-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #4 from terraform-modules/feature-access-keys
add creation of access keys
- Loading branch information
Showing
13 changed files
with
257 additions
and
39 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,35 +1,47 @@ | ||
| # Versions | ||
|
|
||
| * v1.0.0 | ||
| ## Version 1.x | ||
|
|
||
| * 1.0.0 | ||
| - tag initial release for tf 0.11 | ||
|
|
||
| * v2.0.0 | ||
| ## Version 2.x | ||
|
|
||
| * 2.0.0 | ||
| - for tf-0.12 support | ||
|
|
||
| * v2.0.1 | ||
| * 2.0.1 | ||
| - add create_access_key variable, but do not implement | ||
| - format | ||
| - change saml_role to list | ||
|
|
||
| * v2.0.2 | ||
| * 2.0.2 | ||
| - do not include groups if groups empty | ||
| - add ```service_account``` variable (true|false) | ||
| - if service account, use contact vs user | ||
|
|
||
| * v2.1 | ||
| * 2.1 | ||
| - add pre-commit to generate docs | ||
|
|
||
| * v2.2 | ||
| * 2.2 | ||
| - add enable_sending_mail to enable email address in SES (this generates a request to the user) | ||
|
|
||
| * v2.3 | ||
| * 2.3 | ||
| - change default for enable_sending_mail to false | ||
|
|
||
| * v2.4.0 -- 20210405 | ||
| * 2.4.0 -- 20210405 | ||
| - use `ldap-get-attribute` to get email address | ||
|
|
||
| * v2.5.0 -- 20210512 | ||
| * 2.5.0 -- 20210512 | ||
| - add `attached_policies` to enable adding policies for an IAM account (generally, just services) | ||
|
|
||
| * v2.5.1 -- 20210526 | ||
| * 2.5.1 -- 20210526 | ||
| - change computing of output of user_password | ||
|
|
||
| * 2.6.0 -- 2022-05-20 | ||
| - update bin/show-user-info.sh to accept TFCOMMAND for an alternate terraform binary, or to pull from the git root file | ||
|
|
||
| * 2.7.0 -- 2022-06-17 | ||
| - add inline_policies | ||
| - add path | ||
| - enable code for creating access keys |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,75 @@ | ||
| resource "aws_iam_access_key" "iam_access_key_v1" { | ||
| count = var.create_access_keys ? 1 : 0 | ||
| user = aws_iam_user.user.name | ||
| pgp_key = local.pgp_key | ||
|
|
||
| depends_on = [time_sleep.wait_iam_access_key_v1] | ||
| } | ||
|
|
||
| # this gives a prior key time to be removed. When doing just one key like | ||
| # here, this may not be necessary | ||
| resource "time_sleep" "wait_iam_access_key_v1" { | ||
| count = var.create_access_keys ? 1 : 0 | ||
|
|
||
| create_duration = "60s" | ||
| } | ||
|
|
||
| locals { | ||
| rotate_keys_tfvars = templatefile("${path.module}/templates/rotate-keys.tpl", | ||
| { | ||
| username = aws_iam_user.user.name | ||
| region = local.account_environment == "ew" ? "us-east-1" : "us-gov-east-1" | ||
| profile = var.profile == null ? "" : var.profile | ||
| pgp_key_file = fileexists(var.pgp_key_file) ? var.pgp_key_file : "" | ||
| }) | ||
| access_key_file = templatefile("${path.module}/templates/access_key.tpl", | ||
| { | ||
| username = aws_iam_user.user.name | ||
| profile = var.profile == null ? "" : var.profile | ||
| account_id = local.account_id | ||
| create_date = var.create_access_keys ? aws_iam_access_key.iam_access_key_v1[0].create_date : "" | ||
| access_key_id = var.create_access_keys ? aws_iam_access_key.iam_access_key_v1[0].id : "" | ||
| encrypted_secret = var.create_access_keys ? aws_iam_access_key.iam_access_key_v1[0].encrypted_secret : "" | ||
| }) | ||
| } | ||
|
|
||
| resource "null_resource" "rotate_keys_tfvars" { | ||
| count = var.create_access_keys ? 1 : 0 | ||
| triggers = { | ||
| username = aws_iam_user.user.name | ||
| access_keys_directory = format("access_keys/%v", aws_iam_user.user.name) | ||
| } | ||
|
|
||
| provisioner "local-exec" { | ||
| when = create | ||
| command = "test -d ${path.root}/${self.triggers.access_keys_directory} || mkdir -p ${path.root}/${self.triggers.access_keys_directory}" | ||
| } | ||
|
|
||
| provisioner "local-exec" { | ||
| when = create | ||
| working_dir = self.triggers.access_keys_directory | ||
| command = "echo access_key.yml > .gitignore" | ||
| } | ||
|
|
||
| # provisioner "local-exec" { | ||
| # when = create | ||
| # working_dir = self.triggers.access_keys_directory | ||
| # command = "ln -sf ../../${var.ppg_key_file} ." | ||
| # } | ||
| } | ||
|
|
||
| resource "local_file" "rotate_keys_tfvars" { | ||
| count = var.create_access_keys ? 1 : 0 | ||
| content = local.rotate_keys_tfvars | ||
| filename = var.create_access_keys ? format("%v/%v/variables.auto.tfvars", path.root, null_resource.rotate_keys_tfvars[0].triggers.access_keys_directory) : "empty.txt" | ||
|
|
||
| depends_on = [null_resource.rotate_keys_tfvars] | ||
| } | ||
|
|
||
| resource "local_file" "access_key_file" { | ||
| count = var.create_access_keys ? 1 : 0 | ||
| content = local.access_key_file | ||
| filename = var.create_access_keys ? format("%v/%v/access_key.yml", path.root, null_resource.rotate_keys_tfvars[0].triggers.access_keys_directory) : "empty.txt" | ||
|
|
||
| depends_on = [null_resource.rotate_keys_tfvars] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| locals { | ||
| base_tags = { | ||
| "boc:tf_module_version" = local._module_version | ||
| "boc:tf_module_name" = local._module_name | ||
| "boc:created_by" = "terraform" | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| locals { | ||
| # account_id = var.account_id != "" ? var.account_id : data.aws_caller_identity.current.account_id | ||
| account_id = data.aws_caller_identity.current.account_id | ||
| account_environment = data.aws_arn.current.partition == "aws-us-gov" ? "gov" : "ew" | ||
| region = data.aws_region.current.name | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| ## output "aws_access_key_id_prev" { | ||
| ## description = "AWS Access Key (previous)" | ||
| ## value = "" | ||
| ## } | ||
| ## | ||
| ## output "aws_secret_access_key_prev" { | ||
| ## description = "AWS Secret Access Key [encrypted] (previous)" | ||
| ## value = "" | ||
| ## } | ||
|
|
||
| output "aws_access_key_id" { | ||
| description = "AWS Access Key (current)" | ||
| value = var.create_access_keys ? aws_iam_access_key.iam_access_key_v1[0].id : "" | ||
| } | ||
|
|
||
| output "aws_secret_access_key" { | ||
| description = "AWS Secret Access Key [encrypted] (current)" | ||
| value = var.create_access_keys ? aws_iam_access_key.iam_access_key_v1[0].encrypted_secret : "" | ||
| } | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| account: ${account_id} | ||
| profile: ${profile} | ||
| create_date: ${create_date} | ||
| username: ${username} | ||
| access_key_id: ${access_key_id} | ||
| access_secret_key_encrypted: ${encrypted_secret} | ||
| access_secret_key_encrypted: |
Oops, something went wrong.