From 50223b641e9fc973a5fb1d4ce7032ef1ac8a01a0 Mon Sep 17 00:00:00 2001
From: badra001 <donald.e.badrak.ii@census.gov>
Date: Fri, 17 Jun 2022 08:13:26 -0400
Subject: [PATCH] update for gpg key stuff

---
 README.md                 | 1 +
 access_keys.tf            | 4 ++--
 main.tf                   | 5 +++--
 templates/rotate-keys.tpl | 2 +-
 variables.tf              | 6 ++++++
 5 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 0d24c7a..2c7e27c 100644
--- a/README.md
+++ b/README.md
@@ -91,6 +91,7 @@ No requirements.
 | <a name="input_inline_policies"></a> [inline\_policies](#input\_inline\_policies) | List of IAM Policy Document objects to include in this role. Format is {name=name,policy=policy-json} | `list(object({ name = string, policy = string }))` | `[]` | no |
 | <a name="input_path"></a> [path](#input\_path) | IAM path | `string` | `"/"` | no |
 | <a name="input_pgp_key"></a> [pgp\_key](#input\_pgp\_key) | PGP key used to encrypt access key | `string` | `""` | no |
+| <a name="input_pgp_key_file"></a> [pgp\_key\_file](#input\_pgp\_key\_file) | PGP key filename for encrypting the access key (supercedes pgp\_key) | `string` | `""` | no |
 | <a name="input_profile"></a> [profile](#input\_profile) | AWS Profile Name, used generating key rotation file | `string` | `null` | no |
 | <a name="input_reference"></a> [reference](#input\_reference) | Remedy ticket reference number for the user | `string` | `""` | no |
 | <a name="input_roles"></a> [roles](#input\_roles) | Roles to which the user belongs | `list(string)` | `[]` | no |
diff --git a/access_keys.tf b/access_keys.tf
index 54a0aa4..ca07e3e 100644
--- a/access_keys.tf
+++ b/access_keys.tf
@@ -1,7 +1,7 @@
 resource "aws_iam_access_key" "iam_access_key_v1" {
   count   = var.create_access_keys ? 1 : 0
   user    = aws_iam_user.user.name
-  pgp_key = file(var.gpg_key_file)
+  pgp_key = local.pgp_key
 
   depends_on = [time_sleep.wait_iam_access_key_v1]
 }
@@ -20,7 +20,7 @@ locals {
       username     = aws_iam_user.user.name
       region       = local.environment == "ew" ? "us-east-1" : "us-gov-east-1"
       profile      = var.profile
-      pgp_key_file = var.ppg_key_file
+      pgp_key_file = fileexists(var.pgp_key_file) ? var.pgp_key_file : ""
   })
 }
 
diff --git a/main.tf b/main.tf
index 6f9d953..57f16ba 100644
--- a/main.tf
+++ b/main.tf
@@ -46,7 +46,8 @@ locals {
   username          = lower(var.username)
   iam_username      = var.iam_username != "" ? var.iam_username : "a-${local.username}"
   email_address     = var.email_address != "" ? lower(var.email_address) : module.user_email.search_result["attribute_value"][0]
-  pgp_key_exists    = var.pgp_key != "" && fileexists(var.pgp_key)
+  pgp_key_exists    = var.pgp_key != "" || fileexists(var.pgp_key_file)
+  pgp_key           = fileexists(var.pgp_key_file) ? file(var.pgp_key_file) : var.pgp_key
   generate_password = var.generate_password && local.pgp_key_exists
   user_password     = local.generate_password == 1 ? element(concat(aws_iam_user_login_profile.user[*].encrypted_password, tolist([""])), 0) : ""
   ap1               = var.service_account ? var.attached_policies : []
@@ -97,7 +98,7 @@ resource "aws_iam_user" "user" {
 resource "aws_iam_user_login_profile" "user" {
   count                   = local.generate_password ? 1 : 0
   user                    = aws_iam_user.user.name
-  pgp_key                 = local.generate_password ? var.pgp_key : null
+  pgp_key                 = local.generate_password ? local.pgp_key : null
   password_reset_required = true
 
   lifecycle {
diff --git a/templates/rotate-keys.tpl b/templates/rotate-keys.tpl
index a5807c3..7e456a2 100644
--- a/templates/rotate-keys.tpl
+++ b/templates/rotate-keys.tpl
@@ -2,4 +2,4 @@ username        = "${username}"
 region          = "${region}"
 profile         = "${profile}"
 service_profile = ""
-gpg_key_file    = "../../${pgp_key_file}"
+gpg_key_file    = "%{ if pgp_key_file != ""}../../${pgp_key_file}%{ else }%{ endif }"
diff --git a/variables.tf b/variables.tf
index 79a6b15..b5fbbda 100644
--- a/variables.tf
+++ b/variables.tf
@@ -58,6 +58,12 @@ variable "pgp_key" {
   default     = ""
 }
 
+variable "pgp_key_file" {
+  description = "PGP key filename for encrypting the access key (supercedes pgp_key)"
+  type        = string
+  default     = ""
+}
+
 # may be a sub-module by user after rotation
 variable "create_access_keys" {
   description = "Flag to create access keys"