Initial implementation (#1)

* Initial implementation * If `alias` not provided, use `label.id` as alias suffix
cloudposse · Apr 7, 2018 · d7e6abc · d7e6abc
1 parent 8f7d52c
commit d7e6abc
Show file tree

Hide file tree

Showing 8 changed files with 253 additions and 3 deletions.
diff --git a/.gitignore b/.gitignore
@@ -4,3 +4,5 @@
 
 # Module directory
 .terraform/
+.idea
+*.iml
diff --git a/.travis.yml b/.travis.yml
@@ -0,0 +1,16 @@
+addons:
+  apt:
+    packages:
+      - git
+      - make
+      - curl
+
+install:
+  - make init
+
+script:
+  - make terraform/install
+  - make terraform/get-plugins
+  - make terraform/get-modules
+  - make terraform/lint
+  - make terraform/validate
diff --git a/LICENSE b/LICENSE
@@ -178,15 +178,15 @@
    APPENDIX: How to apply the Apache License to your work.
 
       To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
+      boilerplate notice, with the fields enclosed by brackets "{}"
       replaced with your own identifying information. (Don't include
       the brackets!)  The text should be enclosed in the appropriate
       comment syntax for the file format. We also recommend that a
       file or class name and description of purpose be included on the
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright [yyyy] [name of copyright owner]
+   Copyright 2018 Cloud Posse, LLC
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

diff --git a/Makefile b/Makefile
@@ -0,0 +1,6 @@
+SHELL := /bin/bash
+
+-include $(shell curl -sSL -o .build-harness "https://git.io/build-harness"; echo .build-harness)
+
+lint:
+	$(SELF) terraform/install terraform/get-modules terraform/get-plugins terraform/lint terraform/validate
diff --git a/README.md b/README.md
@@ -1 +1,137 @@
-# terraform-aws-kms-key
+# terraform-aws-kms-key [![Build Status](https://travis-ci.org/cloudposse/terraform-aws-kms-key.svg?branch=master)](https://travis-ci.org/cloudposse/terraform-aws-kms-key)
+
+Terraform module to provision a [KMS](https://aws.amazon.com/kms/) key with alias.
+
+Can be used with [chamber](https://github.com/segmentio/chamber) for managing secrets by storing them in Amazon EC2 Systems Manager Parameter Store.
+
+* https://aws.amazon.com/systems-manager/features
+* https://aws.amazon.com/blogs/mt/the-right-way-to-store-secrets-using-parameter-store
+
+
+## Usage
+
+```hcl
+module "kms_key" {
+  source                  = "git::https://github.com/cloudposse/terraform-aws-kms-key.git?ref=master"
+  namespace               = "cp"
+  stage                   = "prod"
+  name                    = "app"
+  description             = "KMS key for chamber"
+  deletion_window_in_days = 10
+  enable_key_rotation     = "true"
+  alias                   = "alias/parameter_store_key"
+}
+```
+
+
+## Variables
+
+|  Name                      |  Default                          |  Description                                             | Required  |
+|:---------------------------|:----------------------------------|:---------------------------------------------------------|:---------:|
+| `namespace`                | ``                                | Namespace (e.g. `cp` or `cloudposse`)                    | Yes       |
+| `stage`                    | ``                                | Stage (e.g. `prod`, `dev`, `staging`)                    | Yes       |
+| `name`                     | ``                                | Application or solution name  (e.g. `app`)               | Yes       |
+| `attributes`               | `[]`                              | Additional attributes (_e.g._ `policy` or `role`)        | No       |
+| `tags`                     | `{}`                              | Additional tags  (_e.g._ `map("Cluster","xyz")`          | No       |
+| `delimiter`                | `-`                               | Delimiter to be used between `namespace`, `stage`, `name`, and `attributes`  | No       |
+| `alias`                    | ``                                | The display name of the alias. The name must start with the word `alias` followed by a forward slash     | No        |
+| `deletion_window_in_days`  | `10`                              | Duration in days after which the key is deleted after destruction of the resource    | No        |
+| `enable_key_rotation`      | `true`                            | Specifies whether key rotation is enabled                | No        |
+| `description`              | `Parameter Store KMS master key`  | The description of the key as viewed in AWS console      | No        |
+
+
+__NOTE:__ To use the KMS key with [chamber](https://github.com/segmentio/chamber), the `alias` must be set to `alias/parameter_store_key`.
+
+__NOTE:__ If `alias` is not specified, `format("alias/%v", module.label.id)` will be used instead.
+
+
+## Outputs
+
+| Name              | Description       |
+|:------------------|:------------------|
+| `key_arn`         | Key ARN           |
+| `key_id`          | Key ID            |
+| `alias_arn`       | Alias ARN         |
+| `alias_name`      | Alias name        |
+
+
+## Help
+
+**Got a question?**
+
+File a GitHub [issue](https://github.com/cloudposse/terraform-aws-kms-key/issues), send us an [email](mailto:[email protected]) or reach out to us on [Gitter](https://gitter.im/cloudposse/).
+
+
+## Contributing
+
+### Bug Reports & Feature Requests
+
+Please use the [issue tracker](https://github.com/cloudposse/terraform-aws-kms-key/issues) to report any bugs or file feature requests.
+
+### Developing
+
+If you are interested in being a contributor and want to get involved in developing `terraform-aws-kms-key`, we would love to hear from you! Shoot us an [email](mailto:[email protected]).
+
+In general, PRs are welcome. We follow the typical "fork-and-pull" Git workflow.
+
+ 1. **Fork** the repo on GitHub
+ 2. **Clone** the project to your own machine
+ 3. **Commit** changes to your own branch
+ 4. **Push** your work back up to your fork
+ 5. Submit a **Pull request** so that we can review your changes
+
+**NOTE:** Be sure to merge the latest from "upstream" before making a pull request!
+
+
+## License
+
+[APACHE 2.0](LICENSE) © 2018 [Cloud Posse, LLC](https://cloudposse.com)
+
+See [LICENSE](LICENSE) for full details.
+
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+
+
+## About
+
+`terraform-aws-kms-key` is maintained and funded by [Cloud Posse, LLC][website].
+
+![Cloud Posse](https://cloudposse.com/logo-300x69.png)
+
+
+Like it? Please let us know at <[email protected]>
+
+We love [Open Source Software](https://github.com/cloudposse/)!
+
+See [our other projects][community]
+or [hire us][hire] to help build your next cloud platform.
+
+  [website]: https://cloudposse.com/
+  [community]: https://github.com/cloudposse/
+  [hire]: https://cloudposse.com/contact/
+
+
+### Contributors
+
+| [![Erik Osterman][erik_img]][erik_web]<br/>[Erik Osterman][erik_web] | [![Andriy Knysh][andriy_img]][andriy_web]<br/>[Andriy Knysh][andriy_web] |
+|-------------------------------------------------------|------------------------------------------------------------------|
+
+  [erik_img]: http://s.gravatar.com/avatar/88c480d4f73b813904e00a5695a454cb?s=144
+  [erik_web]: https://github.com/osterman/
+  [andriy_img]: https://avatars0.githubusercontent.com/u/7356997?v=4&u=ed9ce1c9151d552d985bdf5546772e14ef7ab617&s=144
+  [andriy_web]: https://github.com/aknysh/
diff --git a/main.tf b/main.tf
@@ -0,0 +1,21 @@
+module "label" {
+  source     = "git::https://github.com/cloudposse/terraform-null-label.git?ref=tags/0.3.3"
+  namespace  = "${var.namespace}"
+  stage      = "${var.stage}"
+  name       = "${var.name}"
+  attributes = "${var.attributes}"
+  delimiter  = "${var.delimiter}"
+  tags       = "${var.tags}"
+}
+
+resource "aws_kms_key" "default" {
+  description             = "${var.description}"
+  deletion_window_in_days = "${var.deletion_window_in_days}"
+  enable_key_rotation     = "${var.enable_key_rotation}"
+  tags                    = "${module.label.tags}"
+}
+
+resource "aws_kms_alias" "default" {
+  name          = "${coalesce(var.alias, format("alias/%v", module.label.id))}"
+  target_key_id = "${aws_kms_key.default.id}"
+}
diff --git a/output.tf b/output.tf
@@ -0,0 +1,15 @@
+output "key_arn" {
+  value = "${aws_kms_key.default.arn}"
+}
+
+output "key_id" {
+  value = "${aws_kms_key.default.key_id}"
+}
+
+output "alias_arn" {
+  value = "${aws_kms_alias.default.arn}"
+}
+
+output "alias_name" {
+  value = "${aws_kms_alias.default.name}"
+}
diff --git a/variables.tf b/variables.tf
@@ -0,0 +1,54 @@
+variable "namespace" {
+  type        = "string"
+  description = "Namespace (e.g. `cp` or `cloudposse`)"
+}
+
+variable "stage" {
+  type        = "string"
+  description = "Stage (e.g. `prod`, `dev`, `staging`)"
+}
+
+variable "name" {
+  type        = "string"
+  description = "Application or solution name (e.g. `app`)"
+}
+
+variable "delimiter" {
+  type        = "string"
+  default     = "-"
+  description = "Delimiter to be used between `namespace`, `stage`, `name` and `attributes`"
+}
+
+variable "attributes" {
+  type        = "list"
+  default     = []
+  description = "Additional attributes (e.g. `1`)"
+}
+
+variable "tags" {
+  type        = "map"
+  default     = {}
+  description = "Additional tags (e.g. map(`BusinessUnit`,`XYZ`)"
+}
+
+variable "deletion_window_in_days" {
+  default     = 10
+  description = "Duration in days after which the key is deleted after destruction of the resource"
+}
+
+variable "enable_key_rotation" {
+  default     = "true"
+  description = "Specifies whether key rotation is enabled"
+}
+
+variable "description" {
+  type        = "string"
+  default     = "Parameter Store KMS master key"
+  description = "The description of the key as viewed in AWS console"
+}
+
+variable "alias" {
+  type        = "string"
+  default     = ""
+  description = "The display name of the alias. The name must start with the word `alias` followed by a forward slash"
+}
-Original file line number
+Diff line change
@@ Expand Up / @@ -4,3 +4,5 @@ @@
     # Module directory
     .terraform/
+    .idea
+    *.iml