Skip to content

Commit 94ffb0d

Browse files
jritsemajritsema
authored
0.11 branch (#35)
* defaults ecr to immutable * Policy support for ECS/Fagate injection of secrets manager secret * adds example for installing the 0.11 template * adds support for injection of secrets from ssm parameter store
1 parent a91117a commit 94ffb0d

File tree

7 files changed

+222
-5
lines changed

7 files changed

+222
-5
lines changed

‎README.md

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,8 @@ that is needed.
3939
| [autoscale-perf.tf][edap] | Performance-based auto scaling | Yes |
4040
| [autoscale-time.tf][edat] | Time-based auto scaling | Yes |
4141
| [logs-logzio.tf][edll] | Ship container logs to logz.io | Yes |
42-
| [secretsmanager.tf][edsm] | Add a base secret to Secretsmanager | Yes |
42+
| [secretsmanager.tf][edsm] | Add a Secrets Manager secret with a CMK KMS key. Also gives app role and ECS task definition role access to read secrets from Secrets Manager | Yes |
43+
| [ssm-parameters.tf][ssm] | Add a CMK KMS key for use with SSM Parameter Store. Also gives ECS task definition role access to read secrets from parameter store. | Yes |
4344
| [ecs-event-stream.tf][ees] | Add an ECS event log dashboard | Yes |
4445

4546

@@ -87,7 +88,7 @@ create an input vars file (`terraform.tfvars`)
8788
app = "my-app"
8889
environment = "dev"
8990
90-
internal = "true"
91+
internal = true
9192
container_port = "8080"
9293
replicas = "1"
9394
health_check = "/health"
@@ -110,6 +111,11 @@ tags = {
110111
$ fargate-create -f terraform.tfvars
111112
```
112113

114+
Note that if you would like to use Terraform 0.11.x, you can use the following command.
115+
```shell
116+
$ fargate-create -t [email protected]:turnerlabs/terraform-ecs-fargate?ref=v0.11
117+
```
118+
113119

114120
## Additional Information
115121

@@ -139,3 +145,4 @@ $ fargate-create -f terraform.tfvars
139145
[ees]: ./env/dev/ecs-event-stream.tf
140146
[base]: ./base/README.md
141147
[env-dev]: ./env/dev/README.md
148+
[ssm]: ./env/dev/ssm-parameters.tf

‎base/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ $ terraform apply
4040
|------|-------------|:----:|:-----:|:-----:|
4141
| app | Name of the application. This value should usually match the application tag below. | string | | yes |
4242
| aws_profile | The AWS profile to use, this would be the same value used in AWS_PROFILE. | string | | yes |
43+
| image_tag_mutability | The tag mutability setting for the repository. | string | IMMUTABLE | |
4344
| region | The AWS region to use for the bucket and registry; typically `us-east-1`. Other possible values: `us-east-2`, `us-west-1`, or `us-west-2`. <br>Currently, Fargate is only available in `us-east-1`. | string | `us-east-1` | yes |
4445
| saml_role | The role that will have access to the S3 bucket, this should be a role that all members of the team have access to. | string | | yes |
4546
| tags | A map of the tags to apply to various resources. The required tags are: <br>+ `application`, name of the app <br>+ `environment`, the environment being created <br>+ `team`, team responsible for the application <br>+ `contact-email`, contact email for the _team_ <br>+ `customer`, who the application was create for | map | `<map>` | yes |

‎base/ecr.tf

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,15 @@
44
* https://aws.amazon.com/ecr/
55
*/
66

7+
# The tag mutability setting for the repository (defaults to IMMUTABLE)
8+
variable "image_tag_mutability" {
9+
default = "IMMUTABLE"
10+
}
11+
712
# create an ECR repo at the app/image level
813
resource "aws_ecr_repository" "app" {
9-
name = "${var.app}"
14+
name = "${var.app}"
15+
image_tag_mutability = "${var.image_tag_mutability}"
1016
}
1117

1218
data "aws_caller_identity" "current" {}

‎env/dev/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ $ terraform apply
6969
| scale_down_max_capacity | The maximum number of containers to scale down to. | string | `0` | no |
7070
| scale_down_min_capacity | The mimimum number of containers to scale down to. Set this and `scale_down_max_capacity` to 0 to turn off service on the `scale_down_cron` schedule. | string | `0` | no |
7171
| scale_up_cron | Default scale up at 7 am weekdays, this is UTC so it doesn't adjust to daylight savings https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/ScheduledEvents.html | string | `cron(0 11 ? * MON-FRI *)` | no |
72-
| secrets_saml_users | The users (email addresses) from the saml role to give access | list | - | yes |
72+
| secrets_saml_users | The users (case sensitive email addresses) from the saml role to give access to Secrets Manager and SSM Parameter Store | list | - | yes |
7373
| tags | Tags for the infrastructure | map | - | yes |
7474
| vpc | The VPC to use for the Fargate cluster | string | - | yes |
7575

‎env/dev/fargate-create.yml

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,16 @@ prompts:
3030
- "logs-logzio.tf"
3131
- "logs-logzio.zip"
3232

33-
- question: "Would you like an integrated Secrets Manager secret?"
33+
- question: "Would you like to use Secrets Manager for secrets?"
3434
default: "no"
3535
filesToDeleteIfNo:
3636
- "secretsmanager.tf"
3737

38+
- question: "Would you like to use SSM Parameter Store for secrets?"
39+
default: "no"
40+
filesToDeleteIfNo:
41+
- "ssm-parameters.tf"
42+
3843
- question: "Would you like an ECS event log dashboard?"
3944
default: "yes"
4045
filesToDeleteIfNo:

‎env/dev/secretsmanager.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,7 @@ locals {
7171
# list of role users and saml users for policies
7272
role_and_saml_ids = [
7373
"${aws_iam_role.app_role.unique_id}:*",
74+
"${aws_iam_role.ecsTaskExecutionRole.unique_id}:*",
7475
"${local.saml_user_ids}",
7576
]
7677

‎env/dev/ssm-parameters.tf

Lines changed: 197 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,197 @@
1+
locals {
2+
# KMS write actions
3+
kms_write_actions = [
4+
"kms:CancelKeyDeletion",
5+
"kms:CreateAlias",
6+
"kms:CreateGrant",
7+
"kms:CreateKey",
8+
"kms:DeleteAlias",
9+
"kms:DeleteImportedKeyMaterial",
10+
"kms:DisableKey",
11+
"kms:DisableKeyRotation",
12+
"kms:EnableKey",
13+
"kms:EnableKeyRotation",
14+
"kms:Encrypt",
15+
"kms:GenerateDataKey",
16+
"kms:GenerateDataKeyWithoutPlaintext",
17+
"kms:GenerateRandom",
18+
"kms:GetKeyPolicy",
19+
"kms:GetKeyRotationStatus",
20+
"kms:GetParametersForImport",
21+
"kms:ImportKeyMaterial",
22+
"kms:PutKeyPolicy",
23+
"kms:ReEncryptFrom",
24+
"kms:ReEncryptTo",
25+
"kms:RetireGrant",
26+
"kms:RevokeGrant",
27+
"kms:ScheduleKeyDeletion",
28+
"kms:TagResource",
29+
"kms:UntagResource",
30+
"kms:UpdateAlias",
31+
"kms:UpdateKeyDescription",
32+
]
33+
34+
# KMS read actions
35+
kms_read_actions = [
36+
"kms:Decrypt",
37+
"kms:DescribeKey",
38+
"kms:List*",
39+
]
40+
41+
# list of saml users for policies
42+
saml_user_ids = [
43+
"${data.aws_caller_identity.current.user_id}",
44+
"${data.aws_caller_identity.current.account_id}",
45+
"${formatlist("%s:%s", data.aws_iam_role.saml_role_ssm.unique_id, var.secrets_saml_users)}",
46+
]
47+
48+
# list of role users and saml users for policies
49+
role_and_saml_ids = [
50+
"${aws_iam_role.ecsTaskExecutionRole.unique_id}:*",
51+
"${local.saml_user_ids}",
52+
]
53+
54+
sm_arn = "arn:aws:secretsmanager:${var.region}:${data.aws_caller_identity.current.account_id}:secret:${var.app}-${var.environment}-??????"
55+
}
56+
57+
# get the saml user info so we can get the unique_id
58+
data "aws_iam_role" "saml_role_ssm" {
59+
name = "${var.saml_role}"
60+
}
61+
62+
# The users (email addresses) from the saml role to give access
63+
# case sensitive
64+
variable "secrets_saml_users" {
65+
type = "list"
66+
}
67+
68+
# kms key used to encrypt ssm parameters
69+
resource "aws_kms_key" "ssm" {
70+
description = "ssm parameters key for ${var.app}-${var.environment}"
71+
deletion_window_in_days = 7
72+
enable_key_rotation = true
73+
tags = "${var.tags}"
74+
policy = "${data.aws_iam_policy_document.ssm.json}"
75+
}
76+
77+
resource "aws_kms_alias" "ssm" {
78+
name = "alias/${var.app}-${var.environment}"
79+
target_key_id = "${aws_kms_key.ssm.id}"
80+
}
81+
82+
data "aws_iam_policy_document" "ssm" {
83+
statement {
84+
sid = "DenyWriteToAllExceptSAMLUsers"
85+
effect = "Deny"
86+
87+
principals {
88+
type = "AWS"
89+
identifiers = ["*"]
90+
}
91+
92+
actions = "${local.kms_write_actions}"
93+
resources = ["*"]
94+
95+
condition {
96+
test = "StringNotLike"
97+
variable = "aws:userId"
98+
values = ["${local.saml_user_ids}"]
99+
}
100+
}
101+
102+
statement {
103+
sid = "DenyReadToAllExceptRoleAndSAMLUsers"
104+
effect = "Deny"
105+
106+
principals {
107+
type = "AWS"
108+
identifiers = ["*"]
109+
}
110+
111+
actions = "${local.kms_read_actions}"
112+
resources = ["*"]
113+
114+
condition {
115+
test = "StringNotLike"
116+
variable = "aws:userId"
117+
values = ["${local.role_and_saml_ids}"]
118+
}
119+
}
120+
121+
statement {
122+
sid = "AllowWriteToSAMLUsers"
123+
effect = "Allow"
124+
125+
principals {
126+
type = "AWS"
127+
identifiers = ["*"]
128+
}
129+
130+
actions = "${local.kms_write_actions}"
131+
resources = ["*"]
132+
133+
condition {
134+
test = "StringLike"
135+
variable = "aws:userId"
136+
values = ["${local.saml_user_ids}"]
137+
}
138+
}
139+
140+
statement {
141+
sid = "AllowReadRoleAndSAMLUsers"
142+
effect = "Allow"
143+
144+
principals {
145+
type = "AWS"
146+
identifiers = ["*"]
147+
}
148+
149+
actions = "${local.kms_read_actions}"
150+
resources = ["*"]
151+
152+
condition {
153+
test = "StringLike"
154+
variable = "aws:userId"
155+
values = ["${local.role_and_saml_ids}"]
156+
}
157+
}
158+
}
159+
160+
# allow ecs task execution role to read this app's parameters
161+
resource "aws_iam_policy" "ecsTaskExecutionRole_ssm" {
162+
name = "${var.app}-${var.environment}-ecs-ssm"
163+
path = "/"
164+
description = "allow ecs task execution role to read this app's parameters"
165+
166+
policy = <<EOF
167+
{
168+
"Version": "2012-10-17",
169+
"Statement": [
170+
{
171+
"Effect": "Allow",
172+
"Action": [
173+
"ssm:GetParameters"
174+
],
175+
"Resource": "arn:aws:ssm:${var.region}:${data.aws_caller_identity.current.account_id}:parameter/${var.app}/${var.environment}/*"
176+
}
177+
]
178+
}
179+
EOF
180+
}
181+
182+
resource "aws_iam_role_policy_attachment" "ecsTaskExecutionRole_ssm" {
183+
role = "${aws_iam_role.ecsTaskExecutionRole.name}"
184+
policy_arn = "${aws_iam_policy.ecsTaskExecutionRole_ssm.arn}"
185+
}
186+
187+
output "ssm_add_secret" {
188+
value = "aws ssm put-parameter --overwrite --type \"SecureString\" --key-id \"${aws_kms_alias.ssm.name}\" --name \"/${var.app}/${var.environment}/PASSWORD\" --value \"password\""
189+
}
190+
191+
output "ssm_add_secret_ref" {
192+
value = "fargate service env set --secret PASSWORD=/${var.app}/${var.environment}/PASSWORD"
193+
}
194+
195+
output "ssm_key_id" {
196+
value = "${aws_kms_key.ssm.key_id}"
197+
}

0 commit comments

Comments
 (0)