From a7a208846d79b8d72b838b0dc54da301914b315f Mon Sep 17 00:00:00 2001 From: badra001 Date: Wed, 22 Nov 2023 19:57:33 -0500 Subject: [PATCH] 2.8.4: enable secret if pgp_file is missing --- CHANGELOG.md | 3 +++ README.md | 14 +++++++++++++- access_keys.tf | 10 +++++----- main.tf | 12 ++++++++++++ outputs.access_keys.tf | 6 +++--- templates/access_key.tpl | 1 + version.tf | 2 +- 7 files changed, 38 insertions(+), 10 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a5ff92a..dba07c7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -70,3 +70,6 @@ * 2.8.3 -- 2022-09-14 - fix access key variables and usage + +* 2.8.4 -- 2023-11-22 + - if pgp_key_file is not provided (empty), it will use the secret vs encrypted secret, so that the secret can be used as input into other resources diff --git a/README.md b/README.md index beea888..4cd6901 100644 --- a/README.md +++ b/README.md @@ -71,6 +71,18 @@ git push The `variables.auto.tfvars` is there to enable this directory to be used for key rotation with the `rotate-keys.py` script. +## Changes when running plan or apply +You may see a `tf-plan` and a `tf-apply` inform you of changes to two different resources in a directory where you have used +this access key enablement: + +* module.NAME.local\_sensitive\_file.access\_key\_file[0] +* module.NAME.null\_resource.access\_key\_file\_decrypt\_key[0] + +This is because these resources are populated from `data` sources with a `templatefile()`. As such, it does not know +the output of the template until run time, so it re-generates that data. If there are no changes to the key, it will simple +create these files with the same content as before. This is not harmful, but it is important to understand when you see changes +in a plan you know you didn't make. + ## Requirements No requirements. @@ -141,7 +153,7 @@ No requirements. | Name | Description | |------|-------------| | [aws\_access\_key\_id](#output\_aws\_access\_key\_id) | AWS Access Key (current) | -| [aws\_secret\_access\_key](#output\_aws\_secret\_access\_key) | AWS Secret Access Key [encrypted] (current) | +| [aws\_secret\_access\_key](#output\_aws\_secret\_access\_key) | AWS Secret Access Key, either encrypted (if using PGP key) or clear | | [user\_arn](#output\_user\_arn) | User ARN | | [user\_name](#output\_user\_name) | User name | | [user\_password](#output\_user\_password) | User Password | diff --git a/access_keys.tf b/access_keys.tf index 3107191..b4179d0 100644 --- a/access_keys.tf +++ b/access_keys.tf @@ -31,10 +31,10 @@ locals { username = aws_iam_user.user.name profile = local.profile account_id = local.account_id - create_date = var.create_access_keys ? lookup(aws_iam_access_key.iam_access_key_v1[0], "create_date", "") : "" - access_key_id = var.create_access_keys ? lookup(aws_iam_access_key.iam_access_key_v1[0], "id", "") : "" - encrypted_secret = var.create_access_keys ? lookup(aws_iam_access_key.iam_access_key_v1[0], "encrypted_secret", "") : "" - secret = var.create_access_keys ? lookup(aws_iam_access_key.iam_access_key_v1[0], "secret", "") : "" + create_date = var.create_access_keys && try(aws_iam_access_key.iam_access_key_v1[0].create_date != null) ? aws_iam_access_key.iam_access_key_v1[0].create_date : "" + access_key_id = var.create_access_keys && try(aws_iam_access_key.iam_access_key_v1[0].id != null) ? aws_iam_access_key.iam_access_key_v1[0].id : "" + encrypted_secret = var.create_access_keys && try(aws_iam_access_key.iam_access_key_v1[0].encrypted_secret != null) ? aws_iam_access_key.iam_access_key_v1[0].encrypted_secret : "" + secret = var.create_access_keys && try(aws_iam_access_key.iam_access_key_v1[0].secret != null) ? aws_iam_access_key.iam_access_key_v1[0].secret : "" }) } @@ -85,7 +85,7 @@ resource "local_sensitive_file" "access_key_file" { } resource "null_resource" "access_key_file_decrypt_key" { - count = var.create_access_keys ? 1 : 0 + count = var.create_access_keys && var.pgp_key_file != "" ? 1 : 0 triggers = { access_keys_directory = var.create_access_keys ? format("%v/%v", path.root, join("", null_resource.rotate_keys_tfvars.*.triggers.access_keys_directory)) : "." access_key_file = var.create_access_keys ? join("", local_sensitive_file.access_key_file.*.filename) : "empty.txt" diff --git a/main.tf b/main.tf index b306ac5..1a5ea6f 100644 --- a/main.tf +++ b/main.tf @@ -71,6 +71,18 @@ * ``` * * The `variables.auto.tfvars` is there to enable this directory to be used for key rotation with the `rotate-keys.py` script. +* +* ## Changes when running plan or apply +* You may see a `tf-plan` and a `tf-apply` inform you of changes to two different resources in a directory where you have used +* this access key enablement: +* +* * module.NAME.local_sensitive_file.access_key_file[0] +* * module.NAME.null_resource.access_key_file_decrypt_key[0] +* +* This is because these resources are populated from `data` sources with a `templatefile()`. As such, it does not know +* the output of the template until run time, so it re-generates that data. If there are no changes to the key, it will simple +* create these files with the same content as before. This is not harmful, but it is important to understand when you see changes +* in a plan you know you didn't make. */ locals { diff --git a/outputs.access_keys.tf b/outputs.access_keys.tf index 602648b..fcd4f8e 100644 --- a/outputs.access_keys.tf +++ b/outputs.access_keys.tf @@ -14,7 +14,7 @@ output "aws_access_key_id" { } output "aws_secret_access_key" { - description = "AWS Secret Access Key [encrypted] (current)" - value = var.create_access_keys ? lookup(aws_iam_access_key.iam_access_key_v1[0], "encrypted_secret", "") : "" + description = "AWS Secret Access Key, either encrypted (if using PGP key) or clear" + # value = var.create_access_keys ? lookup(aws_iam_access_key.iam_access_key_v1[0], "encrypted_secret", "") : "" + value = var.create_access_keys && try(aws_iam_access_key.iam_access_key_v1[0].encrypted_secret != null) ? aws_iam_access_key.iam_access_key_v1[0].encrypted_secret : aws_iam_access_key.iam_access_key_v1[0].secret } - diff --git a/templates/access_key.tpl b/templates/access_key.tpl index c5484a0..b4432d6 100644 --- a/templates/access_key.tpl +++ b/templates/access_key.tpl @@ -4,3 +4,4 @@ create_date: ${create_date} username: ${username} access_key_id: ${access_key_id} access_secret_key_encrypted: ${encrypted_secret} +access_secret_key: ${secret} diff --git a/version.tf b/version.tf index c6b1ea7..1a3865e 100644 --- a/version.tf +++ b/version.tf @@ -1,4 +1,4 @@ locals { _module_name = "aws-iam-user" - _module_version = "2.8.3" + _module_version = "2.8.4" }