Skip to content

Commit 2fe3a55

Browse files
authored
feat: allow skip saving ssh keys to files
Signed-off-by: GitHub <[email protected]>
1 parent a202c67 commit 2fe3a55

14 files changed

+411
-12
lines changed

README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -147,12 +147,13 @@ Available targets:
147147
| <a name="input_regex_replace_chars"></a> [regex\_replace\_chars](#input\_regex\_replace\_chars) | Terraform regular expression (regex) string.<br>Characters matching the regex will be removed from the ID elements.<br>If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no |
148148
| <a name="input_ssh_key_algorithm"></a> [ssh\_key\_algorithm](#input\_ssh\_key\_algorithm) | SSH key algorithm | `string` | `"RSA"` | no |
149149
| <a name="input_ssh_public_key_file"></a> [ssh\_public\_key\_file](#input\_ssh\_public\_key\_file) | Name of existing SSH public key file (e.g. `id_rsa.pub`) | `string` | `null` | no |
150-
| <a name="input_ssh_public_key_path"></a> [ssh\_public\_key\_path](#input\_ssh\_public\_key\_path) | Path to SSH public key directory (e.g. `/secrets`) | `string` | n/a | yes |
150+
| <a name="input_ssh_public_key_path"></a> [ssh\_public\_key\_path](#input\_ssh\_public\_key\_path) | Path to SSH public key directory (e.g. `/secrets`) | `string` | `null` | no |
151151
| <a name="input_ssm_parameter_enabled"></a> [ssm\_parameter\_enabled](#input\_ssm\_parameter\_enabled) | Whether an SSM parameter store value is created to store the key's private key pem. | `bool` | `false` | no |
152152
| <a name="input_ssm_parameter_path_prefix"></a> [ssm\_parameter\_path\_prefix](#input\_ssm\_parameter\_path\_prefix) | The path prefix for the created SSM parameter e.g. '/ec2/key-pairs/acme-ue1-dev-bastion'. `ssm_parameter_enabled` must be set to `true` for this to take affect. | `string` | `"/ec2/key-pairs/"` | no |
153153
| <a name="input_stage"></a> [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no |
154154
| <a name="input_tags"></a> [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).<br>Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no |
155155
| <a name="input_tenant"></a> [tenant](#input\_tenant) | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no |
156+
| <a name="input_write_ssh_key"></a> [write\_ssh\_key](#input\_write\_ssh\_key) | Whether to write generated keypair to disk at `ssh_public_key_path`. | `string` | `true` | no |
156157

157158
## Outputs
158159

docs/terraform.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,12 +58,13 @@
5858
| <a name="input_regex_replace_chars"></a> [regex\_replace\_chars](#input\_regex\_replace\_chars) | Terraform regular expression (regex) string.<br>Characters matching the regex will be removed from the ID elements.<br>If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no |
5959
| <a name="input_ssh_key_algorithm"></a> [ssh\_key\_algorithm](#input\_ssh\_key\_algorithm) | SSH key algorithm | `string` | `"RSA"` | no |
6060
| <a name="input_ssh_public_key_file"></a> [ssh\_public\_key\_file](#input\_ssh\_public\_key\_file) | Name of existing SSH public key file (e.g. `id_rsa.pub`) | `string` | `null` | no |
61-
| <a name="input_ssh_public_key_path"></a> [ssh\_public\_key\_path](#input\_ssh\_public\_key\_path) | Path to SSH public key directory (e.g. `/secrets`) | `string` | n/a | yes |
61+
| <a name="input_ssh_public_key_path"></a> [ssh\_public\_key\_path](#input\_ssh\_public\_key\_path) | Path to SSH public key directory (e.g. `/secrets`) | `string` | `null` | no |
6262
| <a name="input_ssm_parameter_enabled"></a> [ssm\_parameter\_enabled](#input\_ssm\_parameter\_enabled) | Whether an SSM parameter store value is created to store the key's private key pem. | `bool` | `false` | no |
6363
| <a name="input_ssm_parameter_path_prefix"></a> [ssm\_parameter\_path\_prefix](#input\_ssm\_parameter\_path\_prefix) | The path prefix for the created SSM parameter e.g. '/ec2/key-pairs/acme-ue1-dev-bastion'. `ssm_parameter_enabled` must be set to `true` for this to take affect. | `string` | `"/ec2/key-pairs/"` | no |
6464
| <a name="input_stage"></a> [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no |
6565
| <a name="input_tags"></a> [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).<br>Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no |
6666
| <a name="input_tenant"></a> [tenant](#input\_tenant) | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no |
67+
| <a name="input_write_ssh_key"></a> [write\_ssh\_key](#input\_write\_ssh\_key) | Whether to write generated keypair to disk at `ssh_public_key_path`. | `string` | `true` | no |
6768

6869
## Outputs
6970

examples/complete/main.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@ provider "aws" {
55
module "aws_key_pair" {
66
source = "../../"
77

8-
ssh_public_key_path = var.ssh_public_key_path
9-
generate_ssh_key = var.generate_ssh_key
8+
generate_ssh_key = var.generate_ssh_key
9+
write_ssh_key = var.write_ssh_key
1010

1111
context = module.this.context
1212
}

examples/complete/variables.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,3 +12,8 @@ variable "generate_ssh_key" {
1212
type = bool
1313
description = "If set to `true`, new SSH key pair will be created"
1414
}
15+
16+
variable "write_ssh_key" {
17+
type = bool
18+
description = "If set to `true`, the SSH key pair will be written to disk"
19+
}

examples/dont-write/context.tf

Lines changed: 279 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,279 @@
1+
#
2+
# ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label
3+
# All other instances of this file should be a copy of that one
4+
#
5+
#
6+
# Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf
7+
# and then place it in your Terraform module to automatically get
8+
# Cloud Posse's standard configuration inputs suitable for passing
9+
# to Cloud Posse modules.
10+
#
11+
# curl -sL https://raw.githubusercontent.com/cloudposse/terraform-null-label/master/exports/context.tf -o context.tf
12+
#
13+
# Modules should access the whole context as `module.this.context`
14+
# to get the input variables with nulls for defaults,
15+
# for example `context = module.this.context`,
16+
# and access individual variables as `module.this.<var>`,
17+
# with final values filled in.
18+
#
19+
# For example, when using defaults, `module.this.context.delimiter`
20+
# will be null, and `module.this.delimiter` will be `-` (hyphen).
21+
#
22+
23+
module "this" {
24+
source = "cloudposse/label/null"
25+
version = "0.25.0" # requires Terraform >= 0.13.0
26+
27+
enabled = var.enabled
28+
namespace = var.namespace
29+
tenant = var.tenant
30+
environment = var.environment
31+
stage = var.stage
32+
name = var.name
33+
delimiter = var.delimiter
34+
attributes = var.attributes
35+
tags = var.tags
36+
additional_tag_map = var.additional_tag_map
37+
label_order = var.label_order
38+
regex_replace_chars = var.regex_replace_chars
39+
id_length_limit = var.id_length_limit
40+
label_key_case = var.label_key_case
41+
label_value_case = var.label_value_case
42+
descriptor_formats = var.descriptor_formats
43+
labels_as_tags = var.labels_as_tags
44+
45+
context = var.context
46+
}
47+
48+
# Copy contents of cloudposse/terraform-null-label/variables.tf here
49+
50+
variable "context" {
51+
type = any
52+
default = {
53+
enabled = true
54+
namespace = null
55+
tenant = null
56+
environment = null
57+
stage = null
58+
name = null
59+
delimiter = null
60+
attributes = []
61+
tags = {}
62+
additional_tag_map = {}
63+
regex_replace_chars = null
64+
label_order = []
65+
id_length_limit = null
66+
label_key_case = null
67+
label_value_case = null
68+
descriptor_formats = {}
69+
# Note: we have to use [] instead of null for unset lists due to
70+
# https://github.com/hashicorp/terraform/issues/28137
71+
# which was not fixed until Terraform 1.0.0,
72+
# but we want the default to be all the labels in `label_order`
73+
# and we want users to be able to prevent all tag generation
74+
# by setting `labels_as_tags` to `[]`, so we need
75+
# a different sentinel to indicate "default"
76+
labels_as_tags = ["unset"]
77+
}
78+
description = <<-EOT
79+
Single object for setting entire context at once.
80+
See description of individual variables for details.
81+
Leave string and numeric variables as `null` to use default value.
82+
Individual variable settings (non-null) override settings in context object,
83+
except for attributes, tags, and additional_tag_map, which are merged.
84+
EOT
85+
86+
validation {
87+
condition = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"])
88+
error_message = "Allowed values: `lower`, `title`, `upper`."
89+
}
90+
91+
validation {
92+
condition = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"])
93+
error_message = "Allowed values: `lower`, `title`, `upper`, `none`."
94+
}
95+
}
96+
97+
variable "enabled" {
98+
type = bool
99+
default = null
100+
description = "Set to false to prevent the module from creating any resources"
101+
}
102+
103+
variable "namespace" {
104+
type = string
105+
default = null
106+
description = "ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique"
107+
}
108+
109+
variable "tenant" {
110+
type = string
111+
default = null
112+
description = "ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for"
113+
}
114+
115+
variable "environment" {
116+
type = string
117+
default = null
118+
description = "ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'"
119+
}
120+
121+
variable "stage" {
122+
type = string
123+
default = null
124+
description = "ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'"
125+
}
126+
127+
variable "name" {
128+
type = string
129+
default = null
130+
description = <<-EOT
131+
ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
132+
This is the only ID element not also included as a `tag`.
133+
The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input.
134+
EOT
135+
}
136+
137+
variable "delimiter" {
138+
type = string
139+
default = null
140+
description = <<-EOT
141+
Delimiter to be used between ID elements.
142+
Defaults to `-` (hyphen). Set to `""` to use no delimiter at all.
143+
EOT
144+
}
145+
146+
variable "attributes" {
147+
type = list(string)
148+
default = []
149+
description = <<-EOT
150+
ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,
151+
in the order they appear in the list. New attributes are appended to the
152+
end of the list. The elements of the list are joined by the `delimiter`
153+
and treated as a single ID element.
154+
EOT
155+
}
156+
157+
variable "labels_as_tags" {
158+
type = set(string)
159+
default = ["default"]
160+
description = <<-EOT
161+
Set of labels (ID elements) to include as tags in the `tags` output.
162+
Default is to include all labels.
163+
Tags with empty values will not be included in the `tags` output.
164+
Set to `[]` to suppress all generated tags.
165+
**Notes:**
166+
The value of the `name` tag, if included, will be the `id`, not the `name`.
167+
Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be
168+
changed in later chained modules. Attempts to change it will be silently ignored.
169+
EOT
170+
}
171+
172+
variable "tags" {
173+
type = map(string)
174+
default = {}
175+
description = <<-EOT
176+
Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
177+
Neither the tag keys nor the tag values will be modified by this module.
178+
EOT
179+
}
180+
181+
variable "additional_tag_map" {
182+
type = map(string)
183+
default = {}
184+
description = <<-EOT
185+
Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.
186+
This is for some rare cases where resources want additional configuration of tags
187+
and therefore take a list of maps with tag key, value, and additional configuration.
188+
EOT
189+
}
190+
191+
variable "label_order" {
192+
type = list(string)
193+
default = null
194+
description = <<-EOT
195+
The order in which the labels (ID elements) appear in the `id`.
196+
Defaults to ["namespace", "environment", "stage", "name", "attributes"].
197+
You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present.
198+
EOT
199+
}
200+
201+
variable "regex_replace_chars" {
202+
type = string
203+
default = null
204+
description = <<-EOT
205+
Terraform regular expression (regex) string.
206+
Characters matching the regex will be removed from the ID elements.
207+
If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits.
208+
EOT
209+
}
210+
211+
variable "id_length_limit" {
212+
type = number
213+
default = null
214+
description = <<-EOT
215+
Limit `id` to this many characters (minimum 6).
216+
Set to `0` for unlimited length.
217+
Set to `null` for keep the existing setting, which defaults to `0`.
218+
Does not affect `id_full`.
219+
EOT
220+
validation {
221+
condition = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0
222+
error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length."
223+
}
224+
}
225+
226+
variable "label_key_case" {
227+
type = string
228+
default = null
229+
description = <<-EOT
230+
Controls the letter case of the `tags` keys (label names) for tags generated by this module.
231+
Does not affect keys of tags passed in via the `tags` input.
232+
Possible values: `lower`, `title`, `upper`.
233+
Default value: `title`.
234+
EOT
235+
236+
validation {
237+
condition = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case)
238+
error_message = "Allowed values: `lower`, `title`, `upper`."
239+
}
240+
}
241+
242+
variable "label_value_case" {
243+
type = string
244+
default = null
245+
description = <<-EOT
246+
Controls the letter case of ID elements (labels) as included in `id`,
247+
set as tag values, and output by this module individually.
248+
Does not affect values of tags passed in via the `tags` input.
249+
Possible values: `lower`, `title`, `upper` and `none` (no transformation).
250+
Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs.
251+
Default value: `lower`.
252+
EOT
253+
254+
validation {
255+
condition = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case)
256+
error_message = "Allowed values: `lower`, `title`, `upper`, `none`."
257+
}
258+
}
259+
260+
variable "descriptor_formats" {
261+
type = any
262+
default = {}
263+
description = <<-EOT
264+
Describe additional descriptors to be output in the `descriptors` output map.
265+
Map of maps. Keys are names of descriptors. Values are maps of the form
266+
`{
267+
format = string
268+
labels = list(string)
269+
}`
270+
(Type is `any` so the map values can later be enhanced to provide additional options.)
271+
`format` is a Terraform format string to be passed to the `format()` function.
272+
`labels` is a list of labels, in order, to pass to `format()` function.
273+
Label values will be normalized before being passed to `format()` so they will be
274+
identical to how they appear in `id`.
275+
Default is `{}` (`descriptors` output will be empty).
276+
EOT
277+
}
278+
279+
#### End of copy of cloudposse/terraform-null-label/variables.tf
Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
region = "us-east-2"
2+
3+
namespace = "eg"
4+
5+
stage = "test"
6+
7+
name = "aws-key-pair-dont-write"
8+
9+
generate_ssh_key = true
10+
11+
write_ssh_key = false

examples/dont-write/main.tf

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
provider "aws" {
2+
region = var.region
3+
}
4+
5+
module "aws_key_pair" {
6+
source = "../../"
7+
8+
ssh_public_key_path = var.ssh_public_key_path
9+
generate_ssh_key = var.generate_ssh_key
10+
11+
context = module.this.context
12+
}

examples/dont-write/outputs.tf

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
output "key_name" {
2+
value = module.aws_key_pair.key_name
3+
description = "Name of SSH key"
4+
}
5+
6+
output "public_key" {
7+
value = module.aws_key_pair.public_key
8+
description = "Content of the generated public key"
9+
}
10+
11+
output "public_key_filename" {
12+
description = "Public Key Filename"
13+
value = module.aws_key_pair.public_key_filename
14+
}
15+
16+
output "private_key_filename" {
17+
description = "Private Key Filename"
18+
value = module.aws_key_pair.private_key_filename
19+
}

examples/dont-write/variables.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
variable "region" {
2+
type = string
3+
description = "AWS region"
4+
}
5+
6+
variable "ssh_public_key_path" {
7+
type = string
8+
description = "Path to SSH public key directory (e.g. `/secrets`)"
9+
}
10+
11+
variable "generate_ssh_key" {
12+
type = bool
13+
description = "If set to `true`, new SSH key pair will be created"
14+
}

0 commit comments

Comments
 (0)