# Usage Example **IMPORTANT**: To successfully complete this example, you must first deploy the module by following [module workspace example](../module\_workspace/README.md). ## Attach Run Task into Terraform Cloud Workspace Follow the steps below to attach the run task created from the module into a new Terraform Cloud workspace. The new workspace will attempt to create multiple invalid IAM resources. The Run tasks integration with IAM Access Analyzer will validate it as part of post-plan stage. * Use the provided demo workspace configuration. ```bash cd examples/demo_workspace ``` * Change the org name in with your own Terraform Cloud org name. ``` terraform { cloud { # TODO: Change this to your Terraform Cloud org name. organization = "" workspaces { ... } } ... } ``` * Populate the required variables, change the placeholder value below. ```bash echo 'tfc_org=""' >> tf.auto.tfvars echo 'aws_region=""' >> tf.auto.tfvars echo 'runtask_id=""' >> tf.auto.tfvars echo 'demo_workspace_name=""' >> tf.auto.tfvars ``` * Initialize Terraform Cloud. When prompted, enter the name of the new demo workspace as you specified in the previous step. ```bash terraform init ``` * Configure the AWS credentials (`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`) in Terraform Cloud, i.e. using variable sets. [Follow these instructions to learn more](https://developer.hashicorp.com/terraform/tutorials/cloud-get-started/cloud-create-variable-set). * In order to create and configure the run tasks, you also need to have Terraform Cloud token stored as Variable/Variable Sets in the workspace. Add `TFE_HOSTNAME` and `TFE_TOKEN` environment variable to the same variable set or directly on the workspace.  * Enable the flag to attach the run task to the demo workspace. ```bash echo 'flag_attach_runtask="true"' >> tf.auto.tfvars terraform apply ``` * Navigate back to Terraform Cloud, locate the new demo workspace and confirm that the Run Task is attached to the demo workspace.  ## Test IAM Access Analyzer using Run Task The following steps deploy simple IAM policy with invalid permissions. This should trigger the Run Task to send failure and stop the apply. * Enable the flag to deploy invalid IAM policy to the demo workspace. ```bash echo 'flag_deploy_invalid_resource="true"' >> tf.auto.tfvars ``` * Run Terraform apply again ```bash terraform apply ``` * Terraform apply will fail due to several errors, use the CloudWatch link to review the errors.  ## Requirements | Name | Version | |------|---------| | [terraform](#requirement\_terraform) | >= 1.0.7 | | [aws](#requirement\_aws) | >= 3.73.0, < 5.0.0 | | [tfe](#requirement\_tfe) | ~>0.38.0 | ## Providers | Name | Version | |------|---------| | [aws](#provider\_aws) | >= 3.73.0, < 5.0.0 | | [tfe](#provider\_tfe) | ~>0.38.0 | ## Modules No modules. ## Resources | Name | Type | |------|------| | [aws_cloudwatch_log_group.sample_log](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource | | [aws_iam_policy.policy_with_computed_values](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | | [aws_iam_policy.policy_with_data_source](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | | [aws_iam_policy.policy_with_eof](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | | [aws_iam_role.invalid_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | | [aws_iam_role_policy.invalid_iam_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource | | [aws_kms_key.invalid_kms_key_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource | | [aws_organizations_policy.invalid_scp_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/organizations_policy) | resource | | [tfe_workspace_run_task.aws-iam-analyzer-attach](https://registry.terraform.io/providers/hashicorp/tfe/latest/docs/resources/workspace_run_task) | resource | | [aws_caller_identity.current_account](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | | [aws_iam_policy_document.invalid_kms_key_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.policy_with_data_source](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_partition.current_partition](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source | | [aws_region.current_region](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | | [tfe_organization.org](https://registry.terraform.io/providers/hashicorp/tfe/latest/docs/data-sources/organization) | data source | | [tfe_workspace.workspace](https://registry.terraform.io/providers/hashicorp/tfe/latest/docs/data-sources/workspace) | data source | ## Inputs | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | [aws\_region](#input\_aws\_region) | The region from which this module will be executed. | `string` | n/a | yes | | [demo\_workspace\_name](#input\_demo\_workspace\_name) | The workspace name | `string` | n/a | yes | | [runtask\_id](#input\_runtask\_id) | The run task id of the IAM Access Analyzer run task | `string` | n/a | yes | | [tfc\_org](#input\_tfc\_org) | Terraform Organization name | `string` | n/a | yes | | [flag\_attach\_runtask](#input\_flag\_attach\_runtask) | Switch this flag to true to attach the run task to the workspace | `bool` | `false` | no | | [flag\_deploy\_invalid\_resource](#input\_flag\_deploy\_invalid\_resource) | Switch this flag to true to deploy sample invalid IAM policy and validate it with Run Task | `bool` | `false` | no | | [runtask\_enforcement\_level](#input\_runtask\_enforcement\_level) | The description give to the attached run task (optional) | `string` | `"mandatory"` | no | | [runtask\_stage](#input\_runtask\_stage) | The description give to the attached run task (optional) | `string` | `"post_plan"` | no | ## Outputs No outputs.