Terraform remains a powerful automation tool for provisioning cloud resources, though much has evolved in both the AWS and Terraform ecosystems since this article was originally published. Dive in for an updated look at how to use AWS IAM with Terraform.
Why Use AWS IAM with Terraform?
AWS Identity and Access Management (IAM) continues to be essential for securing cloud resources provisioned through Terraform. In today’s zero-trust environment, fine-grained access control is not optional but mandatory for enterprise security. Modern organizations leverage Terraform to implement least-privilege policies at scale, significantly reducing potential attack surfaces while maintaining operational efficiency.
AWS IAM on Terraform: Key Features in 2025
IAM remains critical for managing users, roles, and access policies, but several advancements have emerged:
- Enhanced Policy Control: Beyond basic policies, AWS now supports advanced permission boundaries and session policies that can be fully automated through Terraform’s improved policy syntax validation.
- Short-lived Credentials: The industry has shifted from long-term access keys to temporary, automatically rotating credentials using AWS IAM Identity Center (successor to AWS SSO) which can be fully managed through Terraform.
- Cross-Account Access Management: Enterprise environments now commonly use Terraform to manage complex multi-account strategies with Organization SCPs (Service Control Policies) and resource-based policies across AWS Organizations.
- Automated Compliance Checks: Terraform now integrates with policy-as-code frameworks that validate IAM configurations against compliance standards before deployment.
How Do You Use IAM Policies in Terraform?
Policies still define user permissions to specific cloud resources, but modern implementations use:
- Policy Libraries: Most organizations maintain versioned policy libraries with parameterized templates rather than embedding policy JSON directly in Terraform code.
- Boundary Policies: These limit maximum permissions and are applied alongside regular policies to enforce governance requirements.
- Dynamic Condition Keys: Advanced policies now use condition keys that reference tags and dynamic values for more granular access control.
How Do You Use IAM Key Authentication in Terraform?
Authentication practices have evolved significantly:
- Identity Provider Federation: Rather than static access keys, most enterprises now use OIDC providers with Terraform to obtain temporary credentials.
- AWS IAM Roles Anywhere: This allows for secure certificate-based authentication for non-AWS workloads running Terraform.
- Credential Vaults: HashiCorp Vault and AWS Secrets Manager integration with Terraform provides secure credential rotation and access without hardcoded values.
How Do You Use IAM Roles in Terraform?
Role assignment has become more sophisticated:
- Attribute-Based Access Control (ABAC): Terraform now efficiently implements tag-based permissions for scaling role assignments.
- Permission Sets: When working with AWS IAM Identity Center, Terraform manages Permission Sets rather than traditional IAM roles, providing centralized access management.
- Service Account Roles: For workloads running in EKS or ECS, Terraform manages specialized service roles with precise permissions.
How to Use AWS IAM with Terraform
This updated example demonstrates modern Terraform practices for creating a user with appropriate permissions.
Step 1: Install Terraform
For Debian-based systems:
bash
curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo apt-key add -
sudo apt-add-repository "deb [arch=amd64] https://apt.releases.hashicorp.com $(lsb_release -cs) main"
sudo apt-get update && sudo apt-get install terraform
Step 2: Create a Terraform Project with Modern Structure
bash
mkdir -p aws-iam-example/{modules,environments}
cd aws-iam-example
Step 3: Create a Backend Configuration for State Management
Create backend.tf:
text
terraform {
backend "s3" {
bucket = "company-terraform-state"
key = "iam/user-management.tfstate"
region = "us-west-2"
dynamodb_table = "terraform-locks"
encrypt = true
}
}
Step 4: Configure Provider with Modern Version Constraints
Create providers.tf:
text
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 5.83.0"
}
}
required_version = ">= 1.7.0"
}
provider "aws" {
region = var.aws_region
# Modern best practice uses assume_role instead of static credentials
assume_role {
role_arn = var.terraform_role_arn
}
default_tags {
tags = {
ManagedBy = "Terraform"
Environment = var.environment
Owner = "InfraTeam"
}
}
}
Step 5: Define Variables
Create variables.tf:
text
variable "aws_region" {
description = "AWS region for resources"
type = string
default = "us-west-2"
}
variable "environment" {
description = "Deployment environment"
type = string
default = "dev"
}
variable "terraform_role_arn" {
description = "Role ARN for Terraform to assume"
type = string
}
variable "user_name" {
description = "Name of the IAM user to create"
type = string
default = "terraform-managed-user"
}
Step 6: Create User and Policy Configuration
Create main.tf:
text
resource "aws_iam_user" "storage_user" {
name = var.user_name
path = "/managed/storage/"
# Force MFA enrollment
force_destroy = false
tags = {
Purpose = "Storage Management"
Team = "Storage Operations"
}
}
# Modern practice uses a policy document data source
data "aws_iam_policy_document" "storage_list_policy" {
statement {
sid = "AllowStorageList"
effect = "Allow"
actions = [
"s3:ListAllMyBuckets",
"s3:GetBucketLocation",
]
resources = ["*"]
condition {
test = "Bool"
variable = "aws:MultiFactorAuthPresent"
values = ["true"]
}
}
# Access to Pure Storage integrated services
statement {
sid = "PureStorageIntegration"
effect = "Allow"
actions = [
"s3:GetObject",
"s3:PutObject",
]
resources = [
"arn:aws:s3:::pure-storage-managed-buckets/*",
]
}
}
resource "aws_iam_policy" "storage_list_policy" {
name = "PureStorage-S3ListAccess"
description = "Allow listing S3 buckets with MFA enforcement"
policy = data.aws_iam_policy_document.storage_list_policy.json
}
resource "aws_iam_user_policy_attachment" "storage_policy_attach" {
user = aws_iam_user.storage_user.name
policy_arn = aws_iam_policy.storage_list_policy.arn
}
# Modern access key management approach
resource "aws_iam_access_key" "user_key" {
user = aws_iam_user.storage_user.name
# Best practice: set an expiration date for access keys
lifecycle {
create_before_destroy = true
}
}
Step 7: Create Outputs
Create outputs.tf:
text
output "user_arn" {
description = "ARN of the created IAM user"
value = aws_iam_user.storage_user.arn
}
output "access_key_id" {
description = "Access key ID for the created user"
value = aws_iam_access_key.user_key.id
}
output "secret_access_key" {
description = "Secret access key for the created user"
value = aws_iam_access_key.user_key.secret
sensitive = true
}
Step 8: Initialize and Apply with Modern Workflow
bash
# Initialize with backend configuration
terraform init
# Validate configuration
terraform validate
# Plan with variable files for environment-specific settings
terraform plan -var-file=environments/dev.tfvars -out=tfplan
# Apply the changes
terraform apply tfplan
Step 9: Rotate Credentials Regularly
Create a CI/CD pipeline job that automatically rotates credentials:
bash
# Example scheduled credential rotation command for CI/CD pipeline
terraform apply -var-file=environments/dev.tfvars -target=aws_iam_access_key.user_key -auto-approve
Pure Storage Integration Considerations
This IAM configuration particularly benefits Pure Storage environments in these ways:
- FlashBlade//E Object Storage Integration: The IAM roles created enable secure access to S3-compatible storage on FlashBlade//E systems
- Pure Fusion Platform Automation: These credentials can be used with the Pure Fusion API for automated storage provisioning, creating a seamless data control plane across hybrid infrastructure.
- AI Workload Orchestration: For Pure Storage customers leveraging AWS for AI training workflows, these IAM configurations enable secure data transfer between on-premises FlashBlade storage and AWS compute instances.
Conclusion
Automating IAM with Terraform remains essential in 2025, but implementations now emphasize temporary credentials, fine-grained permissions, security enforcement through policy conditions, and integration with modern CI/CD pipelines. This approach aligns with a unified storage management approach across hybrid clouds, particularly for high-performance AI workloads and database applications requiring both speed and security.
BUYER’S GUIDE, 14 PAGES
Reevaluating Your Virtualization Strategy?
Explore your options in our guide to modern virtualization.
