Package: iambic-core
IAMbic: Cloud IAM as Code"IAMbic: Version Control for IAM"IAMbic is designed for DevSecOps, Security, and Compliance teams. It provides enhanced visibility, auditing, and (optionally) control over IAM at scale. It integrates with IAM sources like AWS, Okta, Azure AD, and Google Workspace, consolidating them into a single version control system (Git) in a common, human-readable YAML files that are called "IAMbic templates".Whether you're managing resources through Terraform, CDK, CloudFormation, manual console operations, or a combination of these, IAMbic keeps your Git repository updated with the real-time state of your cloud IAM. Any IAM change, irrespective of its origin, triggers a git commit. This ensures you have a consolidated Git repository of all your IAM, presented in a common format, complete with a comprehensive audit trail in Git History. This trail details every change, its timestamp, and the responsible entity.If you'd prefer a hands-off approach, IAMbic can function purely as an auditing and visibility tool to have increased visibility over IAM changes, as mentioned above. But you can also use IAMbic to manage and prevent drift on the IAM resources that you specify. IAMbic templates are bi-directional, which means IAMbic can also write IAM changes back to the cloud through your CI/CD pipeline. A pull request with the desired change would be created in GitHub, approved, and then reflected back in the cloud and Git. Additionally, IAMbic lets you declare temporary access or permissions - It will take care of expiring and removing policies after a defined expiration period. Examples of this arein IAMbic's Quick Start Guide.If you'd like to learn more about the Github Pull-Request flow for making IAM changes, Check out an example on ourGitOps/IAMOps Philosophy page. We also have asample iambic-templates repository, which is fully managed by IAMbic.Discover more athttps://docs.iambic.org.Check out BeABetterDev's IAMbic Overview and Deep Dive video below for a quick overview of IAMbic's capabilities.We're also onSlackif you'd like help getting started or have any questions.Integration with Terraform or other IaC toolsIAMbic is designed to work in harmony with Terraform and other Infrastructure-as-Code (IaC) solutions. It acts as a complementary tool, enhancing the strengths of existing IaC setups by providing centralized visibility and auditing for Identity and Access Management (IAM). To understand how IAMbic and Terraform elevate IAM together, and how they can be integrated seamlessly in your DevOps pipeline, check out ourin-depth blog post.Below is a table of the key differences between IAMbic and Terraform:FeatureIAMbicTerraform (or other IaC)Multi-Account AWS and OrgsNative Support3rd Party Tools (Terragrunt, etc)Declarative TemporaryAccess/PermissionsNative SupportNoImports current IAMto VCSYes3rd Party Tools(Limited to single AWS Account)Auto-commits new IAMchanges to VCSYesNoCloudtrail Attribution for IAM changesYesNoBi-Directional SyncYesNoDrift PreventionYesLimitedCentral Source of Truthfor current state of all  IAMYesNoMulti-Cloud SupportCurrently AWS, Azure AD, Okta, and Google Workspace,with more coming soon.YesLanguageYAMLHCLOpen SourceYesNoCentralizedGovernance & ComplianceNative in VCSNoCommunity SupportGrowingStrongKey FeaturesVersion Control for IAM: IAMbic helps you audit and (optionally) manage IAM from different sources by bringing them together into one Git repository in an easy-to-read format.Comprehensive audit trail: IAMbic creates Git commits for all IAM changes, regardless of how they take place. This gives you a comprehensive audit trail in Git history.Temporary Access and Permissions: Declaratively define and automate expiration dates for resources, permissions, and access rules.Drift Prevention: Protect the IAM resources you want to be exclusively managed via IAMbic. IAMbic will automatically revert any out-of-band changes to those resources.Dynamic AWS Permissions: Simplify multi-account AWS management with flexible templates, allowing multi-account roles to have different permissions and access rules on different accounts.Centralized Management: IAMbic keeps Git updated with the latest, complete state of your cloud environment, maintaining a single source of truth for auditing and compliance across multiple cloud providers in Git.Extendable: Integrate with various clouds and applications through a powerful plugin architecture.Auditable: Track changes to IAM policies, permissions, and rules with Git history. For AWS, IAmbic annotates out-of-band commits with details from CloudTrail.Check outIAMbic IAMOps Philosophyand anexample IAMbic templates repositoryto see a real-life example of IAMbic.📣 Let's chatDo you want to connect with our contributors?Just click the button below and follow the instructions.Getting StartedDive into IAMbic with ourquick-start guideand explore powerfultemplate examplesfor AWS Multi-Account Roles,
Identity Center (SSO) Permission Sets, Service Control Policies, Dynamic Permissions,
Okta Applications and Group Assignments, Azure Active Directory Users and Groups, and Google Workspace Group Assignments.We are rapidly expanding support for existing resources and cloud providers, so check back often!Installing IAMbic and Supported VersionsInstall the required PrerequisitesInstall and configure IAMbicTemplate ExamplesHere are some examples showcasing IAMbic's capabilities:AWS Multi-Account Cloudwatch RoleCreate a Cloudwatch role with static permissions across three accounts, dynamically generating role names based on the account the role is deployed to. This template would result in the creation of three roles: "dev_cloudwatch",
"staging_cloudwatch", and "prod_cloudwatch" on the respective AWS accounts.See theGetting Started guide for AWS, the AWS IAM Role section of ourExample Templates repository, and ourblog post on multi-account rolesfor more information.template_type:NOQ::AWS::IAM::Roleidentifier:'{{var.account_name}}_cloudwatch'included_accounts:-dev-staging-prodproperties:description:-description:Cloudwatch role for {{var.account_name}}assume_role_policy_document:statement:-action:-sts:AssumeRole-sts:TagSessioneffect:Allowprincipal:aws:arn:aws:iam::123456789012:role/ExampleRoleversion:'2012-10-17'inline_policies:policy_name:cloudwatch_logsstatement:-effect:allowaction:-logs:DescribeLogGroups-logs:DescribeLogStreams-logs:GetLogEvents-logs:GetLogRecord-logs:GetQueryResults-logs:TestMetricFilter-logs:FilterLogEvents-logs:StartQuery-logs:StopQueryresource:"*"managed_policies:-policy_arn:arn:aws:iam::aws:policy/AdministratorAccessrole_name:'{{var.account_name}}_cloudwatch'tags:-key:ownervalue:devopsAWS Dynamic PermissionsCreate a BackendDeveloperRole with varying permissions based on the AWS account. See theGetting Started guide for AWSfor more information.template_type:NOQ::AWS::IAM::Roleidentifier:'{{var.account_name}}_backend_developer'included_accounts:-'*'excluded_accounts:-complianceproperties:description:-description:Backend developer role for {{var.account_name}}assume_role_policy_document:statement:-action:-sts:AssumeRole-sts:TagSessioneffect:Allowprincipal:aws:arn:aws:iam::123456789012:role/ExampleRoleversion:'2012-10-17'inline_policies:-policy_name:s3_policystatement:-# Policy applies to role on all accounts except `customer_data`.excluded_accounts:-customer_dataeffect:allowaction:-s3:GetObject-s3:ListObjectresource:-"*"condition:StringNotEquals:s3:ResourceTag/sensitive:'true'-# Allow write access to non-sensitive resources on the dev accountincluded_accounts:-deveffect:allowaction:-s3:PutObjectresource:-"*"condition:StringNotEquals:s3:ResourceTag/sensitive:'true'role_name:'{{var.account_name}}_backend_developer'tags:-key:ownervalue:devopsAWS Identity Center (SSO) Permission SetsCreate an AWS Identity Center (SSO) permission set with varying permissions based on the AWS account. See theGetting Started guide for AWS, the AWS IC/SSO Permission Set section of ourExample Templates repository, and our blog post onTailoring AWS Identity Center (SSO) Permissions Per Account with IAMbicfor more information.template_type:NOQ::AWS::IdentityCenter::PermissionSetaccess_rules:-expires_at:2028-05-19T14:17 UTCgroups:-engineeringidentifier:designproperties:name:designcustomer_managed_policy_references:-name:base_denyinline_policy:statement:-action:-ec2:list*effect:Denyresource:-'*'-action:-ec2:list*effect:Denyexpires_at:2033-05-19T14:17 UTCresource:-'*'managed_policies:-arn:arn:aws:iam::aws:policy/AWSHealthFullAccesspermissions_boundary:customer_managed_policy_reference:name:base_permission_boundarysession_duration:PT4Htags:-key:ownervalue:design@example.comOkta Application AssignmentsManage Okta application assignments, including expiration dates for specific users. See theGetting Started guide for Oktafor more information.template_type:NOQ::Okta::Appidp_name:developmentproperties:name:Salesforce.comassignments:-user:username@example.com-user:username2@example.com-user:username3@example.comexpires_at:2023-09-01T00:00 UTCstatus:ACTIVEAWS Service Control PoliciesManaging access to AWS services can be a tricky business. That's where Service Control Policies (SCPs) come in. SCPs allow you to define what services and actions are accessible within your AWS accounts. With IAMbic, you can import your existing SCPs, create new ones that restrict access to specific AWS services, and prevent any drift from occurring to ensure that you're protecting sensitive information the way you intend.For instance, let's say you want to limit access to certain AWS regions. You can create an SCP that denies access to all regions except those you specify. This can be particularly useful if you're looking to maintain tighter control over your data residency and compliance.Here's an example of how you can set this up:template_type:NOQ::AWS::Organizations::SCPaccount_id:'123456789012'iambic_managed:enforcedidentifier:RestrictRegionsorg_id:o-123456properties:policy_document:statement:-condition:StringNotEquals:aws:RequestedRegion:-us-east-1-us-west-2effect:Denynot_action:-a4b:*-budgets:*-ce:*-chime:*-cloudfront:*-cur:*-globalaccelerator:*-health:*-iam:*-importexport:*-mobileanalytics:*-organizations:*-route53:*-route53domains:*-shield:*-support:*-trustedadvisor:*-waf:*-wellarchitected:*resource:-'*'policy_name:RestrictRegionstargets:roots:-r-123In this example, the SCP namedRestrictRegionsdenies access to all AWS regions exceptus-east-1andus-west-2. It also excludes certain global services from the restriction.For more information on how to get started with AWS and SCPs, check out ourGetting Started guide for AWSand theAWS SCP Section of our Example Templates repository. You can also learn more about tailoring AWS Identity Center (SSO) permissions per account with IAMbic in ourblog post.Okta Group AssignmentsEasily manage Okta group assignments with expiration dates for members. See theGetting Started guide for Oktafor more information.template_type:NOQ::Okta::Groupidp_name:mainproperties:name:engineering_internsdescription:Engineering Internsmembers:-username:intern1@example.comexpires_at:2023-09-01# Interns last day-username:intern2@example.comexpires_at:2023-09-01Google Group AssignmentsManage Google Workspace group assignments, including temporary access for external users. See theGetting Started guide for Google
Workspacefor more information.template_type:NOQ::GoogleWorkspace::Groupproperties:name:DockerHubdescription:Dockerhub Accessdomain:example.comemail:dockerhub@example.commembers:-email:owner@example.comrole:OWNER-email:external_user@gmail.com-email:some_engineer@example.comexpires_at:2023-03-05Azure Active Directory UsersManage Azure Active Directory users and their attributes. See theGetting Started guide for Azure ADfor more information.expires_at:2025-01-01template_type:NOQ::AzureAD::Useridp_name:developmentproperties:display_name:Example Usergiven_name:Exampleusername:user@example.comAzure Active Directory Groups and Group AssignmentsManage Azure Active Directory groups and group assignments, including temporary access for external users. See theGetting Started guide for Azure ADfor more information.template_type:NOQ::AzureAD::Groupidp_name:developmentproperties:name:iambic_test_groupdescription:A test group to use with IAMbicmembers:-name:user@example.comdata_type:userexpires_at:tomorrowPreview standalone IAMbic templates repositoryPreview a standaloneIAMbic templates repositoryon how IAMbic tracks multi-cloud IAM assets in GitHub. The repository is made public for you to study. No need to make your repository public.IAMbic - Beta SoftwareIAMbic is currently in beta, and is not yet recommended for use in production environments. We are actively working to improve the stability and performance of the software, and welcome feedback from the community.If you choose to use IAMbic in its current state, please be aware that you may encounter bugs, performance issues, or other unexpected behavior. We strongly recommend testing IAMbic thoroughly in a non-production environment before using it in production.Please report any issues or feedback to our GitHub issue tracker. Thank you for your support and contributions to the project!ContributingContributions to IAMbic are welcome and encouraged! If you find a bug or want to suggest an enhancement, please open an issue. Pull requests are also welcome.Contact UsIf you have any questions or feedback, please reach out to us onSlack. We'd love to hear from you!LicenseIAMbic (This repo)IAMbic is licensed under the Apache-2.0 license. Commercial licenses and support are also available from Noq Software, Inc.Provider PluginsProvider Plugins (Such as the AWS, Okta, Azure Active Directory, and Google Workspace plugins) are licensed under Apache 2. You are free to write your own provider plugins for internal services without releasing its source code.For more information, please visithttps://docs.iambic.org/license.