1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84

# main.tf — IAM compliance fixture
# Produces zero IAM policy violations

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

# No hardcoded credentials — IAM-006 passes
provider "aws" {
  region = "ap-south-1"
}

# IAM-001 — Policies attached to group, not user
resource "aws_iam_group" "app_group" {
  name = "app-group"
}

resource "aws_iam_group_policy" "app_group_policy" {
  name  = "app-group-policy"
  group = aws_iam_group.app_group.name
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["s3:GetObject"]
      Resource = "arn:aws:s3:::my-bucket/*"
    }]
  })
}

# IAM-002 — No access keys created

# IAM-003 — KMS permissions scoped to specific key ARN
resource "aws_iam_role" "app_role" {
  name                 = "app-role"
  permissions_boundary = "arn:aws:iam::123456789012:policy/boundary-policy"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "ec2.amazonaws.com" }
      Action    = "sts:AssumeRole"
    }]
  })
}

resource "aws_iam_role_policy" "scoped_kms" {
  name = "scoped-kms-policy"
  role = aws_iam_role.app_role.name
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["kms:Decrypt"]
      Resource = "arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd"
    }]
  })
}

# IAM-004 — Permissions boundary set (see app_role above)

# IAM-005 — Cross-account trust scoped to specific account with condition
resource "aws_iam_role" "cross_account_role" {
  name                 = "cross-account-role"
  permissions_boundary = "arn:aws:iam::123456789012:policy/boundary-policy"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { AWS = "arn:aws:iam::999999999999:root" }
      Action    = "sts:AssumeRole"
      Condition = {
        StringEquals = {
          "sts:ExternalId" = "unique-external-id"
        }
      }
    }]
  })
}