Migrate users from account-baseline-security to iam-users-and-groups

[justin-octo]

Trying to move users out of security/_global/account-baseline (uses account-baseline-security) and into a new module security/_global/iam/users using iam-users-and-groups

Initially we had our users deployed using terraform-aws-service-catalog/landingzone/account-baseline because we only had a few engineers/architects. We have since added more users to our admin staff. Managing the users has become very unwieldy using account-baseline-security. And so we want to split off the users into a separate module and iam-users-adn-groups seems to be the best way.
My thought was to just move the users over and leave the groups (mostly just the CrossAccount groups). We already had the users in a separate users.yml file.
What's the best way to do this?

I am trying to do a terragrunt state mv command, but when I try to do a terragrunt plan in the new folder/location it says:

Error: resource address "aws_iam_user.user" does not exist in the configuration.

But it is definitely in the users.yml file. Thinking I just imported it wrong?

---

Tracked in ticket #110818

[justin-octo]

We don't want to delete and recreate the users.

[josh-padnick]

@iangrunt Could you assist with this question?

[iangrunt]

@justin-octo, could you describe all the steps you took in terms of running cd, mkdir, mv and import? Thank you!

[justin-octo]

Based roughly on the second use case here https://www.maxivanov.io/how-to-move-resources-and-modules-in-terragrunt/

This is roughly what I did, or tried to do anyway. Names have been changed to protect the innocent (or guilty, or neither).

BEFORE
infrastructure-live/
|-- security/
    |-- _global/
        |-- account-baseline/
            |-- terragrunt.hcl	# module contains all the account-baseline-security including users
            |-- users-groupA.yml
            |-- users-groupB.yml
            |-- users-groupC.yml

AFTER
infrastructure-live/
|-- security/
    |-- _global/
        |-- account-baseline/
            |-- terragrunt.hcl	# module contains all the account-baseline-security excluding users
        |-- iam/
            |-- users/
                |-- terragrunt.hcl	# module contains all the users (not the groups)
                |-- users-groupA.yml
                |-- users-groupB.yml
                |-- users-groupC.yml

1. make a backup, make it read only to be safe (we have remote in S3 with versioning, but just in case)
   From the folder infrastructure-live/security/_global/account-baseline/

aws-vault exec security-profile -- terragrunt state pull > ../../../../security-account-baseline-backup.tfstate
chmod 400 ../../../../security-account-baseline-backup.tfstate

2. Make new directory, move user yml files

mkdir /work/infrastructure-live/security/_global/iam/user
cp /work/infrastructure-live/security/_global/account-baseline/*.yml /work/infrastructure-live/security/_global/iam/users/

Edited the infrastructure-live/security/_global/account-baseline/terragrunt.hcl to exclude the users.
Created the new infrastructure-live/security/_global/iam/users/terragrunt.hcl to include the users in the YML files.

3. Init a new state file for this new module and pull it down

cd /work/infrastructure-live/security/_global/iam/user
aws-vault exec security-profile -- terragrunt init
aws-vault exec security-profile -- terragrunt state pull > iam-users.tfstate

4. Move each user one-by-one (so far just trying with a "test.user")
   From the folder infrastructure-live/security/_global/account-baseline/

aws-vault exec security-profile -- terragrunt state mv -state-out /work/infrastructure-live/security/_global/iam/users/iam-users.tfstate aws_iam_user.user[\"test.user\"] aws_iam_user.user[\"test.user\"]

5. Move to the new folder and push the local state file with the added user

cd /work/infrastructure-live/security/_global/iam/user
aws-vault exec security-profile -- terragrunt state push /work/infrastructure-live/security/_global/iam/user/iam-users.tfstate

6. Verify the new user is added to the state file properly and Terragrunt shows no changes

aws-vault exec security-profile -- terragrunt plan

At some point I also did the terragrunt state mv on two group membership objects as well (when it did not work at first).

Since then, I believe I needed the module.iam-users.aws_iam_user.user["test.user"] instead?
So, I think I'm going to remove the state file from the S3 bucket for infrastructure-live/security/_global/iam/user and start over.

any tips or advice, or if I'm just plane doing it wrong

[justin-octo]

At some point I also tried this when the terragrunt plan showed the user did not exist:

cd /work/infrastructure-live/security/_global/iam/user
aws-vault exec security-profile -- terragrunt import module.iam_users.aws_iam_user.user "test.user"

[justin-octo]

If I'm totally messing this up (likely), it would be nice to have a step-by-step of how to do it properly somewhere. By "it", I mean separate users out from account-baseline-security and move them to iam-users-and-groups.

[justin-octo]

We use this in the terragrunt.hcl to combine the yml files:

  users = merge(
    yamldecode(file("users-groupA.yml")),
    yamldecode(file("users-groupB.yml")),
    yamldecode(file("users-groupC.yml"))
  )

[justin-octo]

Each of the yml files contains a list of users in this format (obviously different groups for different users):

test.user:
  create_login_profile: true
  groups:
    - iam-user-self-mgmt
    - _account.staging-read-only
    - _account.staging-vpn-users
  pgp_key: keybase:justinwork-notreally
  tags:
    email: justin.roysdon+test@work.com

[justin-octo]

Keybase user and email not real in the above posted YML. Just for example purposes.

[justin-octo]

I think I got it...

module.iam_users.aws_iam_user.user[\"test.user2\"] 

is what I needed

[iangrunt]

@justin-octo, thank you for your thoroughness before I had the chance to respond and replicate!

Was the issue escaping the quotes from terragrunt import?

[justin-octo]

No, while the proper escaping was important, it was that I had selected the wrong resource during the terragrunt state mv process. I had tried to move the aws_iam_user.user which did not exist. But rather I needed to move the resource module.iam_users.aws_iam_user.user. I needed to do this for each user. In addition, I needed to move the group membership and web_console resources for each user. So these three:

module.iam_users.aws_iam_user_group_membership.group_memberships
module.iam_users.aws_iam_user_login_profile.web_console
module.iam_users.aws_iam_user.user

I did find that I could put it into a for loop as well.

moving_users="test.user test.user2 test.user3"
for user in ${moving_users}; do
    aws-vault exec security-profile -- terragrunt state mv -state-out /work/infrastructure-live/security/_global/iam/users/iam-users.tfstate module.iam_users.aws_iam_user_group_membership.group_memberships[\"${user}\"] module.iam_users.aws_iam_user_group_membership.group_memberships[\"${user}\"]
    aws-vault exec security-profile -- terragrunt state mv -state-out /work/infrastructure-live/security/_global/iam/users/iam-users.tfstate module.iam_users.aws_iam_user_login_profile.web_console[\"${user}\"] module.iam_users.aws_iam_user_login_profile.web_console[\"${user}\"]
    aws-vault exec security-profile -- terragrunt state mv -state-out /work/infrastructure-live/security/_global/iam/users/iam-users.tfstate module.iam_users.aws_iam_user.user[\"${user}\"] module.iam_users.aws_iam_user.user[\"${user}\"]
done

I still had to manually update the respective users.yml files in each module after the state mv. And then I was able to verify everything with a terragrunt apply in each module (account-baseline and the new iam-users).

Some minor things like password_reset_required = true -> false popped up, but did not have any significant impact. These may have been users who needed to update their password. But it did not impact the relocation of the users from one module to the other.

[justin-octo]

New Steps:

1. Backup state file in account-baseline

cd /work/infrastructure-live/security/_global/account-baseline
aws-vault exec security-profile -- terragrunt state pull > iam-users.tfstate

2. Download state file in iam-users iam-users.tfstate

cd /work/infrastructure-live/security/_global/iam/users/
aws-vault exec security-profile -- terragrunt state pull > iam-users.tfstate

3. From account-baseline, terragrunt state mv user and group memberships -state-out /work/infrastructure-live/security/_global/iam/users/iam-users.tfstate

cd /work/infrastructure-live/security/_global/account-baseline
aws-vault exec security-profile -- terragrunt state mv -state-out /work/infrastructure-live/security/_global/iam/users/iam-users.tfstate module.iam_users.aws_iam_user_group_membership.group_memberships[\"test.user\"] module.iam_users.aws_iam_user_group_membership.group_memberships[\"test.user\"]
aws-vault exec security-profile -- terragrunt state mv -state-out /work/infrastructure-live/security/_global/iam/users/iam-users.tfstate module.iam_users.aws_iam_user.user[\"test.user\"] module.iam_users.aws_iam_user.user[\"test.user\"]
aws-vault exec security-profile -- terragrunt state mv -state-out /work/infrastructure-live/security/_global/iam/users/iam-users.tfstate module.iam_users.aws_iam_user_login_profile.web_console[\"test.user\"] module.iam_users.aws_iam_user_login_profile.web_console[\"test.user\"]

5. Uncomment user in iam/users/users.yml AND comment out user from account-baseline/users.yml
6. Push to remote state file in S3

cd /work/infrastructure-live/security/_global/iam/users/
aws-vault exec security-profile -- terragrunt state push /work/infrastructure-live/security/_global/iam/users/iam-users.tfstate

7. From /work/infrastructure-live/security/_global/iam/users/, run aws-vault exec security-profile -- terragrunt plan to verify "no changes"
8. Fix things... if needed.
9. If it is all good, Delete the local state file, rm /work/infrastructure-live/security/_global/iam/users/iam-users.tfstate

[justin-octo]

A couple of times I had to restore the statefile from the local copy to the S3 bucket, and delete the lock Id in DynamoDB. I'm wondering if I could have just done this rather than the terragrunt state push... command. But I felt it better to try to trust the tooling.

[justin-octo]

I tried to do the users in batches about 3 at a time "just in case". Some I did one at a time if I knew they might be special.