feat(ssm-secrets): add support for extra config options

[RoseSecurity]

what

• Added support for specifying parameter_store_paths and resources in the values passed to the external_ssm_secrets module, enabling more granular control over which secrets and resources are managed.
• Introduced a serviceAccount configuration that sets the service account name based on module.this.name, improving service account management.
• Added an rbac configuration block with a create flag controlled by var.rbac_enabled, allowing for optional RBAC resource creation.

why

• This updates the configuration for the external_ssm_secrets module to support additional customization and RBAC (Role-Based Access Control) options. The main changes expand the set of values passed to the module, allowing for more flexible and secure integration.

Summary by CodeRabbit

• New Features

  • Configure multiple Parameter Store paths for external secrets.
  • Add resource requests/limits configuration for pods.
  • Specify custom ServiceAccount names and toggle RBAC creation.
  • Maintains existing region configuration.

• Chores

  • Updated chart/values structure to support the new configuration options without changing existing behavior.

[coderabbitai]

Walkthrough

Adds new YAML keys to the values passed to the external_ssm_secrets Helm chart in src/main.tf: parameter_store_paths, resources, serviceAccount.name, and rbac.create. The existing region value remains. No control-flow or public API changes.

Changes

Cohort / File(s)	Summary
Terraform Helm values update src/main.tf	Expanded YAML-encoded values for external_ssm_secrets: added parameter_store_paths, resources, serviceAccount: { name }, and rbac: { create }; retained region.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

I hop through fields of keys and names,
New paths and roles in tidy frames.
A service account takes its place,
RBAC set with careful grace.
Region steady, secrets grow—what a race! 🐇

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The title succinctly and accurately describes the primary change of the pull request, which is adding support for extra configuration options in the SSM secrets module. It follows conventional commit style, clearly indicating a new feature and its scope, and avoids vague or generic language. The phrasing is concise and immediately conveys the main enhancement without extraneous detail.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch improve-helm-release-values

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 0c95b22 and 156a8a7.

📒 Files selected for processing (1)

• src/main.tf (1 hunks)

🚧 Files skipped from review as they are similar to previous changes (1)

• src/main.tf

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: Summary

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 7f607a7 and 0c95b22.

📒 Files selected for processing (1)

• src/main.tf (1 hunks)

🧰 Additional context used

📓 Path-based instructions (2)

src/@(main|variables|outputs|providers|versions|context).tf

📄 CodeRabbit inference engine (AGENTS.md)

Keep the Terraform component’s core files (main.tf, variables.tf, outputs.tf, providers.tf, versions.tf, context.tf) in src/ as the source of truth

Files:

• src/main.tf

src/**/*.tf

📄 CodeRabbit inference engine (AGENTS.md)

src/**/*.tf: Use 2-space indentation for all Terraform files
Prefer lower_snake_case for Terraform variables and locals
Keep Terraform resource and data source names descriptive and aligned with Cloud Posse null-label patterns
Run terraform fmt and do not commit formatting violations
Follow TFLint rules configured in .tflint.hcl; do not commit lint violations

Files:

• src/main.tf

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: Summary

[RoseSecurity]

/terratest

[github-actions]

These changes were released in v1.537.1.