2.8.4: enable secret if pgp_file is missing

CHANGELOG.md

@@ -70,3 +70,6 @@
 
 * 2.8.3 -- 2022-09-14
   - fix access key variables and usage
+
+* 2.8.4 -- 2023-11-22
+  - if pgp_key_file is not provided (empty), it will use the secret vs encrypted secret, so that the secret can be used as input into other resources

README.md

@@ -71,6 +71,18 @@ git push
 
 The `variables.auto.tfvars` is there to enable this directory to be used for key rotation with the `rotate-keys.py` script.
 
+## Changes when running plan or apply
+You may see a `tf-plan` and a `tf-apply` inform you of changes to two different resources in a directory where you have used
+this access key enablement:
+
+*   module.NAME.local\_sensitive\_file.access\_key\_file[0]
+*   module.NAME.null\_resource.access\_key\_file\_decrypt\_key[0]
+
+This is because these resources are populated from `data` sources with a `templatefile()`.  As such, it does not know
+the output of the template until run time, so it re-generates that data.  If there are no changes to the key, it will simple
+create these files with the same content as before. This is not harmful, but it is important to understand when you see changes
+in a plan you know you didn't make.
+
 ## Requirements
 
 No requirements.
@@ -141,7 +153,7 @@ No requirements.
 | Name | Description |
 |------|-------------|
 | <a name="output_aws_access_key_id"></a> [aws\_access\_key\_id](#output\_aws\_access\_key\_id) | AWS Access Key (current) |
-| <a name="output_aws_secret_access_key"></a> [aws\_secret\_access\_key](#output\_aws\_secret\_access\_key) | AWS Secret Access Key [encrypted] (current) |
+| <a name="output_aws_secret_access_key"></a> [aws\_secret\_access\_key](#output\_aws\_secret\_access\_key) | AWS Secret Access Key, either encrypted (if using PGP key) or clear |
 | <a name="output_user_arn"></a> [user\_arn](#output\_user\_arn) | User ARN |
 | <a name="output_user_name"></a> [user\_name](#output\_user\_name) | User name |
 | <a name="output_user_password"></a> [user\_password](#output\_user\_password) | User Password |

access_keys.tf

@@ -31,10 +31,10 @@ locals {
       username         = aws_iam_user.user.name
       profile          = local.profile
       account_id       = local.account_id
-      create_date      = var.create_access_keys ? lookup(aws_iam_access_key.iam_access_key_v1[0], "create_date", "") : ""
-      access_key_id    = var.create_access_keys ? lookup(aws_iam_access_key.iam_access_key_v1[0], "id", "") : ""
-      encrypted_secret = var.create_access_keys ? lookup(aws_iam_access_key.iam_access_key_v1[0], "encrypted_secret", "") : ""
-      secret           = var.create_access_keys ? lookup(aws_iam_access_key.iam_access_key_v1[0], "secret", "") : ""
+      create_date      = var.create_access_keys && try(aws_iam_access_key.iam_access_key_v1[0].create_date != null) ? aws_iam_access_key.iam_access_key_v1[0].create_date : ""
+      access_key_id    = var.create_access_keys && try(aws_iam_access_key.iam_access_key_v1[0].id != null) ? aws_iam_access_key.iam_access_key_v1[0].id : ""
+      encrypted_secret = var.create_access_keys && try(aws_iam_access_key.iam_access_key_v1[0].encrypted_secret != null) ? aws_iam_access_key.iam_access_key_v1[0].encrypted_secret : ""
+      secret           = var.create_access_keys && try(aws_iam_access_key.iam_access_key_v1[0].secret != null) ? aws_iam_access_key.iam_access_key_v1[0].secret : ""
   })
 }
 
@@ -85,7 +85,7 @@ resource "local_sensitive_file" "access_key_file" {
 }
 
 resource "null_resource" "access_key_file_decrypt_key" {
-  count = var.create_access_keys ? 1 : 0
+  count = var.create_access_keys && var.pgp_key_file != "" ? 1 : 0
   triggers = {
     access_keys_directory = var.create_access_keys ? format("%v/%v", path.root, join("", null_resource.rotate_keys_tfvars.*.triggers.access_keys_directory)) : "."
     access_key_file       = var.create_access_keys ? join("", local_sensitive_file.access_key_file.*.filename) : "empty.txt"

main.tf

@@ -71,6 +71,18 @@
 * ```
 *
 * The `variables.auto.tfvars` is there to enable this directory to be used for key rotation with the `rotate-keys.py` script.
+*
+* ## Changes when running plan or apply
+* You may see a `tf-plan` and a `tf-apply` inform you of changes to two different resources in a directory where you have used
+* this access key enablement:
+*
+* *   module.NAME.local_sensitive_file.access_key_file[0]
+* *   module.NAME.null_resource.access_key_file_decrypt_key[0]
+*
+* This is because these resources are populated from `data` sources with a `templatefile()`.  As such, it does not know
+* the output of the template until run time, so it re-generates that data.  If there are no changes to the key, it will simple
+* create these files with the same content as before. This is not harmful, but it is important to understand when you see changes
+* in a plan you know you didn't make.
 */
 
 locals {

outputs.access_keys.tf

@@ -14,7 +14,7 @@ output "aws_access_key_id" {
 }
 
 output "aws_secret_access_key" {
-  description = "AWS Secret Access Key [encrypted] (current)"
-  value       = var.create_access_keys ? lookup(aws_iam_access_key.iam_access_key_v1[0], "encrypted_secret", "") : ""
+  description = "AWS Secret Access Key, either encrypted (if using PGP key) or clear"
+  #  value       = var.create_access_keys ? lookup(aws_iam_access_key.iam_access_key_v1[0], "encrypted_secret", "") : ""
+  value = var.create_access_keys && try(aws_iam_access_key.iam_access_key_v1[0].encrypted_secret != null) ? aws_iam_access_key.iam_access_key_v1[0].encrypted_secret : aws_iam_access_key.iam_access_key_v1[0].secret
 }
-

templates/access_key.tpl

@@ -4,3 +4,4 @@ create_date: ${create_date}
 username: ${username}
 access_key_id: ${access_key_id}
 access_secret_key_encrypted: ${encrypted_secret}
+access_secret_key: ${secret}

version.tf

@@ -1,4 +1,4 @@
 locals {
   _module_name    = "aws-iam-user"
-  _module_version = "2.8.3"
+  _module_version = "2.8.4"
 }