Skip to content

Commit 61056dd

Browse files
author
Jamie Nelson
committed
Initial commit of policy generator module
0 parents  commit 61056dd

File tree

2 files changed

+227
-0
lines changed

2 files changed

+227
-0
lines changed

‎README.md‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
2+
## Variables
3+
4+
| Name | Description | Required |
5+
|---------------------|-----------------------------------------------------------------------------------------------------------------------------------------|-----------|
6+
| parameter_root_name | The prefix or root parameter that you want to allow access to | No |
7+
| kms_key | The arn of the KMS key that you want to allow access to. If empty it uses a wildcard resource. `*` | No |
8+
| region | The region of the parameter store value that you want to allow access to. If none supplied, it uses the current region of the provider. | No |
9+
| account_id | The account id of the parameter store you want to allow access to. If none supplied, it uses the current account id of the provider. | No |
10+
11+
## Outputs
12+
13+
| Name | Description |
14+
|---------------------------------|---------------------------------------------------------------------------------------------------|
15+
| read_parameter_store_policy | A JSON policy document that only allows read access to the parameter store |
16+
| write_parameter_store_policy | A JSON policy document that only allows write access to the parameter store |
17+
| manage_kms_store_policy | A JSON policy document that allows decryption access to a KMS key |
18+
| manage_parameter_store_policy | A JSON policy document that allows full access to the parameter store |
19+
| put_xray_trace_policy | A JSON policy document that allows putting data into x-ray for tracing parameter store requests |
20+
21+
## Examples
22+
23+
### Create a policy that allows access to read all parameters
24+
25+
```hcl
26+
module "ps_policy" {
27+
source = "git::https://github.com/cloudposse/terraform-aws-parameter-store-policy.git?ref=master"
28+
}
29+
30+
resource "aws_iam_policy" "ps_read" {
31+
name_prefix = "read_any_parameter_store_value"
32+
path = "/"
33+
policy = "${module.ps_policy.read_parameter_store_policy}"
34+
}
35+
```
36+
37+
### Create a policy that allows access to write all parameters
38+
39+
```hcl
40+
module "ps_policy" {
41+
source = "git::https://github.com/cloudposse/terraform-aws-parameter-store-policy.git?ref=master"
42+
}
43+
44+
resource "aws_iam_policy" "ps_write" {
45+
name_prefix = "write_any_parameter_store_value"
46+
path = "/"
47+
policy = "${module.ps_policy.write_parameter_store_policy}"
48+
}
49+
```
50+
51+
### Create a policy that allows managing all policies
52+
```hcl
53+
module "ps_policy" {
54+
source = "git::https://github.com/cloudposse/terraform-aws-parameter-store-policy.git?ref=master"
55+
}
56+
57+
resource "aws_iam_policy" "ps_manage" {
58+
name_prefix = "manage_any_parameter_store_value"
59+
path = "/"
60+
policy = "${module.ps_policy.manage_parameter_store_policy}"
61+
}
62+
```
63+
64+
### Create a policy that allows reading all parameters that start with a certain prefix
65+
```hcl
66+
module "ps_policy" {
67+
source = "git::https://github.com/cloudposse/terraform-aws-parameter-store-policy.git?ref=master"
68+
parameter_root_name = "/cp/dev/app"
69+
70+
}
71+
72+
resource "aws_iam_policy" "ps_manage" {
73+
name_prefix = "write_specific_parameter_store_value"
74+
path = "/"
75+
policy = "${module.ps_policy.manage_parameter_store_policy}"
76+
}
77+
```
78+
79+
### Create a kms policy to allow decrypting of the parameter store values
80+
```hcl
81+
module "kms_key" {
82+
source = "git::https://github.com/cloudposse/terraform-aws-kms-key.git?ref=master"
83+
namespace = "cp"
84+
stage = "prod"
85+
name = "app"
86+
description = "KMS key"
87+
deletion_window_in_days = 10
88+
enable_key_rotation = "true"
89+
alias = "alias/parameter_store_key"
90+
}
91+
92+
module "ps_policy" {
93+
source = "git::https://github.com/cloudposse/terraform-aws-parameter-store-policy.git?ref=master"
94+
parameter_root_name = "/cp/dev/app"
95+
kms_key = "${module.kms_key.key_arn}"
96+
97+
}
98+
99+
resource "aws_iam_policy" "ps_kms" {
100+
name_prefix = "decrypt_parameter_store_value"
101+
path = "/"
102+
policy = "${module.ps_policy.manage_kms_store_policy}"
103+
}
104+
```
105+
106+
### Create a policy for another account, or region
107+
```hcl
108+
module "ps_policy" {
109+
source = "git::https://github.com/cloudposse/terraform-aws-parameter-store-policy.git?ref=master"
110+
parameter_root_name = "/cp/dev/app"
111+
account_id = "783649272629220"
112+
region = "ap-southeast-2"
113+
114+
}
115+
116+
resource "aws_iam_policy" "ps_manage" {
117+
name_prefix = "manage_any_parameter_store_value"
118+
path = "/"
119+
policy = "${module.ps_policy.manage_parameter_store_policy}"
120+
}
121+
```

‎main.tf‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
variable "parameter_root_name" {
2+
description = "The prefix or root parameter that you want to allow access to"
3+
default = ""
4+
}
5+
6+
variable "kms_key" {
7+
description = "The arn of the KMS key that you want to allow access to. If empty it uses a wildcard resource. `*` "
8+
default = ""
9+
}
10+
11+
variable "region" {
12+
description = "The region of the parameter store value that you want to allow access to. If none supplied, it uses the current region of the provider."
13+
default = ""
14+
}
15+
16+
variable "account_id" {
17+
description = "The account id of the parameter store you want to allow access to. If none supplied, it uses the current account id of the provider. "
18+
default = ""
19+
}
20+
21+
data "aws_region" "default" {}
22+
data "aws_caller_identity" "default" {}
23+
24+
locals {
25+
region = "${ var.region == "" ? data.aws_region.default.name : var.region}"
26+
account_id = "${var.account_id == "" ? data.aws_caller_identity.default.account_id : var.account_id}"
27+
28+
# Normalise the parameter name, and remove any duplicate slashes
29+
parameter_root_name = "${join("/",compact(split("/", var.parameter_root_name)))}"
30+
31+
# If no KMS arn supplied, allow access to any KMS
32+
kms_key = "${var.kms_key == "" ? "*" : var.kms_key }"
33+
}
34+
35+
data "aws_iam_policy_document" "read_parameter_store" {
36+
statement {
37+
actions = ["ssm:GetParameters", "ssm:GetParameter", "ssm:GetParameterHistory", "ssm:GetParametersByPath"]
38+
resources = ["arn:aws:ssm:${local.region}:${local.account_id}:parameter/${local.parameter_root_name}*"]
39+
}
40+
}
41+
42+
data "aws_iam_policy_document" "write_parameter_store" {
43+
statement {
44+
actions = ["ssm:PutParameters", "ssm:PutParameter"]
45+
resources = ["arn:aws:ssm:${local.region}:${local.account_id}:parameter/${local.parameter_root_name}*"]
46+
}
47+
}
48+
49+
data "aws_iam_policy_document" "manage_parameter_store" {
50+
statement {
51+
actions = [
52+
"ssm:PutParameters",
53+
"ssm:PutParameter",
54+
"ssm:DeleteParameter",
55+
"ssm:DeleteParameters",
56+
"ssm:GetParameters",
57+
"ssm:GetParameter",
58+
"ssm:GetParameterHistory",
59+
"ssm:GetParametersByPath",
60+
]
61+
62+
resources = ["arn:aws:ssm:${local.region}:${local.account_id}:parameter/${local.parameter_root_name}*"]
63+
}
64+
}
65+
66+
data "aws_iam_policy_document" "put_xray_trace" {
67+
statement {
68+
actions = ["xray:PutTraceSegments", "xray:PutTelemetryRecords"]
69+
resources = ["*"]
70+
}
71+
}
72+
73+
data "aws_iam_policy_document" "manage_kms_store" {
74+
statement {
75+
actions = [
76+
"kms:ListKeys",
77+
"kms:ListAliases",
78+
"kms:Describe*",
79+
"kms:Decrypt",
80+
]
81+
82+
resources = [
83+
"${local.kms_key}",
84+
]
85+
}
86+
}
87+
88+
output "read_parameter_store_policy" {
89+
value = "${data.aws_iam_policy_document.read_parameter_store.json}"
90+
}
91+
92+
output "write_parameter_store_policy" {
93+
value = "${data.aws_iam_policy_document.write_parameter_store.json}"
94+
}
95+
96+
output "manage_kms_store_policy" {
97+
value = "${data.aws_iam_policy_document.manage_kms_store.json}"
98+
}
99+
100+
output "manage_parameter_store_policy" {
101+
value = "${data.aws_iam_policy_document.manage_parameter_store.json}"
102+
}
103+
104+
output "put_xray_trace_policy" {
105+
value = "${data.aws_iam_policy_document.put_xray_trace.json}"
106+
}

0 commit comments

Comments
 (0)