Hi everyone! I'm trying to learn AWS IAM and Terraform together. My team said we need to give our external auditors read-only access to our AWS account. They mentioned using something like Check Point CloudGuard, but I wanted to first understand how to do it manually with pure AWS/IAM.
I followed a guide and made this basic Terraform module. It creates a group, a policy, and a user. Could you check if this is secure enough for real auditors? Or is there a big pitfall I'm missing?
```hcl
resource "aws_iam_group" "auditors" {
name = "external-auditors"
}
resource "aws_iam_policy" "read_only" {
name = "AuditorReadOnlyAccess"
policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Effect = "Allow"
Action = [
"cloudtrail:LookupEvents",
"cloudwatch:Describe*",
"config:Describe*",
"iam:GenerateCredentialReport",
"iam:Get*",
"iam:List*",
"s3:GetObject",
"s3:ListBucket"
]
Resource = "*"
}
]
})
}
resource "aws_iam_group_policy_attachment" "auditors_attach" {
group = aws_iam_group.auditors.name
policy_arn = aws_iam_policy.read_only.arn
}
resource "aws_iam_user" "auditor1" {
name = "auditor-john"
}
resource "aws_iam_user_group_membership" "add_to_group" {
user = aws_iam_user.auditor1.name
groups = [aws_iam_group.auditors.name]
}
```
My main worry: Is `Resource = "*"` too permissive even for read-only? Also, if we *were* to use CloudGuard, would it just automate this policy creation, or does it add a lot more security layers? Trying to understand when a dedicated tool becomes necessary.