update for gpg key stuff

terraform-modules · Jun 17, 2022 · 50223b6 · 50223b6
1 parent 69a6f63
commit 50223b6
Show file tree

Hide file tree

Showing 5 changed files with 13 additions and 5 deletions.
diff --git a/README.md b/README.md
@@ -91,6 +91,7 @@ No requirements.
 | <a name="input_inline_policies"></a> [inline\_policies](#input\_inline\_policies) | List of IAM Policy Document objects to include in this role. Format is {name=name,policy=policy-json} | `list(object({ name = string, policy = string }))` | `[]` | no |
 | <a name="input_path"></a> [path](#input\_path) | IAM path | `string` | `"/"` | no |
 | <a name="input_pgp_key"></a> [pgp\_key](#input\_pgp\_key) | PGP key used to encrypt access key | `string` | `""` | no |
+| <a name="input_pgp_key_file"></a> [pgp\_key\_file](#input\_pgp\_key\_file) | PGP key filename for encrypting the access key (supercedes pgp\_key) | `string` | `""` | no |
 | <a name="input_profile"></a> [profile](#input\_profile) | AWS Profile Name, used generating key rotation file | `string` | `null` | no |
 | <a name="input_reference"></a> [reference](#input\_reference) | Remedy ticket reference number for the user | `string` | `""` | no |
 | <a name="input_roles"></a> [roles](#input\_roles) | Roles to which the user belongs | `list(string)` | `[]` | no |

diff --git a/access_keys.tf b/access_keys.tf
@@ -1,7 +1,7 @@
 resource "aws_iam_access_key" "iam_access_key_v1" {
   count   = var.create_access_keys ? 1 : 0
   user    = aws_iam_user.user.name
-  pgp_key = file(var.gpg_key_file)
+  pgp_key = local.pgp_key
 
   depends_on = [time_sleep.wait_iam_access_key_v1]
 }
@@ -20,7 +20,7 @@ locals {
       username     = aws_iam_user.user.name
       region       = local.environment == "ew" ? "us-east-1" : "us-gov-east-1"
       profile      = var.profile
-      pgp_key_file = var.ppg_key_file
+      pgp_key_file = fileexists(var.pgp_key_file) ? var.pgp_key_file : ""
   })
 }
 

diff --git a/main.tf b/main.tf
@@ -46,7 +46,8 @@ locals {
   username          = lower(var.username)
   iam_username      = var.iam_username != "" ? var.iam_username : "a-${local.username}"
   email_address     = var.email_address != "" ? lower(var.email_address) : module.user_email.search_result["attribute_value"][0]
-  pgp_key_exists    = var.pgp_key != "" && fileexists(var.pgp_key)
+  pgp_key_exists    = var.pgp_key != "" || fileexists(var.pgp_key_file)
+  pgp_key           = fileexists(var.pgp_key_file) ? file(var.pgp_key_file) : var.pgp_key
   generate_password = var.generate_password && local.pgp_key_exists
   user_password     = local.generate_password == 1 ? element(concat(aws_iam_user_login_profile.user[*].encrypted_password, tolist([""])), 0) : ""
   ap1               = var.service_account ? var.attached_policies : []
@@ -97,7 +98,7 @@ resource "aws_iam_user" "user" {
 resource "aws_iam_user_login_profile" "user" {
   count                   = local.generate_password ? 1 : 0
   user                    = aws_iam_user.user.name
-  pgp_key                 = local.generate_password ? var.pgp_key : null
+  pgp_key                 = local.generate_password ? local.pgp_key : null
   password_reset_required = true
 
   lifecycle {

diff --git a/templates/rotate-keys.tpl b/templates/rotate-keys.tpl
@@ -2,4 +2,4 @@ username        = "${username}"
 region          = "${region}"
 profile         = "${profile}"
 service_profile = ""
-gpg_key_file    = "../../${pgp_key_file}"
+gpg_key_file    = "%{ if pgp_key_file != ""}../../${pgp_key_file}%{ else }%{ endif }"
diff --git a/variables.tf b/variables.tf
@@ -58,6 +58,12 @@ variable "pgp_key" {
   default     = ""
 }
 
+variable "pgp_key_file" {
+  description = "PGP key filename for encrypting the access key (supercedes pgp_key)"
+  type        = string
+  default     = ""
+}
+
 # may be a sub-module by user after rotation
 variable "create_access_keys" {
   description = "Flag to create access keys"