Skip to content

Commit c3f8d58

Browse files
mbarrienmbarrien
authored
Add aws-ssm-params and aws-ssm-params-writer (#111)
1 parent 5c845ff commit c3f8d58

File tree

11 files changed

+181
-1
lines changed

11 files changed

+181
-1
lines changed

‎aws-param/README.md

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
1-
# AWS ParamStore Secret
1+
# AWS ParamStore Secret (DEPRECATED)
2+
3+
__*Deprecated. Please use `aws-ssm-params` module for new code*__
24

35
This module is made to work together with [Chamber](https://github.com/segmentio/chamber) to manage secrets in AWS. Typically a user would use chamber to put secrets into the ParamStore and then use this module to read them out in Terraform code.
46

‎aws-ssm-params-writer/README.md

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# AWS SSM Params Writer (DEPRECATED)
2+
3+
__*Deprecated. Please use `aws-ssm-params-writer` module for new code*__
4+
5+
This module will set encrypted string parameters in the AWS SSM parameter store. Designed to be used in combination with
6+
[Chamber](https://github.com/segmentio/chamber) to send variables that are output by a Terraform run to a process via
7+
environment variables.
8+
9+
Parameters are stored in AWS SSM Parameter store at the path `/{project}-{env}-{service}/{name}` where name
10+
is each of the keys of the parameters input.
11+
12+
**WARNING:** These parameters will stored **unencrypted** in the Terraform state file. See more about this issue
13+
in the [Terraform docs](https://www.terraform.io/docs/state/sensitive-data.html).
14+
15+
<!-- START -->
16+
## Inputs
17+
18+
| Name | Description | Type | Default | Required |
19+
|------|-------------|:----:|:-----:|:-----:|
20+
| env | Env for tagging and naming. See [doc](../README.md#consistent-tagging). | string | n/a | yes |
21+
| owner | Owner for tagging and naming. See [doc](../README.md#consistent-tagging). | string | n/a | yes |
22+
| parameters | Map from parameter names to values to set. | map(string) | n/a | yes |
23+
| project | Project for tagging and naming. See [doc](../README.md#consistent-tagging) | string | n/a | yes |
24+
| service | Service for tagging and naming. See [doc](../README.md#consistent-tagging). | string | n/a | yes |
25+
26+
<!-- END -->

‎aws-ssm-params-writer/main.tf

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
locals {
2+
service_name = "${var.project}-${var.env}-${var.service}"
3+
}
4+
5+
data "aws_kms_key" "key" {
6+
key_id = "alias/parameter_store_key"
7+
}
8+
9+
resource "aws_ssm_parameter" "parameter" {
10+
for_each = var.parameters
11+
name = "/${local.service_name}/${each.key}"
12+
value = each.value
13+
14+
type = "SecureString"
15+
key_id = data.aws_kms_key.key.id
16+
overwrite = true
17+
18+
tags = {
19+
managedBy = "terraform"
20+
project = var.project
21+
env = var.env
22+
service = var.service
23+
owner = var.owner
24+
}
25+
}

‎aws-ssm-params-writer/module_test.go

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
package test
2+
3+
import (
4+
"testing"
5+
6+
"github.com/gruntwork-io/terratest/modules/terraform"
7+
)
8+
9+
func TestAWSSSMParamsWriter(t *testing.T) {
10+
options := &terraform.Options{
11+
TerraformDir: ".",
12+
}
13+
terraform.Init(t, options)
14+
}

‎aws-ssm-params-writer/outputs.tf

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+

‎aws-ssm-params-writer/variables.tf

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
variable "project" {
2+
type = string
3+
description = "Project for tagging and naming. See [doc](../README.md#consistent-tagging)"
4+
}
5+
6+
variable "env" {
7+
type = string
8+
description = "Env for tagging and naming. See [doc](../README.md#consistent-tagging)."
9+
}
10+
11+
variable "service" {
12+
type = string
13+
description = "Service for tagging and naming. See [doc](../README.md#consistent-tagging)."
14+
}
15+
16+
variable "owner" {
17+
type = string
18+
description = "Owner for tagging and naming. See [doc](../README.md#consistent-tagging)."
19+
}
20+
21+
variable "parameters" {
22+
type = map(string)
23+
description = "Map from parameter names to values to set."
24+
}

‎aws-ssm-params/README.md

+42
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# AWS SSM Params Reader
2+
3+
This module is made to work together with [Chamber](https://github.com/segmentio/chamber) to manage secrets in AWS. Typically a user would use chamber to put secrets into the ParamStore and then use this module to read them out in Terraform code.
4+
5+
You can use [our secrets setup module](../aws-param-secrets-setup/README.md) to prepare an AWS account/region to work with these tools.
6+
7+
## Example
8+
9+
```hcl
10+
module "secret" {
11+
source = "github.com/chanzuckerberg/cztack/aws-ssm-params-secret?ref=v0.18.2"
12+
13+
project = "acme"
14+
env = "staging"
15+
service = "website"
16+
17+
parameters = ["password"]
18+
}
19+
20+
# yeah don't really do this
21+
output "secret" {
22+
value = module.secret.values
23+
}
24+
```
25+
26+
<!-- START -->
27+
## Inputs
28+
29+
| Name | Description | Type | Default | Required |
30+
|------|-------------|:----:|:-----:|:-----:|
31+
| env | Env for tagging and naming. See [doc](../README.md#consistent-tagging) | string | n/a | yes |
32+
| parameters | Set of names of secrets. | set(string) | n/a | yes |
33+
| project | Project for tagging and naming. See [doc](../README.md#consistent-tagging) | string | n/a | yes |
34+
| service | Service for tagging and naming. See [doc](../README.md#consistent-tagging) | string | n/a | yes |
35+
36+
## Outputs
37+
38+
| Name | Description |
39+
|------|-------------|
40+
| values | "Map from keys to corresponding values stored in the SSM Parameter Store." |
41+
42+
<!-- END -->

‎aws-ssm-params/main.tf

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
locals {
2+
service_name = "${var.project}-${var.env}-${var.service}"
3+
}
4+
5+
data "aws_ssm_parameter" "secret" {
6+
# https://github.com/hashicorp/terraform/issues/22281#issuecomment-517080564
7+
for_each = { for v in var.parameters : v => v }
8+
name = "/${local.service_name}/${each.key}"
9+
}

‎aws-ssm-params/module_test.go

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
package test
2+
3+
import (
4+
"testing"
5+
6+
"github.com/gruntwork-io/terratest/modules/terraform"
7+
)
8+
9+
func TestAWSSSMParams(t *testing.T) {
10+
options := &terraform.Options{
11+
TerraformDir: ".",
12+
}
13+
terraform.Init(t, options)
14+
}

‎aws-ssm-params/outputs.tf

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
output "values" {
2+
description = "Map from keys to corresponding values stored in the SSM Parameter Store."
3+
value = { for k, v in data.aws_ssm_parameter.secret : k => v.value }
4+
}

‎aws-ssm-params/variables.tf

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
variable "env" {
2+
type = string
3+
description = "Env for tagging and naming. See [doc](../README.md#consistent-tagging)"
4+
}
5+
6+
variable "project" {
7+
type = string
8+
description = "Project for tagging and naming. See [doc](../README.md#consistent-tagging)"
9+
}
10+
11+
variable "service" {
12+
type = string
13+
description = "Service for tagging and naming. See [doc](../README.md#consistent-tagging)"
14+
}
15+
16+
variable "parameters" {
17+
type = set(string)
18+
description = "Set of names of secrets."
19+
}

0 commit comments

Comments
 (0)