Creating IAM Users and Granting the Minimum CCE Permissions

Step 1: Create a Project Directory and Initialize the Configuration

1. Create an IAM user management directory (the directory name is user-defined).

   mkdir terraform_iam_user
   cd ./terraform_iam_user

2. Copy the prepared provider configuration file to the current directory. The init.tf file has been created in the terraform_hw_demo directory in section "Installing Terraform and Configuring the Huawei Cloud Provider".

   cp ../terraform_hw_demo/init.tf .

Step 2: Create Configuration Files

All the following configuration files are created in the project directory.

1. Query IAM policies.

   Create the policy_data.tf file to query system-defined policies and filter them by name.

   variable "policy_type" {
     description = "The type of the policy"
     type        = string
     default     = "system"
   }
   
   variable "policy_names" {
     description = "The name list of policies to be associated with the user group"
     type        = list(string)
   }
   
   # Obtain all IAM policies in a specified region (if the region parameter is not specified, the region specified in the provider block is used by default).
   data "huaweicloud_identityv5_policies" "test" {
     policy_type = var.policy_type
   }
   
   # Filter the policies by policy name.
   locals {
     filtered_policies = [for policy in data.huaweicloud_identityv5_policies.test.policies : policy if contains(var.policy_names, policy.policy_name)]
   }

   The involved parameters are described in the table below.

   Parameter	Description
   policy_type	Policy type. Options: system (default): indicates a system-defined policy. custom: indicates a custom policy.
   policy_names	List of policy names to be attached to the user group.

2. Create a user group.

   Create the group.tf file and create an IAM user group.

   variable "group_name" {
     description = "The name of the user group"
     type        = string
   }
   
   variable "group_description" {
     description = "The description of the user group"
     type        = string
     default     = ""
   }
   
   # Create an IAM user group in the specified region (if the region parameter is not specified, the region specified in the provider block is used by default).
   resource "huaweicloud_identityv5_group" "test" {
     group_name  = var.group_name
     description = var.group_description
   }

   The involved parameters are described in the table below.

   Parameter	Description
   group_name	User group name.
   group_description	User group description.

3. Create the group_attach.tf file to grant permissions to the user group.

   # Create IAM policies and attach them with the user group in the specified region (if the region parameter is not specified, the region specified in the provider block is used by default).
   resource "huaweicloud_identityv5_policy_group_attach" "test" {
     count = length(local.filtered_policies)
   
     policy_id = try(local.filtered_policies[count.index].policy_id, null)
     group_id  = huaweicloud_identityv5_group.test.id
     depends_on = [
       huaweicloud_identityv5_group.test
     ]
   }

   The involved parameters are described in the table below.

   Parameter	Description
   count	Number of resources to be created, which is equal to the number of policies to be attached.
   policy_id	Policy ID, which can be obtained from the query result in step 1.
   group_id	User group ID, which is the ID of the user group created in step 2.

4. Create the users.tf file to create IAM users.

   variable "users_configuration" {
     description = "IAM user configuration"
     type        = list(object({
       name     = string
       password = optional(string, "")
     }))
     nullable    = false
   }
   
   # Create IAM users in the specified region (if the region parameter is not specified, the region specified in the provider block is used by default).
   resource "huaweicloud_identity_user" "test" {
     count = length(var.users_configuration)
   
     name     = lookup(var.users_configuration[count.index], "name", null)
     password = lookup(var.users_configuration[count.index], "password", null)
   }

   The involved parameters are described in the table below.

   Parameter	Description
   name	Username.
   password	User password. Reset the password upon the first login to the console.

5. Add the users to the user group.

   Create the group_members.tf file and add the users created in step 4 to the user group created in step 2. The users will inherit all permissions of the user group.

   resource "huaweicloud_identity_group_membership" "test" {
     count = length(var.users_configuration)
     group = huaweicloud_identityv5_group.test.id
     users = huaweicloud_identity_user.test[*].id
     depends_on = [
       huaweicloud_identityv5_group.test,
       huaweicloud_identity_user.test
     ]
   }

   The involved parameters are described in the table below.

   Parameter	Description
   group	User group ID, which is the ID of the user group created in step 2.
   users	User ID list, which contains the IDs of all users created in step 4.

6. Configure resource parameters.

   Create the terraform.tfvars file and preset the input parameters required by the resources. The following is an example configuration. Modify the parameters based on service requirements.

   # IAM user group configuration
   group_name        = "cce_operate"
   group_description = "CCE resource management"
   
   # IAM policy configuration
   policy_type  = "system"
   policy_names = [
     "CCEFullPolicy"  # Policy name. This policy has all permissions on CCE.
   ]
   
   # IAM user configuration
   users_configuration = [
     {
       name     = "cce_use"   # Username
       password = "*******"  # User password. The password needs to be reset upon the first login to the console.
     }
   ]

   The involved parameters are described in the table below.

   Parameter	Description
   group_name	User group name, for example, cce_operate.
   group_description	User group description.
   policy_type	Policy type. For example, system indicates a system-defined policy.
   policy_names	Policy name list. For example, CCEFullPolicy indicates full access to CCE. If the minimum permissions are required, replace it with CCEReadOnlyPolicy (CCE read-only permissions).
   users_configuration	User configuration list, including the username and password.

Step 3: Initialize and Apply the Terraform Configuration

1. Initialize the environment.

   terraform init

2. View the execution plan and check whether the resource changes meet your expectation.

   terraform plan

3. After confirming the plan, create resources. Terraform will ask for your confirmation. Enter yes to confirm the execution.

   terraform apply

4. View the created resources.

   terraform show

Step 4: Clear Resources

If you no longer need the resources created by Terraform, run the following command to release them: Terraform will ask for your confirmation. Enter yes to confirm the execution.

This operation will permanently delete the user group, all IAM users, and authorization relationships created by Terraform. Ensure that you no longer need them before performing this operation.

terraform destroy