From 73577a9437f53ce0f7d3025d5c530b10ee98c709 Mon Sep 17 00:00:00 2001
From: badra001 <donald.e.badrak.ii@census.gov>
Date: Wed, 22 Nov 2023 19:47:58 -0500
Subject: [PATCH] 3.0.0: tf-upgrade brach, enable secret if pgp_file is missing

---
 CHANGELOG.md             |  5 +++++
 README.md                |  2 +-
 access_keys.tf           | 10 +++++-----
 outputs.access_keys.tf   |  7 ++++---
 templates/access_key.tpl |  1 +
 version.tf               |  2 +-
 6 files changed, 17 insertions(+), 10 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a5ff92a..a6acc9c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -70,3 +70,8 @@
 
 * 2.8.3 -- 2022-09-14
   - fix access key variables and usage
+
+## Version 3.x
+
+* 3.0.0 -- 2023-11-22 tf-upgrade
+  - if pgp_key_file is not provided (empty), it will use the secret vs encrypted secret, so that the secret can be used as input into other resources
diff --git a/README.md b/README.md
index 61b1ce3..4cd6901 100644
--- a/README.md
+++ b/README.md
@@ -153,7 +153,7 @@ No requirements.
 | Name | Description |
 |------|-------------|
 | <a name="output_aws_access_key_id"></a> [aws\_access\_key\_id](#output\_aws\_access\_key\_id) | AWS Access Key (current) |
-| <a name="output_aws_secret_access_key"></a> [aws\_secret\_access\_key](#output\_aws\_secret\_access\_key) | AWS Secret Access Key [encrypted] (current) |
+| <a name="output_aws_secret_access_key"></a> [aws\_secret\_access\_key](#output\_aws\_secret\_access\_key) | AWS Secret Access Key, either encrypted (if using PGP key) or clear |
 | <a name="output_user_arn"></a> [user\_arn](#output\_user\_arn) | User ARN |
 | <a name="output_user_name"></a> [user\_name](#output\_user\_name) | User name |
 | <a name="output_user_password"></a> [user\_password](#output\_user\_password) | User Password |
diff --git a/access_keys.tf b/access_keys.tf
index 3107191..dfbcf69 100644
--- a/access_keys.tf
+++ b/access_keys.tf
@@ -31,10 +31,10 @@ locals {
       username         = aws_iam_user.user.name
       profile          = local.profile
       account_id       = local.account_id
-      create_date      = var.create_access_keys ? lookup(aws_iam_access_key.iam_access_key_v1[0], "create_date", "") : ""
-      access_key_id    = var.create_access_keys ? lookup(aws_iam_access_key.iam_access_key_v1[0], "id", "") : ""
-      encrypted_secret = var.create_access_keys ? lookup(aws_iam_access_key.iam_access_key_v1[0], "encrypted_secret", "") : ""
-      secret           = var.create_access_keys ? lookup(aws_iam_access_key.iam_access_key_v1[0], "secret", "") : ""
+      create_date      = var.create_access_keys && try(aws_iam_access_key.iam_access_key_v1[0].create_date != null) ? aws_iam_access_key.iam_access_key_v1[0].create_date : ""
+      access_key_id    = var.create_access_keys && try(aws_iam_access_key.iam_access_key_v1[0].id != null) ? aws_iam_access_key.iam_access_key_v1[0].id : ""
+      encrypted_secret = var.create_access_keys && try(aws_iam_access_key.iam_access_key_v1[0].encrypted_secret != null) ? aws_iam_access_key.iam_access_key_v1[0].encrypted_secret : ""
+      secret           = var.create_access_keys && try(nonsensitive(aws_iam_access_key.iam_access_key_v1[0].secret) != null) ? aws_iam_access_key.iam_access_key_v1[0].secret : ""
   })
 }
 
@@ -85,7 +85,7 @@ resource "local_sensitive_file" "access_key_file" {
 }
 
 resource "null_resource" "access_key_file_decrypt_key" {
-  count = var.create_access_keys ? 1 : 0
+  count = var.create_access_keys && var.pgp_key_file != "" ? 1 : 0
   triggers = {
     access_keys_directory = var.create_access_keys ? format("%v/%v", path.root, join("", null_resource.rotate_keys_tfvars.*.triggers.access_keys_directory)) : "."
     access_key_file       = var.create_access_keys ? join("", local_sensitive_file.access_key_file.*.filename) : "empty.txt"
diff --git a/outputs.access_keys.tf b/outputs.access_keys.tf
index 602648b..bc7fa51 100644
--- a/outputs.access_keys.tf
+++ b/outputs.access_keys.tf
@@ -14,7 +14,8 @@ output "aws_access_key_id" {
 }
 
 output "aws_secret_access_key" {
-  description = "AWS Secret Access Key [encrypted] (current)"
-  value       = var.create_access_keys ? lookup(aws_iam_access_key.iam_access_key_v1[0], "encrypted_secret", "") : ""
+  description = "AWS Secret Access Key, either encrypted (if using PGP key) or clear"
+  #  value       = var.create_access_keys ? try(lookup(aws_iam_access_key.iam_access_key_v1[0], "encrypted_secret"),nonsensitive(lookup(aws_iam_access_key.iam_access_key_v1[0], "secret"))) : ""
+  #  value       = var.create_access_keys ? try(aws_iam_access_key.iam_access_key_v1[0].encrypted_secret,nonsensitive(aws_iam_access_key.iam_access_key_v1[0].secret)) : ""
+  value = var.create_access_keys && try(aws_iam_access_key.iam_access_key_v1[0].encrypted_secret != null) ? aws_iam_access_key.iam_access_key_v1[0].encrypted_secret : nonsensitive(aws_iam_access_key.iam_access_key_v1[0].secret)
 }
-
diff --git a/templates/access_key.tpl b/templates/access_key.tpl
index c5484a0..b4432d6 100644
--- a/templates/access_key.tpl
+++ b/templates/access_key.tpl
@@ -4,3 +4,4 @@ create_date: ${create_date}
 username: ${username}
 access_key_id: ${access_key_id}
 access_secret_key_encrypted: ${encrypted_secret}
+access_secret_key: ${secret}
diff --git a/version.tf b/version.tf
index c6b1ea7..964202d 100644
--- a/version.tf
+++ b/version.tf
@@ -1,4 +1,4 @@
 locals {
   _module_name    = "aws-iam-user"
-  _module_version = "2.8.3"
+  _module_version = "3.0.0"
 }