This is a terraform module that creates a lambda function that rotates Cloudflare secrets stored in AWS Secrets Manager.
This project is part of the Guardian Project Ops collection.
It's free and open source made available under the the GNU Affero General Public v3 License.
The provided lambda can rotate these types of cloudflare secrets:
- api tokens - Rotate API tokens with granular permissions (tokens are visible at https://dash.cloudflare.com/profile/api-tokens)
- tunnel service keys - Rotate tunnel service keys using a non-public API. NOTE: currently there is no way to expire or revoke a service key.
- argo tunnel tokens - Creates and rotates the certfiles you need to pass cloudflared for setting up an Argo tunnel. More information on the structure of this file here
One lambda can manage multiple AWS Secrets Manager (SM) Secrets.
Each AWS SM Secret can only wrap one of the above secret types.
Each type of secret needs a different credential for the lambda to authenticate it self to Cloudflare.
- api tokens - requires an api token with the User.API Tokens permission
- tunnel serivce keys - requires the full Global API Key and account email address
- argo tunnel tokens - requires a tunnel service key and the Origin CA Key the tunnel service key is accepted as an environment variable or optionally as an ARN to another AWS SM Secret that contains the tunnel service key
This module does not provision the aws secrets manager secrets resource.
IMPORTANT: The master branch is used in source just as an example. In your code, do not pin to master because there may be breaking changes between releases.
Instead pin to the release tag (e.g. ?ref=tags/x.y.z) of one of our latest releases.
module "cf_rotate" {
source = "git::https://gitlab.com/guardianproject-ops/terraform-aws-lambda-secrets-manager-cloudflare.git?ref=master"
# only necessary to pass the credentials needed for the secrets that this lambda will rotate
api_token = "xxx" # with User.API Tokens permission
api_key = "xxx"
api_email = "user@example.com"
api_origin_key = "xxx"
api_tunnel_service_key = "xxx" # or ..
api_tunnel_service_key_arns = ["xxxxxx"] # .. the arn takes priority
secret_prefix = "cloudflare/*"
namespace = var.namespace
name = var.name
stage = var.stage
delimiter = var.delimiter
attributes = ["cf", "rotate"]
tags = var.tags
}| Name | Version |
|---|---|
| aws | ~> 2.0 |
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| additional_tag_map | Additional tags for appending to tags_as_list_of_maps. Not added to tags. |
map(string) |
{} |
no |
| api_email | The cloudflare user's email address | string |
"" |
no |
| api_key | The cloudflare user's Global API Key | string |
"" |
no |
| api_origin_key | The Origin CA Key to generate certificates | string |
"" |
no |
| api_token | A Cloudflare API token with User.API Tokens permission | string |
"" |
no |
| api_tunnel_service_key | A single argo tunnel service key to use to generate argo tunnel tokens | string |
"" |
no |
| api_tunnel_service_key_arns | A list of AWS SM Secrets containing argo tunnel service keys that this lambda could use to generate argo tunnel tokens | list(string) |
[] |
no |
| attributes | Additional attributes (e.g. 1) |
list(string) |
[] |
no |
| cloudtrail_log_group_name | The ARN of the log group cloudtrail events are sent to ( used when creating cloudwatch log metric ) | string |
"" |
no |
| cloudwatch_log_group_arn | The ARN of the cloudwatch log group this lambda will log to | string |
n/a | yes |
| cloudwatch_metric_name | The name of the cloudwatch metric | string |
"FailedRotations" |
no |
| cloudwatch_metric_namespace | The namespace to place the metric in | string |
"SecretsManager" |
no |
| context | Single object for setting entire context at once. See description of individual variables for details. Leave string and numeric variables as null to use default value.Individual variable settings (non-null) override settings in context object, except for attributes, tags, and additional_tag_map, which are merged. |
object({ |
{ |
no |
| create_cloudwatch_log_metric | Whether to create cloudwatch metric for failed rotations | bool |
true |
no |
| delimiter | Delimiter to be used between namespace, environment, stage, name and attributes.Defaults to - (hyphen). Set to "" to use no delimiter at all. |
string |
n/a | yes |
| enabled | Set to false to prevent the module from creating any resources | bool |
n/a | yes |
| environment | Environment, e.g. 'uw2', 'us-west-2', OR 'prod', 'staging', 'dev', 'UAT' | string |
n/a | yes |
| id_length_limit | Limit id to this many characters.Set to 0 for unlimited length.Set to null for default, which is 0.Does not affect id_full. |
number |
n/a | yes |
| label_order | The naming order of the id output and Name tag. Defaults to ["namespace", "environment", "stage", "name", "attributes"]. You can omit any of the 5 elements, but at least one must be present. |
list(string) |
n/a | yes |
| name | Solution name, e.g. 'app' or 'jenkins' | string |
n/a | yes |
| namespace | Namespace, which could be your organization name or abbreviation, e.g. 'eg' or 'cp' | string |
n/a | yes |
| regex_replace_chars | Regex to replace chars with empty string in namespace, environment, stage and name.If not set, "/[^a-zA-Z0-9-]/" is used to remove all characters other than hyphens, letters and digits. |
string |
n/a | yes |
| secret_prefix | The Secrets Manager Secret prefix of the secrets this lambda will manage, including the wild card if you want one. e.g., 'cloudflare/*' | string |
n/a | yes |
| stage | Stage, e.g. 'prod', 'staging', 'dev', OR 'source', 'build', 'test', 'deploy', 'release' | string |
n/a | yes |
| tags | Additional tags (e.g. map('BusinessUnit','XYZ') |
map(string) |
{} |
no |
| Name | Description |
|---|---|
| cloudwatch_metric_name | n/a |
| cloudwatch_metric_namespace | n/a |
| lambda | n/a |
File an issue, send us an email or join us in the Matrix 'verse at #guardianproject:matrix.org or IRC at #guardianproject on Freenode.
Please use the issue tracker to report any bugs or file feature requests.
If you are interested in becoming a contributor, want to get involved in developing this project, other projects, or want to join our team, we would love to hear from you! Shoot us an email.
In general, PRs are welcome. We follow the typical "fork-and-pull" Git workflow.
- Fork the repo on GitLab
- Clone the project to your own machine
- Commit changes to your own branch
- Push your work back up to your fork
- Submit a Merge Request so that we can review your changes
NOTE: Be sure to merge the latest changes from "upstream" before making a pull request!
Copyright © 2017-2020 Guardian Project
GNU AFFERO GENERAL PUBLIC LICENSE
Version 3, 19 November 2007
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
See LICENSE.md for full details.
All other trademarks referenced herein are the property of their respective owners.
This project is maintained and funded by The Guardian Project.
We're a collective of designers and developers focused on useable privacy and security. Everything we do is 100% FOSS. Check out out other ops projects and non-ops projects, follow us on mastadon or twitter, apply for a job, or partner with us.
 Abel Luck |
|---|