From a901af391e8c02a1f6494815134b86e332785b89 Mon Sep 17 00:00:00 2001 From: Volodymyr S <26582191+SweetOps@users.noreply.github.com> Date: Mon, 26 Sep 2022 13:56:02 +0200 Subject: [PATCH] feat: make module complaint with terraform 1.3 (#5) --- .github/workflows/docs.yml | 35 ++++++++++++++-------------- .github/workflows/pr-lint.yml | 2 +- .github/workflows/terraform.yml | 3 +-- .github/workflows/tflint.yml | 2 +- .github/workflows/tfsec.yml | 2 +- README.md | 8 +++---- examples/basic/README.md | 2 +- examples/basic/versions.tf | 3 +-- main.tf | 41 ++++++++------------------------- variables.tf | 19 ++++++--------- versions.tf | 3 +-- 11 files changed, 46 insertions(+), 74 deletions(-) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 58dd5ab..1275ca3 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -1,3 +1,4 @@ +name: Generate terraform docs on: pull_request: @@ -5,22 +6,22 @@ jobs: docs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 - with: - ref: ${{ github.event.pull_request.head.ref }} + - uses: actions/checkout@v2 + with: + ref: ${{ github.event.pull_request.head.ref }} - - name: Render terraform docs inside the examples/basic/README.md - uses: terraform-docs/gh-actions@v0.11.0 - with: - working-dir: ./examples/basic/ - git-push: "false" - output-file: README.md - config-file: ".terraform-docs.yml" + - name: Render terraform docs inside the examples/basic/README.md + uses: terraform-docs/gh-actions@v0.11.0 + with: + working-dir: ./examples/basic/ + git-push: "false" + output-file: README.md + config-file: ".terraform-docs.yml" - - name: Render terraform docs inside the README.md - uses: terraform-docs/gh-actions@v0.11.0 - with: - working-dir: . - git-push: "true" - output-file: README.md - config-file: ".terraform-docs.yml" + - name: Render terraform docs inside the README.md + uses: terraform-docs/gh-actions@v0.11.0 + with: + working-dir: . + git-push: "true" + output-file: README.md + config-file: ".terraform-docs.yml" diff --git a/.github/workflows/pr-lint.yml b/.github/workflows/pr-lint.yml index 1e22c52..f138c4d 100644 --- a/.github/workflows/pr-lint.yml +++ b/.github/workflows/pr-lint.yml @@ -9,7 +9,7 @@ jobs: steps: - name: Lint PR - uses: aslafy-z/conventional-pr-title-action@master + uses: aslafy-z/conventional-pr-title-action@v2.4.1 with: preset: conventional-changelog-angular@^5.0.6 env: diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml index cbc0ee6..010bdb6 100644 --- a/.github/workflows/terraform.yml +++ b/.github/workflows/terraform.yml @@ -14,7 +14,7 @@ jobs: - name: Setup Terraform uses: hashicorp/setup-terraform@v1 with: - terraform_version: 1.0.4 + terraform_version: 1.3.0 - name: Ensure Terraform code is formated run: terraform fmt -check @@ -24,4 +24,3 @@ jobs: - name: Validate Terraform code run: terraform validate -no-color - diff --git a/.github/workflows/tflint.yml b/.github/workflows/tflint.yml index 2792e9f..146a0d8 100644 --- a/.github/workflows/tflint.yml +++ b/.github/workflows/tflint.yml @@ -14,7 +14,7 @@ jobs: - name: Setup Terraform uses: hashicorp/setup-terraform@v1 with: - terraform_version: 1.0.4 + terraform_version: 1.3.0 - name: Terraform Init run: terraform init diff --git a/.github/workflows/tfsec.yml b/.github/workflows/tfsec.yml index c457c55..d6682ab 100644 --- a/.github/workflows/tfsec.yml +++ b/.github/workflows/tfsec.yml @@ -15,7 +15,7 @@ jobs: - name: Setup Terraform uses: hashicorp/setup-terraform@v1 with: - terraform_version: 1.0.4 + terraform_version: 1.3.0 - name: Terraform Init run: terraform init diff --git a/README.md b/README.md index 9a14f11..122ba16 100644 --- a/README.md +++ b/README.md @@ -45,7 +45,7 @@ module "secrets" { | Name | Version | |------|---------| -| [terraform](#requirement\_terraform) | >= 1.0 | +| [terraform](#requirement\_terraform) | >= 1.3 | | [aws](#requirement\_aws) | >= 3.0 | ## Providers @@ -82,7 +82,7 @@ module "secrets" { | [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no | | [environment](#input\_environment) | ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no | | [id\_length\_limit](#input\_id\_length\_limit) | Limit `id` to this many characters (minimum 6).
Set to `0` for unlimited length.
Set to `null` for keep the existing setting, which defaults to `0`.
Does not affect `id_full`. | `number` | `null` | no | -| [kms\_key](#input\_kms\_key) | enabled:
Whether to create KSM key.
description:
The description of the key as viewed in AWS console.
alias:
The display name of the alias. The name must start with the word alias followed by a forward slash.
If not specified, the alias name will be auto-generated.
deletion\_window\_in\_days:
Duration in days after which the key is deleted after destruction of the resource
enable\_key\_rotation:
Specifies whether key rotation is enabled. | 
object({
    enabled                 = optional(bool)
    description             = optional(string)
    alias                   = optional(string)
    deletion_window_in_days = optional(number)
    enable_key_rotation     = optional(bool)
  })
| 
{
  "deletion_window_in_days": 30,
  "description": "Managed by Terraform",
  "enable_key_rotation": true,
  "enabled": true
}
| no | +| [kms\_key](#input\_kms\_key) | enabled:
Whether to create KSM key.
description:
The description of the key as viewed in AWS console.
alias:
The display name of the alias. The name must start with the word alias followed by a forward slash.
If not specified, the alias name will be auto-generated.
deletion\_window\_in\_days:
Duration in days after which the key is deleted after destruction of the resource
enable\_key\_rotation:
Specifies whether key rotation is enabled. | 
object({
    enabled                 = optional(bool, true)
    description             = optional(string, "Managed by Terraform")
    alias                   = optional(string)
    deletion_window_in_days = optional(number, 30)
    enable_key_rotation     = optional(bool, true)
  })
| `{}` | no | | [kms\_key\_id](#input\_kms\_key\_id) | ARN or Id of the AWS KMS customer master key (CMK) to be used to encrypt the secret values in the versions stored in this secret.
If you don't specify this value, then Secrets Manager defaults to using the AWS account's default CMK (the one named `aws/secretsmanager`). | `string` | `null` | no | | [label\_key\_case](#input\_label\_key\_case) | Controls the letter case of the `tags` keys (label names) for tags generated by this module.
Does not affect keys of tags passed in via the `tags` input.
Possible values: `lower`, `title`, `upper`.
Default value: `title`. | `string` | `null` | no | | [label\_order](#input\_label\_order) | The order in which the labels (ID elements) appear in the `id`.
Defaults to ["namespace", "environment", "stage", "name", "attributes"].
You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. | `list(string)` | `null` | no | @@ -93,8 +93,8 @@ module "secrets" { | [policy](#input\_policy) | Valid JSON document representing a resource policy. | `string` | `null` | no | | [recovery\_window\_in\_days](#input\_recovery\_window\_in\_days) | Valid JSON document representing a resource policy. | `number` | `30` | no | | [regex\_replace\_chars](#input\_regex\_replace\_chars) | Terraform regular expression (regex) string.
Characters matching the regex will be removed from the ID elements.
If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no | -| [rotation](#input\_rotation) | enabled:
Whether to create secret rotation rule.
Default value: `false`
lambda\_arn:
Specifies the ARN of the Lambda function that can rotate the secret.
automatically\_after\_days:
Specifies the number of days between automatic scheduled rotations of the secret. | 
object({
    enabled                  = optional(bool)
    lambda_arn               = string
    automatically_after_days = number
  })
| 
{
  "automatically_after_days": 0,
  "lambda_arn": ""
}
| no | -| [secret\_version](#input\_secret\_version) | enabled:
Whether to create secret version.
Default value: `false`
secret\_string:
Specifies text data that you want to encrypt and store in this version of the secret.
This is required if `secret_binary` is not set.
secret\_binary:
Specifies binary data that you want to encrypt and store in this version of the secret.
This is required if `secret_string` is not set.
Needs to be encoded to base64. | 
object({
    enabled       = optional(bool)
    secret_string = optional(string)
    secret_binary = optional(string)
  })
| `{}` | no | +| [rotation](#input\_rotation) | enabled:
Whether to create secret rotation rule.
Default value: `false`
lambda\_arn:
Specifies the ARN of the Lambda function that can rotate the secret.
automatically\_after\_days:
Specifies the number of days between automatic scheduled rotations of the secret. | 
object({
    enabled                  = optional(bool, false)
    lambda_arn               = string
    automatically_after_days = number
  })
| 
{
  "automatically_after_days": 0,
  "lambda_arn": ""
}
| no | +| [secret\_version](#input\_secret\_version) | enabled:
Whether to create secret version.
Default value: `false`
secret\_string:
Specifies text data that you want to encrypt and store in this version of the secret.
This is required if `secret_binary` is not set.
secret\_binary:
Specifies binary data that you want to encrypt and store in this version of the secret.
This is required if `secret_string` is not set.
Needs to be encoded to base64. | 
object({
    enabled       = optional(bool, true)
    secret_string = optional(string)
    secret_binary = optional(string)
  })
| `{}` | no | | [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no | | [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no | | [tenant](#input\_tenant) | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no | diff --git a/examples/basic/README.md b/examples/basic/README.md index 3082207..fbde261 100644 --- a/examples/basic/README.md +++ b/examples/basic/README.md @@ -45,7 +45,7 @@ module "secrets" { | Name | Version | |------|---------| -| [terraform](#requirement\_terraform) | >= 1.0 | +| [terraform](#requirement\_terraform) | >= 1.3 | | [aws](#requirement\_aws) | >= 3.0 | ## Providers diff --git a/examples/basic/versions.tf b/examples/basic/versions.tf index 0407a3c..2973d0e 100644 --- a/examples/basic/versions.tf +++ b/examples/basic/versions.tf @@ -1,6 +1,5 @@ terraform { - required_version = ">= 1.0" - experiments = [module_variable_optional_attrs] + required_version = ">= 1.3" required_providers { aws = { diff --git a/main.tf b/main.tf index 1a359c1..45c2ab0 100644 --- a/main.tf +++ b/main.tf @@ -4,41 +4,20 @@ locals { secret_id = one(aws_secretsmanager_secret.default[*].id) secret_arn = one(aws_secretsmanager_secret.default[*].arn) version_id = one(aws_secretsmanager_secret_version.default[*].version_id) - secret_version = defaults(var.secret_version, local.secret_version_default) - secret_version_enabled = local.enabled && local.secret_version["enabled"] - secret_string = local.secret_version_enabled && length(local.secret_version["secret_string"]) > 0 ? local.secret_version["secret_string"] : null - secret_binary = local.secret_version_enabled && length(local.secret_version["secret_binary"]) > 0 ? local.secret_version["secret_binary"] : null - secret_rotation = defaults(var.rotation, local.secret_rotation_default) - secret_rotation_enabled = local.enabled && local.secret_rotation["enabled"] - kms_key = defaults(var.kms_key, local.kms_key_default) - kms_key_enabled = local.enabled && local.kms_key["enabled"] - kms_key_id = local.kms_key["enabled"] ? module.kms_key.key_id : var.kms_key_id - - kms_key_default = { - deletion_window_in_days = 30 - description = "Managed by Terraform" - enable_key_rotation = true - enabled = true - } - secret_version_default = { - secret_string = "" - secret_binary = "" - enabled = false - } - - secret_rotation_default = { - enabled = false - } + secret_version_enabled = local.enabled && var.secret_version["enabled"] + secret_rotation_enabled = local.enabled && var.rotation["enabled"] + kms_key_enabled = local.enabled && var.kms_key["enabled"] + kms_key_id = var.kms_key["enabled"] ? module.kms_key.key_id : var.kms_key_id } module "kms_key" { source = "cloudposse/kms-key/aws" version = "0.12.1" - description = local.kms_key["description"] - deletion_window_in_days = local.kms_key["deletion_window_in_days"] - enable_key_rotation = local.kms_key["enable_key_rotation"] - alias = lookup(local.kms_key, "alias", format("secretsmanager/%s", module.this.id)) + description = var.kms_key["description"] + deletion_window_in_days = var.kms_key["deletion_window_in_days"] + enable_key_rotation = var.kms_key["enable_key_rotation"] + alias = lookup(var.kms_key, "alias", format("secretsmanager/%s", module.this.id)) enabled = local.kms_key_enabled context = module.this.context @@ -59,8 +38,8 @@ resource "aws_secretsmanager_secret_version" "default" { count = local.secret_version_enabled ? 1 : 0 secret_id = local.secret_id - secret_string = local.secret_string - secret_binary = local.secret_binary + secret_string = var.secret_version["secret_string"] + secret_binary = var.secret_version["secret_binary"] } resource "aws_secretsmanager_secret_rotation" "default" { diff --git a/variables.tf b/variables.tf index 04e5d0c..70b9304 100644 --- a/variables.tf +++ b/variables.tf @@ -27,18 +27,13 @@ variable "kms_key_id" { variable "kms_key" { type = object({ - enabled = optional(bool) - description = optional(string) + enabled = optional(bool, true) + description = optional(string, "Managed by Terraform") alias = optional(string) - deletion_window_in_days = optional(number) - enable_key_rotation = optional(bool) + deletion_window_in_days = optional(number, 30) + enable_key_rotation = optional(bool, true) }) - default = { - deletion_window_in_days = 30 - description = "Managed by Terraform" - enable_key_rotation = true - enabled = true - } + default = {} description = <<-DOC enabled: Whether to create KSM key. @@ -56,7 +51,7 @@ variable "kms_key" { variable "secret_version" { type = object({ - enabled = optional(bool) + enabled = optional(bool, true) secret_string = optional(string) secret_binary = optional(string) }) @@ -78,7 +73,7 @@ variable "secret_version" { variable "rotation" { type = object({ - enabled = optional(bool) + enabled = optional(bool, false) lambda_arn = string automatically_after_days = number }) diff --git a/versions.tf b/versions.tf index 0407a3c..2973d0e 100644 --- a/versions.tf +++ b/versions.tf @@ -1,6 +1,5 @@ terraform { - required_version = ">= 1.0" - experiments = [module_variable_optional_attrs] + required_version = ">= 1.3" required_providers { aws = {