Create a RAM user and RAM user group by using Terraform - Terraform

Prerequisites

Use a RAM user with minimum required permissions to reduce the risk of leaking your Alibaba Cloud account AccessKey pair. Create a RAM user and Grant permissions to a RAM user. The following policy is used in this example:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ram:GetUser",
        "ram:ListGroupsForUser",
        "ram:ListUsers",
        "ram:ListUsersForGroup",
        "ram:CreateUser",
        "ram:RemoveUserFromGroup",
        "ram:ListGroups",
        "ram:GetGroup",
        "ram:CreateGroup",
        "ram:DeleteGroup",
        "ram:GetLoginProfile",
        "ram:CreateAccessKey",
        "ram:DeleteAccessKey",
        "ram:ListAccessKeys",
        "ram:DeleteLoginProfile",
        "ram:CreateLoginProfile",
        "ram:UpdateLoginProfile",
        "ram:DeleteUser",
        "ram:UpdateAccessKey",
        "ram:AddUserToGroup"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "ram:ListPoliciesForGroup",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "ram:AttachPolicyToGroup",
      "Resource": "*"
    }
  ]
}

Terraform is set up using one of the following methods:
- Use Terraform in Terraform Explorer: An online environment provided by Alibaba Cloud. No installation required. Suitable for quick use and debugging.
- Use Terraform in Cloud Shell: Terraform is preinstalled with credentials configured. Suitable for quick access without setup.
- Install and configure Terraform on your on-premises machine: Suitable for unstable network connections or custom development environments.

Resources used

alicloud_ram_user: a RAM user.
alicloud_ram_login_profile: the console logon settings for the RAM user.
alicloud_ram_access_key: an AccessKey pair of the RAM user.
alicloud_ram_group: a RAM user group.
alicloud_ram_group_membership: adds the RAM user to the RAM user group.

Step 1: Create a RAM user

Create a working directory and a file named main.tf. Copy the following code into the main.tf file. This code creates a RAM user, sets a logon password, and generates an AccessKey pair.

# The password of the RAM user.
variable "password" {
  default = "Test@123456!"
}

# The name of the file that is used to store the AccessKey pair.
variable "accesskey_txt_name" {
  default = "accesskey.txt"
}

resource "random_integer" "default" {
  min = 10000
  max = 99999
}

# The RAM user.
resource "alicloud_ram_user" "user" {
  name = "tf_user_${random_integer.default.result}"
}

# The password of a RAM user.
resource "alicloud_ram_login_profile" "profile" {
  user_name = alicloud_ram_user.user.name
  password  = var.password
}

# The AccessKey pair of the RAM user.
resource "alicloud_ram_access_key" "ak" {
  user_name   = alicloud_ram_user.user.name
  secret_file = var.accesskey_txt_name
}

Note

In production, do not hardcode sensitive values in .tf files. Use input variables without defaults and supply values through terraform.tfvars or environment variables.

Initialize the Terraform environment:

terraform init

Expected output:

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Apply the configuration:

terraform apply

Enter yes when prompted and press Enter. Expected output:

Important

After the configuration is applied, a file that stores the AccessKey pair is generated in the current directory. Keep this file confidential.

You can apply this plan to save these new output values to the Terraform state, without changing any real infrastructure.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes


Apply complete!  Resources: 4 added, 0 changed, 0 destroyed.

Verify the result.

Use either of the following methods:
Run the terraform show command

Run the following command to view the RAM user details:
```
terraform show
```
Log on to the RAM console

Log on to the RAM console. In the left-side navigation pane, choose Identities > Users to view the RAM user.

Step 2: Create a RAM user group and add the RAM user to the RAM user group

Add the following content to the main.tf file.

# The RAM user group.
resource "alicloud_ram_group" "group" {
  name  = "test_ram_group_${random_integer.default.result}"
  force = true
}

# Add the RAM user to the RAM user group.
resource "alicloud_ram_group_membership" "membership" {
  group_name = alicloud_ram_group.group.name
  user_names = [alicloud_ram_user.user.name]
}

Preview the changes:
```
terraform plan
```
Apply the configuration:
```
terraform apply
```
Enter yes when prompted and press Enter. Expected output:
```
Apply complete!  Resources: 2 added, 0 changed, 0 destroyed.
```
Verify the result.

Use either of the following methods:
Run the terraform show command

Run the following command to view the RAM user group details:
```
terraform show
```
Log on to the RAM console
1. Log on to the RAM console. In the left-side navigation pane, choose Identities > Groups to view the RAM user group.
2. Click the RAM user group name to view its members.

Release resources

Run the following command to release resources you no longer need. The terraform destroy command is documented in Common commands.

terraform destroy

Example

Note

Run the sample code in this topic with a few clicks in Terraform Explorer.

Sample code

# The password of the RAM user.
variable "password" {
  default = "Test@123456!"
}

# The name of the file that is used to store the AccessKey pair.
variable "accesskey_txt_name" {
  default = "accesskey.txt"
}

resource "random_integer" "default" {
  min = 10000
  max = 99999
}

# The RAM user.
resource "alicloud_ram_user" "user" {
  name = "tf_user_${random_integer.default.result}"
}

# The password of a RAM user.
resource "alicloud_ram_login_profile" "profile" {
  user_name = alicloud_ram_user.user.name
  password  = var.password
}

# The AccessKey pair of the RAM user.
resource "alicloud_ram_access_key" "ak" {
  user_name   = alicloud_ram_user.user.name
  secret_file = var.accesskey_txt_name
}

# The RAM user group.
resource "alicloud_ram_group" "group" {
  name  = "test_ram_group_${random_integer.default.result}"
  force = true
}

# Add the RAM user to the RAM user group.
resource "alicloud_ram_group_membership" "membership" {
  group_name = alicloud_ram_group.group.name
  user_names = [alicloud_ram_user.user.name]
}

For additional examples, visit the More Complete Examples page on GitHub.