removing role_grants

onboarding.tf

@@ -22,24 +22,6 @@ module "strongdm_onboarding" {
   # If set to false the default VPC will be used instead
   # create_vpc = true
 
-
-  # List of existing users to grant resources to
-  # NOTE: These emails must exactly match existing users in strongDM or an error will occur
-  # NOTE: An error will occur if these users are already assigned to a role in strongDM
-  grant_to_existing_users = [
-    var.SDM_ADMINS_EMAILS
-  ]
-
-  # New accounts to create with access to all resources
-  admin_users = [
-    "[email protected]",
-  ]
-
-  # New accounts to create with read-only permissions
-  read_only_users = [
-    "[email protected]",
-  ]
-
   # Tags will be added to strongDM and AWS resources.
   # tags = {}
 }

onboarding/data.tf

@@ -6,9 +6,12 @@ data "aws_vpc" "default" {
   default = true
 }
 
-data "aws_subnet_ids" "subnets" {
+data "aws_subnets" "subnets" {
   count  = var.create_vpc ? 0 : 1
-  vpc_id = data.aws_vpc.default[0].id
+  filter {
+      name   = "vpc-id"
+      values = [data.aws_vpc.default[0].id]
+    }
 }
 
 # ---------------------------------------------------------------------------- #

onboarding/eks_cluster/main.tf

@@ -121,12 +121,6 @@ resource "sdm_resource" "k8s_eks_data_eks" {
   }
 }
 
-resource "sdm_role_grant" "admin_grant_eks" {
-  count       = var.create_eks ? 1 : 0
-  role_id     = var.admins_id
-  resource_id = sdm_resource.k8s_eks_data_eks[0].id
-}
-
 module "configmap" {
   count       = var.create_eks ? 1 : 0
   source = "./configmap"

onboarding/http/main.tf

@@ -79,14 +79,7 @@ resource "sdm_resource" "web_page" {
     tags = merge({ Name = "${var.prefix}-http" }, var.default_tags, var.tags)
   }
 }
-resource "sdm_role_grant" "admin_grant_web_page" {
-  role_id     = var.admins_id
-  resource_id = sdm_resource.web_page.id
-}
-resource "sdm_role_grant" "read_only_grant_web_page" {
-  role_id     = var.read_only_id
-  resource_id = sdm_resource.web_page.id
-}
+
 # ---------------------------------------------------------------------------- #
 # Access the EC2 instance with strongDM over SSH
 # ---------------------------------------------------------------------------- #
@@ -101,8 +94,3 @@ resource "sdm_resource" "ssh_ec2" {
     tags     = merge({ Name = "${var.prefix}-http" }, var.default_tags, var.tags)
   }
 }
-resource "sdm_role_grant" "admin_grant_ssh_ec2" {
-  count       = var.create_ssh ? 1 : 0
-  role_id     = var.admins_id
-  resource_id = sdm_resource.ssh_ec2[0].id
-}

onboarding/mysql/main.tf

@@ -104,11 +104,6 @@ resource "sdm_resource" "mysql_admin" {
   }
 }
 
-resource "sdm_role_grant" "admin_grant_mysql_admin" {
-  role_id     = var.admins_id
-  resource_id = sdm_resource.mysql_admin.id
-}
-
 resource "sdm_resource" "mysql_ro" {
   mysql {
     name     = "${var.prefix}-mysql-read-only"
@@ -122,11 +117,6 @@ resource "sdm_resource" "mysql_ro" {
   }
 }
 
-resource "sdm_role_grant" "read_only_grant_mysql_ro" {
-  role_id     = var.read_only_id
-  resource_id = sdm_resource.mysql_ro.id
-}
-
 # ---------------------------------------------------------------------------- #
 # Access the EC2 instance with strongDM over SSH
 # ---------------------------------------------------------------------------- #
@@ -143,8 +133,3 @@ resource "sdm_resource" "mysql_ssh" {
   }
 }
 
-resource "sdm_role_grant" "admin_grant_mysql_ssh" {
-  count       = var.create_ssh ? 1 : 0
-  role_id     = var.admins_id
-  resource_id = sdm_resource.mysql_ssh[0].id
-}

onboarding/variables.tf

@@ -72,6 +72,6 @@ variable "read_only_users" {
 
 locals {
   vpc_id         = var.create_vpc ? module.network[0].vpc_id : data.aws_vpc.default[0].id
-  subnet_ids     = var.create_vpc ? module.network[0].public_subnets : sort(data.aws_subnet_ids.subnets[0].ids)
+  subnet_ids      = var.create_vpc ? module.network[0].public_subnets : sort(data.aws_subnets.subnets[0].ids)
   default_tags   = { CreatedBy = "strongDM-Onboarding" }
 }

onboarding/windows_server/main.tf

@@ -90,7 +90,3 @@ resource "sdm_resource" "windows_server" {
   }
 }
 
-resource "sdm_role_grant" "admin_grant_windows_server" {
-  role_id     = var.admins_id
-  resource_id = sdm_resource.windows_server.id
-}