README.yaml

#
# This is the canonical configuration for the `README.md`
# Run `make readme` to rebuild the `README.md`
#

# Name of this project
name: terraform-aws-iam-account-settings

# License of this project
license: "APACHE2"

# Canonical GitHub repo
github_repo: cloudposse/terraform-aws-iam-account-settings

# Short description of this project
description: |-
  Terraform module to provision general IAM account settings. It will create the IAM account alias for pretty login URLs and set the account password policy."

# Badges to display
badges:
  - name: Latest Release
    image: https://img.shields.io/github/release/cloudposse/terraform-aws-iam-account-settings.svg?style=for-the-badge
    url: https://github.com/cloudposse/terraform-aws-iam-account-settings/releases/latest
  - name: Last Updated
    image: https://img.shields.io/github/last-commit/cloudposse/terraform-aws-iam-account-settings.svg?style=for-the-badge
    url: https://github.com/cloudposse/terraform-aws-iam-account-settings/commits
  - name: Slack Community
    image: https://slack.cloudposse.com/for-the-badge.svg
    url: https://slack.cloudposse.com
usage: |2-

  ```hcl
  module "account_settings" {
    source = "cloudposse/iam-account-settings/aws"
    # Cloud Posse recommends pinning every module to a specific version
    # version     = "x.x.x"

    namespace  = "eg"
    stage      = "prod"
    name       = "account"

    allow_users_to_change_password = true
    minimum_password_length        = 20
    password_reuse_prevention      = 30
  }

  output "account_alias" {
    value = "${module.account_settings.account_alias}"
  }

  output "signin_url" {
    value = "${module.account_settings.signin_url}"
  }
  ```

  ## Security Info

  For better compliance with modern security best practices the following rules are enabled for the AWS account:

  Initial password creation (upon user creation) requires password to be reset on first login
  * Minimum password length: 16 chars
  * Requires at least one upper case letter
  * Requires at least one lower case letter
  * Requires at least one number
  * Requires at least one alphanumeric character
  * Passwords expire after 90 days
  * Passwords may not be repeated more than every 5th time you reset a password
  * Furthermore, MFA is required to assume a role (access to dev/staging/prod accounts), which is how access is granted to any and all AWS resources for staging/production.

  These password requirements are a best effort to meet PCI DSS v3.2.1 regulations for passwords and MFA, as published in May 2018 (in this instance, only for AWS)

  https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf

  Source Sections (starting on page 72):

  * 8.2.3
  * 8.2.4
  * 8.2.5
  * 8.2.6
  * 8.4 (documentation only)

include:
  - "docs/targets.md"
  - "docs/terraform.md"


# List any related terraform modules that this module may be used with or that this module depends on.
related:
  - name: "terraform-aws-iam-assumed-roles"
    description: "Terraform Module for Assumed Roles on AWS with IAM Groups Requiring MFA"
    url: "https://github.com/cloudposse/terraform-aws-iam-assumed-roles"
  - name: "terraform-aws-iam-user"
    description: "Terraform Module to provision a basic IAM user suitable for humans."
    url: "https://github.com/cloudposse/terraform-aws-iam-user"
  - name: "terraform-aws-iam-s3-user"
    description: "Terraform module to provision a basic IAM user with permissions to access S3 resources, e.g. to give the user read/write/delete access to the objects in an S3 bucket"
    url: "https://github.com/cloudposse/terraform-aws-iam-s3-user"
  - name: "terraform-aws-organization-access-group"
    description: "Terraform module to create an IAM Group and Policy to grant permissions to delegated IAM users in the Organization's master account to access a member account"
    url: "https://github.com/cloudposse/terraform-aws-organization-access-group"
  - name: "terraform-aws-ssm-iam-role"
    description: "Terraform module to provision an IAM role with configurable permissions to access SSM Parameter Store"
    url: "https://github.com/cloudposse/terraform-aws-ssm-iam-role"
  - name: "terraform-aws-iam-chamber-user"
    description: "Terraform module to provision a basic IAM chamber user with access to SSM parameters and KMS key to decrypt secrets, suitable for CI/CD systems (e.g. TravisCI, CircleCI, CodeFresh) or systems which are external to AWS that cannot leverage AWS IAM Instance Profiles"
    url: "https://github.com/cloudposse/terraform-aws-iam-chamber-user"
  - name: "terraform-aws-lb-s3-bucket"
    description: "Terraform module to provision an S3 bucket with built in IAM policy to allow AWS Load Balancers to ship access logs"
    url: "https://github.com/cloudposse/terraform-aws-lb-s3-bucket"

# Contributors to this project
contributors: []