Skip to content

Commit 1c612e9

Browse files
jamesiarmesjamesiarmes
committed
Fix: Use the correct variables.
1 parent 04e9334 commit 1c612e9

File tree

3 files changed

+40
-23
lines changed

3 files changed

+40
-23
lines changed

‎README.md‎

Lines changed: 20 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -64,17 +64,19 @@ kms_key_arn = aws_kms_key.example.arn
6464

6565
## Inputs
6666

67-
| Name | Description | Type | Default | Required |
68-
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- | ------- | ----------- |
69-
| project | Name of the project. | `string` | n/a | yes |
70-
| kms_key_arn | ARN for an existing KMS key to use for encryption. Required if `create_kms_key` is set to `false`; ignored otherwise. | `string` | `null` | conditional |
71-
| add_suffix | Apply a random suffix to the secret name. Useful when secrets may need to be replaced, but makes identify secrets by name alone more difficult. | `bool` | `true` | no |
72-
| create_kms_key | Whether to create a new KMS key for encrypting secrets. If set to `false`, `kms_key_arn` must be provided. | `bool` | `true` | no |
73-
| environment | Environment for the project. | `string` | `"dev"` | no |
74-
| key_recovery_period | Recovery period for deleted KMS key, in days. Must be between 7 and 30, or 0 to disable recovery. Only used if `create_kms_key` is set to `true`. | `number` | `30` | no |
75-
| [secrets] | Secrets to be created. | `map(object)` | `{}` | no |
76-
| service | Optional service that these resources are supporting. Example: `"api"`, `"web"`, `"worker"` | `string` | n/a | no |
77-
| tags | Optional tags to be applied to all resources. | `list` | `[]` | no |
67+
| Name | Description | Type | Default | Required |
68+
| ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- | ------- | ----------- |
69+
| project | Name of the project. | `string` | n/a | yes |
70+
| kms_key_arn | ARN for an existing KMS key to use for encryption. Required if `create_kms_key` is set to `false`; ignored otherwise. | `string` | `null` | conditional |
71+
| add_suffix | Apply a random suffix to the secret name. Useful when secrets may need to be replaced, but makes identify secrets by name alone more difficult. | `bool` | `true` | no |
72+
| create_kms_key | Whether to create a new KMS key for encrypting secrets. If set to `false`, `kms_key_arn` must be provided. | `bool` | `true` | no |
73+
| environment | Environment for the project. | `string` | `"dev"` | no |
74+
| key_recovery_period | Recovery period for deleted KMS key, in days. Must be between 7 and 30, or 0 to disable recovery. Only used if `create_kms_key` is set to `true`. | `number` | `30` | no |
75+
| recovery_window | Recovery window for deleted secrets, in days. Must be between 7 and 30, or 0 to disable recovery when the secret is deleted. This value can be overridden for each secret by setting the `recovery_window` for the secret. | `number` | `30` | no |
76+
| [secrets] | Secrets to be created. | `map(object)` | `{}` | no |
77+
| service | Optional service that these resources are supporting. Example: `"api"`, `"web"`, `"worker"` | `string` | n/a | no |
78+
| tags | Optional tags to be applied to all resources. | `list` | `[]` | no |
79+
7880

7981
### secrets
8082

@@ -112,13 +114,13 @@ secrets = {
112114
This would result in a key named `my/example/key-` before the random suffix is
113115
applied.
114116

115-
| Name | Description | Type | Default | Required |
116-
| ---------------------- | ------------------------------------------------------------- | -------- | ------- | -------- |
117-
| description | Description of the secret. | `string` | n/a | yes |
118-
| create_random_password | Creates a random password as the staring value. | `bool` | `false` | no |
119-
| name | Name to use as the prefix for the secret. | `string` | `""` | no |
120-
| recovery_window | Number of days that a secret can be recovered after deletion. | `string` | `30` | no |
121-
| start_value | Value to be set into the secret at creation. | `string` | `"{}"` | no |
117+
| Name | Description | Type | Default | Required |
118+
| ---------------------- | -------------------------------------------------------------------------------------------------------------------- | -------- | ------- | -------- |
119+
| description | Description of the secret. | `string` | n/a | yes |
120+
| create_random_password | Creates a random password as the staring value. | `bool` | `false` | no |
121+
| name | Name to use as the prefix for the secret. | `string` | `""` | no |
122+
| recovery_window | Override the default recovery window. Must be between 7 and 30, or 0 to disable recovery when the secret is deleted. | `number` | `null` | no |
123+
| start_value | Value to be set into the secret at creation. | `string` | `"{}"` | no |
122124

123125
## Outputs
124126

‎main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ module "secrets_manager" {
1414
)
1515
create_random_password = each.value.create_random_password
1616
description = each.value.description
17-
recovery_window_in_days = each.value.recovery_window
17+
recovery_window_in_days = coalesce(each.value.recovery_window, var.recovery_window)
1818
kms_key_id = local.kms_key_id
1919
secret_string = each.value.start_value
2020

‎variables.tf‎

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,13 @@ variable "key_recovery_period" {
2323
type = number
2424
default = 30
2525
description = <<-EOT
26-
Recovery period for deleted KMS key, in days. Must be between 7 and 30, or 0
27-
to disable recovery. Only used if `create_kms_key` is set to `true`.
26+
Recovery period for deleted KMS keys in days. Must be between 7 and 30. Only
27+
used if `create_kms_key` is set to `true`.
2828
EOT
2929

3030
validation {
3131
condition = var.key_recovery_period == 0 || (var.key_recovery_period > 6 && var.key_recovery_period < 31)
32-
error_message = "Recovery period must be between 7 and 30, or 0 to disable recovery."
32+
error_message = "Key recovery period must be between 7 and 30."
3333
}
3434
}
3535

@@ -47,14 +47,29 @@ variable "project" {
4747
description = "Project that these resources are supporting."
4848
}
4949

50+
variable "recovery_window" {
51+
type = number
52+
default = 30
53+
description = <<-EOT
54+
Recovery window for deleted secrets, in days. Must be between 7 and 30, or 0
55+
to disable recovery when the secret is deleted. This value can be overridden
56+
for each secret by setting the `recovery_window` for the secret.
57+
EOT
58+
59+
validation {
60+
condition = var.recovery_window == 0 || (var.recovery_window > 6 && var.recovery_window < 31)
61+
error_message = "Recovery window must be between 7 and 30, or 0 to disable recovery."
62+
}
63+
}
64+
5065
# TODO: Support rotation.
5166
variable "secrets" {
5267
type = map(object({
5368
add_suffix = optional(bool, null)
5469
create_random_password = optional(bool, false)
5570
description = string
5671
name = optional(string, null)
57-
recovery_window = optional(number, 30)
72+
recovery_window = optional(number, null)
5873
start_value = optional(string, "{}")
5974
}))
6075

0 commit comments

Comments
 (0)