Day 16 - Managing AWS IAM Users with Terraform using CSV
Introduction
Today I worked on managing AWS IAM users using Terraform with a CSV-driven approach.
Instead of creating users manually in the AWS Console, I treated the CSV file as a source of truth. Terraform reads this file, creates users, assigns tags, and dynamically places them into groups.
This felt very similar to database thinking. Each row in the CSV behaves like a table row, and Terraform applies logic on top of it.
Architecture Overview
What I Built
- IAM users created from CSV file
- IAM groups for logical organization
- Dynamic group membership using filters
- Tags used as metadata to drive logic
Step 1: Using CSV as a Data Source
The users.csv file acts as a structured dataset.
Example:
first_name,last_name,department,job_title
Michael,Scott,Education,Regional Manager
Dwight,Schrute,Sales,Assistant to the Regional Manager
Each row represents one user.
Step 2: Reading CSV in Terraform
locals {
users = csvdecode(file("${path.module}/users.csv"))
}
csvdecode() converts the CSV into a list of objects. This is similar to loading a table into memory.
Step 3: Creating IAM Users
resource "aws_iam_user" "users" {
for_each = local.users_map
name = each.key
}
Instead of manually defining each user, Terraform loops through the dataset and creates users automatically.
Step 4: Enabling Console Access
resource "aws_iam_user_login_profile" "users" {
for_each = aws_iam_user.users
}
Each user gets console access with password reset enforced.
Step 5: Dynamic Group Membership
users = [
for user in aws_iam_user.users : user.name
if user.tags.Department == "Education"
]
This is the most important part.
Instead of assigning users manually, Terraform filters users based on attributes.
How I Think About This
This felt very similar to SQL:
SELECT username
FROM users
WHERE department = 'Education';
- CSV = table
- rows = users
- filter = WHERE clause
- Terraform = execution engine
Step 6: Validation
Commands used:
terraform init
terraform plan
terraform apply
Key Learnings
- Terraform can work like a data processing engine
- CSV can act as a lightweight source of truth
for_eachis critical for scaling- Tags can drive automation logic
- Group membership can be fully dynamic
Real World Use
This approach can be used for:
- Employee onboarding
- Department-based access control
- Bulk user provisioning
- Reproducible IAM setup across environments
Improvements I Would Add Next
- Attach IAM policies to groups
- Enforce MFA
- Integrate with AWS SSO
- Extend CSV with email or environment fields
Conclusion
This was one of the most practical exercises so far.
It showed how Terraform can move beyond infrastructure and manage identities in a structured and scalable way.
Comments
Post a Comment