Skip to content

Commit cd1c067

Browse files
SWhyteAnswerSWhyteAnswer
committed
[NDR-181] re-adding over zealous parameter removal
1 parent cceb2fe commit cd1c067

File tree

6 files changed

+128
-151
lines changed

6 files changed

+128
-151
lines changed

‎infrastructure/ecr.tf‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,15 @@
11
module "ndr-docker-ecr-ui" {
2-
source = "./modules/ecr/"
3-
app_name = "ndr-${terraform.workspace}-app"
4-
5-
environment = var.environment
6-
owner = var.owner
2+
source = "./modules/ecr/"
3+
app_name = "ndr-${terraform.workspace}-app"
4+
current_account_id = data.aws_caller_identity.current.account_id
5+
environment = var.environment
6+
owner = var.owner
77
}
88
module "ndr-docker-ecr-data-collection" {
9-
count = local.is_sandbox ? 0 : 1
10-
source = "./modules/ecr/"
11-
app_name = "${terraform.workspace}-data-collection"
12-
environment = var.environment
13-
owner = var.owner
9+
count = local.is_sandbox ? 0 : 1
10+
source = "./modules/ecr/"
11+
app_name = "${terraform.workspace}-data-collection"
12+
current_account_id = data.aws_caller_identity.current.account_id
13+
environment = var.environment
14+
owner = var.owner
1415
}

‎infrastructure/modules/ecr/README.md‎

Lines changed: 18 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -30,34 +30,30 @@ module "ecr_repository" {
3030
```
3131

3232
<!-- BEGIN_TF_DOCS -->
33-
3433
## Requirements
3534

36-
| Name | Version |
37-
| ------------------------------------------------------ | ------- |
38-
| <a name="requirement_aws"></a> [aws](#requirement_aws) | ~> 5.0 |
39-
35+
| Name | Version |
36+
|------|---------|
37+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 5.0 |
4038
## Resources
4139

42-
| Name | Type |
43-
| -------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |
44-
| [aws_ecr_lifecycle_policy.ndr_ecr_lifecycle_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_lifecycle_policy) | resource |
45-
| [aws_ecr_repository.ndr-ecr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository) | resource |
46-
| [aws_ecr_repository_policy.ndr_ecr_repository_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository_policy) | resource |
47-
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
48-
40+
| Name | Type |
41+
|------|------|
42+
| [aws_ecr_lifecycle_policy.ndr_ecr_lifecycle_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_lifecycle_policy) | resource |
43+
| [aws_ecr_repository.ndr-ecr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository) | resource |
44+
| [aws_ecr_repository_policy.ndr_ecr_repository_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository_policy) | resource |
45+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
4946
## Inputs
5047

51-
| Name | Description | Type | Default | Required |
52-
| ------------------------------------------------------------------ | ------------------- | -------- | ------- | :------: |
53-
| <a name="input_app_name"></a> [app_name](#input_app_name) | the name of the app | `string` | n/a | yes |
54-
| <a name="input_environment"></a> [environment](#input_environment) | n/a | `string` | n/a | yes |
55-
| <a name="input_owner"></a> [owner](#input_owner) | n/a | `string` | n/a | yes |
56-
48+
| Name | Description | Type | Default | Required |
49+
|------|-------------|------|---------|:--------:|
50+
| <a name="input_app_name"></a> [app\_name](#input\_app\_name) | Name of the application (used in repository naming). | `string` | n/a | yes |
51+
| <a name="input_current_account_id"></a> [current\_account\_id](#input\_current\_account\_id) | AWS account ID where the repository is created. | `string` | n/a | yes |
52+
| <a name="input_environment"></a> [environment](#input\_environment) | Deployment environment tag used for naming and labeling (e.g., dev, prod). | `string` | n/a | yes |
53+
| <a name="input_owner"></a> [owner](#input\_owner) | Identifies the team or person responsible for the resource (used for tagging). | `string` | n/a | yes |
5754
## Outputs
5855

59-
| Name | Description |
60-
| ----------------------------------------------------------------------------------------- | ----------- |
61-
| <a name="output_ecr_repository_url"></a> [ecr_repository_url](#output_ecr_repository_url) | n/a |
62-
56+
| Name | Description |
57+
|------|-------------|
58+
| <a name="output_ecr_repository_url"></a> [ecr\_repository\_url](#output\_ecr\_repository\_url) | n/a |
6359
<!-- END_TF_DOCS -->

‎infrastructure/modules/kms/README.md‎

Lines changed: 25 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -50,43 +50,38 @@ module "kms_key" {
5050
```
5151

5252
<!-- BEGIN_TF_DOCS -->
53-
5453
## Requirements
5554

56-
| Name | Version |
57-
| ------------------------------------------------------ | ------- |
58-
| <a name="requirement_aws"></a> [aws](#requirement_aws) | ~> 5.0 |
59-
55+
| Name | Version |
56+
|------|---------|
57+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 5.0 |
6058
## Resources
6159

62-
| Name | Type |
63-
| ------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |
64-
| [aws_kms_alias.encryption_key_alias](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | resource |
65-
| [aws_kms_key.encryption_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
66-
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
60+
| Name | Type |
61+
|------|------|
62+
| [aws_kms_alias.encryption_key_alias](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | resource |
63+
| [aws_kms_key.encryption_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
64+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
6765
| [aws_iam_policy_document.combined_policy_documents](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
68-
| [aws_iam_policy_document.kms_key_base](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
69-
| [aws_iam_policy_document.kms_key_generate](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
70-
66+
| [aws_iam_policy_document.kms_key_base](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
67+
| [aws_iam_policy_document.kms_key_generate](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
7168
## Inputs
7269

73-
| Name | Description | Type | Default | Required |
74-
| --------------------------------------------------------------------------------------------------------- | ----------- | -------------- | ------- | :------: |
75-
| <a name="input_allow_decrypt_for_arn"></a> [allow_decrypt_for_arn](#input_allow_decrypt_for_arn) | n/a | `bool` | `false` | no |
76-
| <a name="input_allowed_arn"></a> [allowed_arn](#input_allowed_arn) | n/a | `list(string)` | `[]` | no |
77-
| <a name="input_aws_identifiers"></a> [aws_identifiers](#input_aws_identifiers) | n/a | `list(string)` | `[]` | no |
78-
| <a name="input_environment"></a> [environment](#input_environment) | n/a | `string` | n/a | yes |
79-
| <a name="input_kms_key_description"></a> [kms_key_description](#input_kms_key_description) | n/a | `string` | n/a | yes |
80-
| <a name="input_kms_key_name"></a> [kms_key_name](#input_kms_key_name) | n/a | `string` | n/a | yes |
81-
| <a name="input_kms_key_rotation_enabled"></a> [kms_key_rotation_enabled](#input_kms_key_rotation_enabled) | n/a | `bool` | `true` | no |
82-
| <a name="input_owner"></a> [owner](#input_owner) | n/a | `string` | n/a | yes |
83-
| <a name="input_service_identifiers"></a> [service_identifiers](#input_service_identifiers) | n/a | `list(string)` | n/a | yes |
84-
70+
| Name | Description | Type | Default | Required |
71+
|------|-------------|------|---------|:--------:|
72+
| <a name="input_allow_decrypt_for_arn"></a> [allow\_decrypt\_for\_arn](#input\_allow\_decrypt\_for\_arn) | Flag to allow generating a decrypt-only policy for specified ARNs. | `bool` | `false` | no |
73+
| <a name="input_allowed_arn"></a> [allowed\_arn](#input\_allowed\_arn) | List of ARNs that are allowed full encrypt/decrypt access to the KMS key. | `list(string)` | `[]` | no |
74+
| <a name="input_aws_identifiers"></a> [aws\_identifiers](#input\_aws\_identifiers) | List of ARNs that will be granted decrypt-only access. | `list(string)` | `[]` | no |
75+
| <a name="input_environment"></a> [environment](#input\_environment) | Deployment environment (e.g., dev, staging, prod). | `string` | n/a | yes |
76+
| <a name="input_kms_key_description"></a> [kms\_key\_description](#input\_kms\_key\_description) | Description of the KMS key. | `string` | n/a | yes |
77+
| <a name="input_kms_key_name"></a> [kms\_key\_name](#input\_kms\_key\_name) | Name of the KMS key to be created. | `string` | n/a | yes |
78+
| <a name="input_kms_key_rotation_enabled"></a> [kms\_key\_rotation\_enabled](#input\_kms\_key\_rotation\_enabled) | Enable automatic KMS key rotation. | `bool` | `true` | no |
79+
| <a name="input_owner"></a> [owner](#input\_owner) | Owner tag for identifying the resource owner. | `string` | n/a | yes |
80+
| <a name="input_service_identifiers"></a> [service\_identifiers](#input\_service\_identifiers) | List of AWS service principal identifiers allowed to use the key (e.g., 's3.amazonaws.com'). | `list(string)` | n/a | yes |
8581
## Outputs
8682

87-
| Name | Description |
88-
| -------------------------------------------------------- | ----------- |
89-
| <a name="output_id"></a> [id](#output_id) | n/a |
90-
| <a name="output_kms_arn"></a> [kms_arn](#output_kms_arn) | n/a |
91-
83+
| Name | Description |
84+
|------|-------------|
85+
| <a name="output_id"></a> [id](#output\_id) | n/a |
86+
| <a name="output_kms_arn"></a> [kms\_arn](#output\_kms\_arn) | n/a |
9287
<!-- END_TF_DOCS -->

0 commit comments

Comments
 (0)