may get defined in downstream Terraform modules with their associated resources) with API implementations that allow it, but we can certainly support both the separate and inline methods if its desirable for the community, by including the warnings about incompatibilities for managing them multiple ways.

[lorengordon]

I was thinking the rule resource could be plural, aws_accessanalyzer_archive_rules, with a flag to mark the config as exclusive, if keeping the resource separate were strongly desired...

[bflad]

Support for the new aws_accessanalyzer_analyzer resource has been merged and will release with version 2.43.0 of the Terraform AWS Provider, Thursday this week. 👍

[sutharshan-sharma]

@ewbankkit @bflad Any example usage available for aws_accessanalyzer_archive_rule resource in Terraform ?

[christophetd]

It would also be very useful to be able to create delegated administrators for Access Analyzer from terraform, c.f. https://aws.amazon.com/blogs/aws/new-use-aws-iam-access-analyzer-in-aws-organizations/

[ina-stoyanova]

Hey all - thank you for adding the IAM Access Analyzer.

I was wondering (if my understanding is correct, the aws_accessanalyzer_archive_rule is not yet a supported resource), then what do people recommend or have found themselves doing to add these rules?

Thanks in advance!

[sutharshan-siva]

@ina-stoyanova you can do it via aws_cli command via shell script with for loop to add archive rules + you can call that shell script with Terraform null resource.

[ina-stoyanova]

Thank you @Sutharshansharma 👍

[dpowley]

Adding another vote for supporting the aws_accessanalyzer_organization_admin_account. Similar to what has already been implemented for GuardDuty and Firewall Manager.

[mwarkentin]

Access Analyzer recently released some new functionality to analyze AWS IAM policies: https://aws.amazon.com/blogs/aws/iam-access-analyzer-update-policy-validation/

It would be interesting if this API could be wired into and exposed during plans for the aws_iam_policy resource.

[github-actions]

This functionality has been released in v4.21.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.