1.16 : Mini-Project #3 — IAM User Management (CSV-Driven, Terraform-Managed)

🎯 Goal: Automate IAM user onboarding — from HR CSV → AWS users, groups, console access — zero manual steps.

✅ You’ll build:

✅ 26 IAM users (The Office characters — scalable to 10,000+)

✅ Dynamic groups (Education, Managers, Engineers)

✅ Conditional group membership (e.g., JobTitle contains "Manager")

✅ Console access with password reset enforcement

✅ Tags for audit/search (DisplayName, Department, JobTitle)

🧠 Why This Matters (Beyond The Office Jokes)

Manual IAM Onboarding	Terraform-Managed IAM
❌ HR → Email → Ticket → IAM Admin → 3-day delay	✅ HR → CSV → `terraform apply` → 30 seconds
❌ Inconsistent usernames (`Michael`, `mscott`, `michael-scott`)	✅ Standardized: `mscott` → `[first_initial][last_name]`
❌ No audit trail for user creation	✅ Git-tracked CSV + Terraform state
❌ Passwords shared insecurely (Slack/email)	✅ Auto-generated + reset-on-first-login

💡 Golden Rule:

“If your identity system isn’t version-controlled — it’s not production-ready.”

📦 Architecture Diagram

flowchart LR
  A[HR System<br/>(users.csv)] -->|Git| B[Terraform Repo]
  B --> C[Terraform Plan/Apply]
  C --> D[AWS IAM]
  D --> E[Users: mscott, dschrute...]
  D --> F[Groups: Education, Managers, Engineers]
  D --> G[Memberships: Dwight → Managers]
  D --> H[Login Profiles: Reset required]

✅ Critical Flow:

HR updates users.csv (adds jdoe,Engineering,Software Engineer)
Git commit → CI/CD triggers terraform apply
Terraform:
- Creates jdoe IAM user
- Adds to Engineers group
- Enables console access
New hire gets email: “Your AWS account is ready: https://[account].signin.aws.amazon.com/console”

✏️ Hands-On: Terraform Implementation

🔹 File Structure (`/day16/`)

day16/
├── backend.tf        # S3 remote state (encrypted, versioned)
├── provider.tf       # AWS provider (locked version)
├── users.csv         # 📊 HR data source (26 users)
├── main.tf           # User creation + CSV parsing
├── groups.tf         # Groups + dynamic membership
└── TASK.md           # 📝 Your challenge (MFA, SSO, HR integration)

🧠 Why This Matters (Beyond The Office Jokes)

📦 Architecture Diagram

✏️ Hands-On: Terraform Implementation

🔹 File Structure (/day16/)

1️⃣ users.csv — Single Source of Truth

🔹 File Structure (`/day16/`)

1️⃣ `users.csv` — Single Source of Truth