From a35a308c1bb14fe57f369c405f85a78c799dc46a Mon Sep 17 00:00:00 2001 From: Haidar <33404432+haidargit@users.noreply.github.com> Date: Thu, 27 Jul 2023 23:54:11 +0700 Subject: [PATCH] feat(aws-key-pair): enable the ssm parameter store to record the key-pair distribution (#77) Co-authored-by: Matt Gowie Co-authored-by: Matt Gowie --- README.md | 7 +++---- docs/terraform.md | 3 +++ main.tf | 10 +++++++++- variables.tf | 12 ++++++++++++ 4 files changed, 27 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 2536797..702b439 100644 --- a/README.md +++ b/README.md @@ -88,10 +88,6 @@ We highly recommend that in your code you pin the version to the exact version y using so that your infrastructure remains stable, and update versions in a systematic way so that they do not catch you by surprise. -Also, because of a bug in the Terraform registry ([hashicorp/terraform#21417](https://github.com/hashicorp/terraform/issues/21417)), -the registry shows many of our inputs as required when in fact they are optional. -The table below correctly indicates which inputs are required. - ```hcl module "ssh_key_pair" { @@ -156,6 +152,7 @@ Available targets: |------|------| | [aws_key_pair.generated](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/key_pair) | resource | | [aws_key_pair.imported](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/key_pair) | resource | +| [aws_ssm_parameter.private_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource | | [local_file.public_key_openssh](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file) | resource | | [local_sensitive_file.private_key_pem](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/sensitive_file) | resource | | [tls_private_key.default](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/private_key) | resource | @@ -185,6 +182,8 @@ Available targets: | [ssh\_key\_algorithm](#input\_ssh\_key\_algorithm) | SSH key algorithm | `string` | `"RSA"` | no | | [ssh\_public\_key\_file](#input\_ssh\_public\_key\_file) | Name of existing SSH public key file (e.g. `id_rsa.pub`) | `string` | `null` | no | | [ssh\_public\_key\_path](#input\_ssh\_public\_key\_path) | Path to SSH public key directory (e.g. `/secrets`) | `string` | n/a | yes | +| [ssm\_parameter\_enabled](#input\_ssm\_parameter\_enabled) | Whether an SSM parameter store value is created to store the key's private key pem. | `bool` | `false` | no | +| [ssm\_parameter\_path\_prefix](#input\_ssm\_parameter\_path\_prefix) | The path prefix for the created SSM parameter e.g. '/ec2/key-pairs/acme-ue1-dev-bastion'. `ssm_parameter_enabled` must be set to `true` for this to take affect. | `string` | `"/ec2/key-pairs/"` | no | | [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no | | [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no | | [tenant](#input\_tenant) | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no | diff --git a/docs/terraform.md b/docs/terraform.md index c702e31..9fa3fe6 100644 --- a/docs/terraform.md +++ b/docs/terraform.md @@ -29,6 +29,7 @@ |------|------| | [aws_key_pair.generated](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/key_pair) | resource | | [aws_key_pair.imported](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/key_pair) | resource | +| [aws_ssm_parameter.private_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource | | [local_file.public_key_openssh](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file) | resource | | [local_sensitive_file.private_key_pem](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/sensitive_file) | resource | | [tls_private_key.default](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/private_key) | resource | @@ -58,6 +59,8 @@ | [ssh\_key\_algorithm](#input\_ssh\_key\_algorithm) | SSH key algorithm | `string` | `"RSA"` | no | | [ssh\_public\_key\_file](#input\_ssh\_public\_key\_file) | Name of existing SSH public key file (e.g. `id_rsa.pub`) | `string` | `null` | no | | [ssh\_public\_key\_path](#input\_ssh\_public\_key\_path) | Path to SSH public key directory (e.g. `/secrets`) | `string` | n/a | yes | +| [ssm\_parameter\_enabled](#input\_ssm\_parameter\_enabled) | Whether an SSM parameter store value is created to store the key's private key pem. | `bool` | `false` | no | +| [ssm\_parameter\_path\_prefix](#input\_ssm\_parameter\_path\_prefix) | The path prefix for the created SSM parameter e.g. '/ec2/key-pairs/acme-ue1-dev-bastion'. `ssm_parameter_enabled` must be set to `true` for this to take affect. | `string` | `"/ec2/key-pairs/"` | no | | [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no | | [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no | | [tenant](#input\_tenant) | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no | diff --git a/main.tf b/main.tf index 2d77b6c..2fc4aa6 100644 --- a/main.tf +++ b/main.tf @@ -47,4 +47,12 @@ resource "local_sensitive_file" "private_key_pem" { content = tls_private_key.default[0].private_key_pem filename = local.private_key_filename file_permission = "0600" -} \ No newline at end of file +} + +resource "aws_ssm_parameter" "private_key" { + count = local.enabled && var.generate_ssh_key && var.ssm_parameter_enabled == true ? 1 : 0 + name = format("%s%s", var.ssm_parameter_path_prefix, module.this.id) + type = "SecureString" + value = tls_private_key.default[0].private_key_pem + tags = module.this.tags +} diff --git a/variables.tf b/variables.tf index 2803638..4fa2416 100644 --- a/variables.tf +++ b/variables.tf @@ -32,3 +32,15 @@ variable "public_key_extension" { default = ".pub" description = "Public key extension" } + +variable "ssm_parameter_enabled" { + type = bool + default = false + description = "Whether an SSM parameter store value is created to store the key's private key pem." +} + +variable "ssm_parameter_path_prefix" { + type = string + default = "/ec2/key-pairs/" + description = "The path prefix for the created SSM parameter e.g. '/ec2/key-pairs/acme-ue1-dev-bastion'. `ssm_parameter_enabled` must be set to `true` for this to take affect." +} \ No newline at end of file