Terraform Level 1, Task 14: Creating an AWS IAM User

Today's task was a dive into the heart of cloud security: Identity and Access Management (IAM). My objective was to use Terraform to create a new IAM user. This is one of the very first and most important steps in setting up any secure AWS environment, as it's the foundation for controlling who can do what within your account.

I learned how to declare a user as a resource in my Terraform code and provision it using the standard init, plan, apply workflow. This document is my first-person guide to that fundamental process.

The Task

My objective was to use Terraform to create a new AWS IAM user. The specific requirements were: - The user's name had to be iamuser_javed. - The resource had to be created in the us-east-1 region. - All code had to be in a single main.tf file.

My Step-by-Step Solution

1. Write the Code: In the /home/bob/terraform directory, I created my main.tf file and wrote the following simple and declarative code.

   # 1. Configure the AWS Provider
   provider "aws" {
     region = "us-east-1"
   }
   
   # 2. Define the IAM User Resource
   resource "aws_iam_user" "iam_user_javed_resource" {
     name = "iamuser_javed"
   }
   

2. Execute the Terraform Workflow: From my terminal, I ran the three core commands.

   • terraform init: This downloaded the AWS provider plugin.
   • terraform plan: This showed me a preview, confirming that Terraform would create one aws_iam_user resource.
   • terraform apply: After I confirmed with yes, this command created the user in my AWS account. The success message confirmed the task was complete.

Key Concepts (The "What & Why")

• IAM (Identity and Access Management): This is the central nervous system for security in AWS. It's the service that lets me create and manage users, groups, roles, and policies to control access to all my other AWS resources.
• IAM User: An IAM user is an identity that represents a person or an application. Creating individual IAM users is a critical security best practice. It allows you to move away from using the all-powerful "root" account for daily tasks.
• Principle of Least Privilege: This task is the first step in applying this crucial security principle. Once I've created an individual user, my next step in a real-world scenario would be to attach a policy to that user that grants them only the permissions they need to do their job, and nothing more. This dramatically limits the potential damage if a user's credentials are ever compromised.

Deep Dive: The aws_iam_user Resource

The Terraform code for this task was very concise, but it's important to understand what each part does.

[Image of an AWS IAM user icon]

# The provider block configures the "aws" provider to work in the correct region.
# Although IAM is a global service, the provider still needs a default region to make API calls.
provider "aws" {
  region = "us-east-1"
}

# This is the resource block that defines my IAM User.
# "aws_iam_user" is the Resource TYPE, telling Terraform I want an IAM User.
# "iam_user_javed_resource" is the local NAME I use to refer to this user
# within my Terraform code.
resource "aws_iam_user" "iam_user_javed_resource" {

  # The 'name' argument is required and sets the unique name for the user
  # within my AWS account.
  name = "iamuser_javed"
}

In a more advanced scenario, I could add other arguments here, such as path to organize users into folders, or tags to add metadata.

Commands I Used

• terraform init: The first command I ran. It prepared my working directory by downloading the aws provider plugin.
• terraform plan: The "dry run" command that showed me a preview of the aws_iam_user resource to be created.
• terraform apply: The command that executed the plan and created the IAM user in my AWS account after I confirmed with yes.