From a2bbff99d59f468b2594bd1904267614ec50bca4 Mon Sep 17 00:00:00 2001
From: badra001 <donald.e.badrak.ii@census.gov>
Date: Wed, 27 Jul 2022 09:52:00 -0400
Subject: [PATCH] update docs

---
 README.md | 32 ++++++++++++++++++++++++++++++++
 main.tf   | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 64 insertions(+)

diff --git a/README.md b/README.md
index 9c21792..43d49e7 100644
--- a/README.md
+++ b/README.md
@@ -39,6 +39,38 @@ module "admin_user_bond0007" {
 }
 ```
 
+## Creating Access Keys
+The abiltity to create an access key has been incorporated into this module. In order to make it work, you must
+provide the `profile` and `pgp_key_file` variables.  The `pgp_key` variable is deprecated.  You must also have the private
+key for the account's GPG key in your keyring.
+
+Here are the variables you need to add:
+
+```hcl
+  profile             = var.profile
+  pgp_key_file        = "./init/tf-gpg-key.b64"
+```
+
+This creates a directory `access_keys/{username}`.  In that it creates these files
+* access\_key.yml
+* variables.auto.tfvars
+
+The `access_key.yml` file contains details about the created access key, and a decryption of that key.
+This file must **NOT** be commited to git.  A `.gitignore` file is created as part of this module under `access_keys`.
+You will need to add the `access_key.yml` to `git-secret`:
+
+```script
+# create branch
+git-secret add access_keys/{username}/*yml
+git-secret hide -m
+git add access_keys/{username} -A
+git commit -a
+git push
+# do PR
+```
+
+The `variables.auto.tfvars` is there to enable this directory to be used for key rotation with the `rotate-keys.py` script.
+
 ## Requirements
 
 No requirements.
diff --git a/main.tf b/main.tf
index 5ab1966..a33b240 100644
--- a/main.tf
+++ b/main.tf
@@ -39,6 +39,38 @@
 *   # inline_policies    = [ { name = "my-policy", policy = data.aws_iam_policy_document.my-policy.json } ]
 * }
 * ```
+* 
+* ## Creating Access Keys
+* The abiltity to create an access key has been incorporated into this module. In order to make it work, you must
+* provide the `profile` and `pgp_key_file` variables.  The `pgp_key` variable is deprecated.  You must also have the private
+* key for the account's GPG key in your keyring.
+*
+* Here are the variables you need to add:
+*
+* ```hcl
+*   profile             = var.profile
+*   pgp_key_file        = "./init/tf-gpg-key.b64"
+* ```
+* 
+* This creates a directory `access_keys/{username}`.  In that it creates these files
+* * access_key.yml
+* * variables.auto.tfvars
+*
+* The `access_key.yml` file contains details about the created access key, and a decryption of that key.
+* This file must **NOT** be commited to git.  A `.gitignore` file is created as part of this module under `access_keys`.
+* You will need to add the `access_key.yml` to `git-secret`:
+*
+* ```script
+* # create branch
+* git-secret add access_keys/{username}/*yml
+* git-secret hide -m
+* git add access_keys/{username} -A
+* git commit -a
+* git push 
+* # do PR
+* ```
+*
+* The `variables.auto.tfvars` is there to enable this directory to be used for key rotation with the `rotate-keys.py` script.
 */
 
 locals {