Now that we have seen how to use the IAM service with both the management console and the AWS CLI,
let us see how to provision IAM resources using Terraform.
To do this, let us make use of the documentation from registry.terraform.io for the AWS provider and
in this case resources specifically for IAM.
The resource that we are looking to create is an IAM user.
And just like we saw with the local file and the random pet resources that we worked on earlier, the
resource name begins with the provider name, which in this case is AWS.
So our resource block would look like this.
The resource type is aws, IAM user.
The resource name is set to Admin user.
This resource expects a mandatory argument called name which is the user's name.
And in this case we have chosen Lucy as our example.
We have also used optional tags which is the key value map.
And here the key is description, and to this we have added a value called technical team leader.
The next step is for us to run terraform init for downloading the provider plugin for AWS.
If we try to run Terraform plan now without any other configuration, you should see an error message
displayed like this.
The first thing that you'll notice is that a user input for the AWS region is prompted by this command.
And as we saw in the introduction to AWS and the IAM section, most resources in AWS are deployed within
a region such as the North Virginia region, Oregon or Ohio as an example.
And although I am, resources are an exception and are created globally and not specifically tied on
to a region, Terraform still expects a region to be provided for it to work.
The second error that we see in the Terraform plan command is that it is not able to find valid credentials
to connect to an AWS account.
Let us see how to fix these two issues next.
First, let us add a provider block for AWS.
This is done by making use of the keyword called provider, which is followed by the provider name,
which in this example is AWS.
Inside this block, we can specify the default AWS region, which in this example is set to us West
two.
We have also added the access key ID and the secret access keys, which will allow Terraform to deploy
resources to our AWS account.
Now, if we run Terraform plan, we should be able to see the execution plan.
And after that, once we run Terraform apply, it should create the resources as per the execution plan.
In the example we have seen so far, we have hardcoded the credentials in the main.tf file.
This is not a recommended approach, especially considering the fact that the configuration file is
something that we intend to store in a version control system.
Another way to pass in credentials with Terraform is by configuring the aws CLI on the client, where
we have installed Terraform.
This creates a credentials file in the hidden directory called AWS.
Inside the home directory of the user.
And this is something that we have seen while we checked out the programmatic access in the previous
lecture.
So instead of hard coding credentials within the provider block, we can move the credentials from the
Terraform configuration file into the credentials file by making use of the AWS configure command.
And this is something that we have seen in the previous lecture.
Once it has been set up, Terraform will automatically use the credentials stored in the credentials
file, and we won't need to use credentials within the Terraform configuration file.
One other way to pass in these values is by making use of environment variables.
To do this, we can export the variables called AWS access Key ID and AWS Secret Access key ID like
this.
You may even set the region in the command line parameter like this.
And this will allow us to remove the provider block completely.
Once this is done, the Terraform commands should work.