diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 7e4e7da..b84d048 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,6 +1,6 @@ repos: - repo: https://github.com/antonbabenko/pre-commit-terraform - rev: v1.96.1 + rev: v1.99.4 hooks: - id: terraform_fmt - id: terraform_wrapper_module_for_each diff --git a/README.md b/README.md index 8616254..e2f734e 100644 --- a/README.md +++ b/README.md @@ -146,14 +146,14 @@ Examples codified under the [`examples`](https://github.com/terraform-aws-module | Name | Version | |------|---------| -| [terraform](#requirement\_terraform) | >= 1.3 | -| [aws](#requirement\_aws) | >= 5.49 | +| [terraform](#requirement\_terraform) | >= 1.5.7 | +| [aws](#requirement\_aws) | >= 6.0 | ## Providers | Name | Version | |------|---------| -| [aws](#provider\_aws) | >= 5.49 | +| [aws](#provider\_aws) | >= 6.0 | ## Modules @@ -180,7 +180,7 @@ No modules. | [aliases](#input\_aliases) | A list of aliases to create. Note - due to the use of `toset()`, values must be static strings and not computed values | `list(string)` | `[]` | no | | [aliases\_use\_name\_prefix](#input\_aliases\_use\_name\_prefix) | Determines whether the alias name is used as a prefix | `bool` | `false` | no | | [bypass\_policy\_lockout\_safety\_check](#input\_bypass\_policy\_lockout\_safety\_check) | A flag to indicate whether to bypass the key policy lockout safety check. Setting this value to true increases the risk that the KMS key becomes unmanageable | `bool` | `null` | no | -| [computed\_aliases](#input\_computed\_aliases) | A map of aliases to create. Values provided via the `name` key of the map can be computed from upstream resources | `any` | `{}` | no | +| [computed\_aliases](#input\_computed\_aliases) | A map of aliases to create. Values provided via the `name` key of the map can be computed from upstream resources | 
map(object({
    name = string
  }))
| `{}` | no | | [create](#input\_create) | Determines whether resources will be created (affects all resources) | `bool` | `true` | no | | [create\_external](#input\_create\_external) | Determines whether an external CMK (externally provided material) will be created or a standard CMK (AWS provided material) | `bool` | `false` | no | | [create\_replica](#input\_create\_replica) | Determines whether a replica standard CMK will be created (AWS provided material) | `bool` | `false` | no | @@ -192,7 +192,7 @@ No modules. | [enable\_default\_policy](#input\_enable\_default\_policy) | Specifies whether to enable the default key policy. Defaults to `true` | `bool` | `true` | no | | [enable\_key\_rotation](#input\_enable\_key\_rotation) | Specifies whether key rotation is enabled. Defaults to `true` | `bool` | `true` | no | | [enable\_route53\_dnssec](#input\_enable\_route53\_dnssec) | Determines whether the KMS policy used for Route53 DNSSEC signing is enabled | `bool` | `false` | no | -| [grants](#input\_grants) | A map of grant definitions to create | `any` | `{}` | no | +| [grants](#input\_grants) | A map of grant definitions to create | 
map(object({
    constraints = optional(list(object({
      encryption_context_equals = optional(map(string))
      encryption_context_subset = optional(map(string))
    })))
    grant_creation_tokens = optional(list(string))
    grantee_principal     = string
    name                  = optional(string) # Will fall back to use map key
    operations            = list(string)
    retire_on_delete      = optional(bool)
    retiring_principal    = optional(string)
  }))
| `null` | no | | [is\_enabled](#input\_is\_enabled) | Specifies whether the key is enabled. Defaults to `true` | `bool` | `null` | no | | [key\_administrators](#input\_key\_administrators) | A list of IAM ARNs for [key administrators](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-default-allow-administrators) | `list(string)` | `[]` | no | | [key\_asymmetric\_public\_encryption\_users](#input\_key\_asymmetric\_public\_encryption\_users) | A list of IAM ARNs for [key asymmetric public encryption users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-users-crypto) | `list(string)` | `[]` | no | @@ -202,7 +202,7 @@ No modules. | [key\_owners](#input\_key\_owners) | A list of IAM ARNs for those who will have full key permissions (`kms:*`) | `list(string)` | `[]` | no | | [key\_service\_roles\_for\_autoscaling](#input\_key\_service\_roles\_for\_autoscaling) | A list of IAM ARNs for [AWSServiceRoleForAutoScaling roles](https://docs.aws.amazon.com/autoscaling/ec2/userguide/key-policy-requirements-EBS-encryption.html#policy-example-cmk-access) | `list(string)` | `[]` | no | | [key\_service\_users](#input\_key\_service\_users) | A list of IAM ARNs for [key service users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-service-integration) | `list(string)` | `[]` | no | -| [key\_statements](#input\_key\_statements) | A map of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for custom permission usage | `any` | `{}` | no | +| [key\_statements](#input\_key\_statements) | A map of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for custom permission usage | 
list(object({
    sid           = optional(string)
    actions       = optional(list(string))
    not_actions   = optional(list(string))
    effect        = optional(string)
    resources     = optional(list(string))
    not_resources = optional(list(string))
    principals = optional(list(object({
      type        = string
      identifiers = list(string)
    })))
    not_principals = optional(list(object({
      type        = string
      identifiers = list(string)
    })))
    condition = optional(list(object({
      test     = string
      values   = list(string)
      variable = string
    })))
  }))
| `null` | no | | [key\_symmetric\_encryption\_users](#input\_key\_symmetric\_encryption\_users) | A list of IAM ARNs for [key symmetric encryption users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-users-crypto) | `list(string)` | `[]` | no | | [key\_usage](#input\_key\_usage) | Specifies the intended use of the key. Valid values: `ENCRYPT_DECRYPT` or `SIGN_VERIFY`. Defaults to `ENCRYPT_DECRYPT` | `string` | `null` | no | | [key\_users](#input\_key\_users) | A list of IAM ARNs for [key users](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-default-allow-users) | `list(string)` | `[]` | no | @@ -211,8 +211,9 @@ No modules. | [policy](#input\_policy) | A valid policy JSON document. Although this is a key policy, not an IAM policy, an `aws_iam_policy_document`, in the form that designates a principal, can be used | `string` | `null` | no | | [primary\_external\_key\_arn](#input\_primary\_external\_key\_arn) | The primary external key arn of a multi-region replica external key | `string` | `null` | no | | [primary\_key\_arn](#input\_primary\_key\_arn) | The primary key arn of a multi-region replica key | `string` | `null` | no | +| [region](#input\_region) | Region where the resource(s) will be managed. Defaults to the Region set in the provider configuration | `string` | `null` | no | | [rotation\_period\_in\_days](#input\_rotation\_period\_in\_days) | Custom period of time between each rotation date. Must be a number between 90 and 2560 (inclusive) | `number` | `null` | no | -| [route53\_dnssec\_sources](#input\_route53\_dnssec\_sources) | A list of maps containing `account_ids` and Route53 `hosted_zone_arn` that will be allowed to sign DNSSEC records | `list(any)` | `[]` | no | +| [route53\_dnssec\_sources](#input\_route53\_dnssec\_sources) | A list of maps containing `account_ids` and Route53 `hosted_zone_arn` that will be allowed to sign DNSSEC records | 
list(object({
    account_ids     = optional(list(string))
    hosted_zone_arn = optional(string)
  }))
| `null` | no | | [source\_policy\_documents](#input\_source\_policy\_documents) | List of IAM policy documents that are merged together into the exported document. Statements must have unique `sid`s | `list(string)` | `[]` | no | | [tags](#input\_tags) | A map of tags to add to all resources | `map(string)` | `{}` | no | | [valid\_to](#input\_valid\_to) | Time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. If not specified, key material does not expire | `string` | `null` | no | @@ -229,6 +230,7 @@ No modules. | [key\_arn](#output\_key\_arn) | The Amazon Resource Name (ARN) of the key | | [key\_id](#output\_key\_id) | The globally unique identifier for the key | | [key\_policy](#output\_key\_policy) | The IAM resource policy set on the key | +| [key\_region](#output\_key\_region) | The region for the key | ## License diff --git a/examples/complete/README.md b/examples/complete/README.md index 5eb9a53..e612714 100644 --- a/examples/complete/README.md +++ b/examples/complete/README.md @@ -24,14 +24,14 @@ Note that this example may create resources which will incur monetary charges on | Name | Version | |------|---------| -| [terraform](#requirement\_terraform) | >= 1.3 | -| [aws](#requirement\_aws) | >= 5.49 | +| [terraform](#requirement\_terraform) | >= 1.5.7 | +| [aws](#requirement\_aws) | >= 6.0 | ## Providers | Name | Version | |------|---------| -| [aws](#provider\_aws) | >= 5.49 | +| [aws](#provider\_aws) | >= 6.0 | ## Modules @@ -53,7 +53,6 @@ Note that this example may create resources which will incur monetary charges on |------|------| | [aws_iam_role.lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | -| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | ## Inputs diff --git a/examples/complete/main.tf b/examples/complete/main.tf index d03c0bf..34b5c40 100644 --- a/examples/complete/main.tf +++ b/examples/complete/main.tf @@ -2,11 +2,19 @@ provider "aws" { region = local.region } +data "aws_caller_identity" "current" {} + locals { region = "us-east-1" - name = "kms-ex-${replace(basename(path.cwd), "_", "-")}" + region_secondary = "eu-west-1" + name = "kms-ex-${basename(path.cwd)}" + + account_id = data.aws_caller_identity.current.account_id current_identity = data.aws_caller_identity.current.arn + # Removes noise from hh:mm:ss in the timestamp + valid_to = replace(timeadd(plantimestamp(), "4380h"), "/T.*/", "T00:00:00Z") # 6 months + tags = { Name = local.name Example = "complete" @@ -14,9 +22,6 @@ locals { } } -data "aws_caller_identity" "current" {} -data "aws_region" "current" {} - ################################################################################ # KMS Module ################################################################################ @@ -37,7 +42,7 @@ module "kms_complete" { key_administrators = [local.current_identity] key_users = [local.current_identity] key_service_users = [local.current_identity] - key_service_roles_for_autoscaling = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling"] + key_service_roles_for_autoscaling = ["arn:aws:iam::${local.account_id}:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling"] key_symmetric_encryption_users = [local.current_identity] key_hmac_users = [local.current_identity] key_asymmetric_public_encryption_users = [local.current_identity] @@ -57,16 +62,16 @@ module "kms_complete" { principals = [ { type = "Service" - identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"] + identifiers = ["logs.${local.region}.amazonaws.com"] } ] - conditions = [ + condition = [ { test = "ArnLike" variable = "kms:EncryptionContext:aws:logs:arn" values = [ - "arn:aws:logs:${local.region}:${data.aws_caller_identity.current.account_id}:log-group:*", + "arn:aws:logs:${local.region}:${local.account_id}:log-group:*", ] } ] @@ -92,11 +97,11 @@ module "kms_complete" { lambda = { grantee_principal = aws_iam_role.lambda.arn operations = ["Encrypt", "Decrypt", "GenerateDataKey"] - constraints = { + constraints = [{ encryption_context_equals = { Department = "Finance" } - } + }] } } @@ -112,7 +117,7 @@ module "kms_external" { is_enabled = true key_material_base64 = "Wblj06fduthWggmsT0cLVoIMOkeLbc2kVfMud77i/JY=" multi_region = false - valid_to = "2023-11-21T23:20:50Z" + valid_to = local.valid_to tags = local.tags } @@ -129,8 +134,8 @@ module "kms_dnssec_signing" { enable_key_rotation = false route53_dnssec_sources = [ { - accounts_ids = [data.aws_caller_identity.current.account_id] # can ommit if using current account ID which is default - hosted_zone_arn = "arn:aws:route53:::hostedzone/*" # can ommit, this is default value + accounts_ids = [local.account_id] # can ommit if using current account ID which is default + hosted_zone_arn = "arn:aws:route53:::hostedzone/*" # can ommit, this is default value } ] @@ -170,14 +175,11 @@ module "kms_primary" { tags = local.tags } -provider "aws" { - region = "eu-west-1" - alias = "replica" -} - module "kms_replica" { source = "../.." + region = local.region_secondary + deletion_window_in_days = 7 description = "Replica key example showing various configurations available" create_replica = true @@ -206,19 +208,15 @@ module "kms_replica" { lambda = { grantee_principal = aws_iam_role.lambda.arn operations = ["Encrypt", "Decrypt", "GenerateDataKey"] - constraints = { + constraints = [{ encryption_context_equals = { Department = "Finance" } - } + }] } } tags = local.tags - - providers = { - aws = aws.replica - } } ################################################################################ @@ -234,7 +232,7 @@ module "kms_primary_external" { create_external = true key_material_base64 = "Wblj06fduthWggmsT0cLVoIMOkeLbc2kVfMud77i/JY=" multi_region = true - valid_to = "2023-11-21T23:20:50Z" + valid_to = local.valid_to aliases = ["primary-external"] @@ -244,6 +242,8 @@ module "kms_primary_external" { module "kms_replica_external" { source = "../.." + region = local.region_secondary + deletion_window_in_days = 7 description = "Replica external key example showing various configurations available" create_replica_external = true @@ -251,7 +251,7 @@ module "kms_replica_external" { # key material must be the same as the primary's key_material_base64 = "Wblj06fduthWggmsT0cLVoIMOkeLbc2kVfMud77i/JY=" primary_external_key_arn = module.kms_primary_external.key_arn - valid_to = "2023-11-21T23:20:50Z" + valid_to = local.valid_to aliases = ["replica-external"] @@ -260,19 +260,15 @@ module "kms_replica_external" { lambda = { grantee_principal = aws_iam_role.lambda.arn operations = ["Encrypt", "Decrypt", "GenerateDataKey"] - constraints = { + constraints = [{ encryption_context_equals = { Department = "Finance" } - } + }] } } tags = local.tags - - providers = { - aws = aws.replica - } } ################################################################################ diff --git a/examples/complete/outputs.tf b/examples/complete/outputs.tf index a2edbf6..ee5047e 100644 --- a/examples/complete/outputs.tf +++ b/examples/complete/outputs.tf @@ -40,6 +40,7 @@ output "complete_aliases" { output "complete_grants" { description = "A map of grants created and their attributes" value = module.kms_complete.grants + sensitive = true } ################################################################################ @@ -84,6 +85,7 @@ output "external_aliases" { output "external_grants" { description = "A map of grants created and their attributes" value = module.kms_external.grants + sensitive = true } ################################################################################ @@ -128,9 +130,9 @@ output "default_aliases" { output "default_grants" { description = "A map of grants created and their attributes" value = module.kms_default.grants + sensitive = true } - ################################################################################ # Replica ################################################################################ @@ -173,9 +175,9 @@ output "replica_aliases" { output "replica_grants" { description = "A map of grants created and their attributes" value = module.kms_replica.grants + sensitive = true } - ################################################################################ # Replica External ################################################################################ @@ -218,4 +220,5 @@ output "replica_external_aliases" { output "replica_external_grants" { description = "A map of grants created and their attributes" value = module.kms_replica_external.grants + sensitive = true } diff --git a/examples/complete/versions.tf b/examples/complete/versions.tf index f96e1b1..db13b0a 100644 --- a/examples/complete/versions.tf +++ b/examples/complete/versions.tf @@ -1,10 +1,10 @@ terraform { - required_version = ">= 1.3" + required_version = ">= 1.5.7" required_providers { aws = { source = "hashicorp/aws" - version = ">= 5.49" + version = ">= 6.0" } } } diff --git a/main.tf b/main.tf index 819de11..e724cb8 100644 --- a/main.tf +++ b/main.tf @@ -18,6 +18,8 @@ locals { resource "aws_kms_key" "this" { count = var.create && !var.create_external && !var.create_replica && !var.create_replica_external ? 1 : 0 + region = var.region + bypass_policy_lockout_safety_check = var.bypass_policy_lockout_safety_check customer_master_key_spec = var.customer_master_key_spec custom_key_store_id = var.custom_key_store_id @@ -40,6 +42,8 @@ resource "aws_kms_key" "this" { resource "aws_kms_external_key" "this" { count = var.create && var.create_external && !var.create_replica && !var.create_replica_external ? 1 : 0 + region = var.region + bypass_policy_lockout_safety_check = var.bypass_policy_lockout_safety_check deletion_window_in_days = var.deletion_window_in_days description = var.description @@ -59,6 +63,8 @@ resource "aws_kms_external_key" "this" { resource "aws_kms_replica_key" "this" { count = var.create && var.create_replica && !var.create_external && !var.create_replica_external ? 1 : 0 + region = var.region + bypass_policy_lockout_safety_check = var.bypass_policy_lockout_safety_check deletion_window_in_days = var.deletion_window_in_days description = var.description @@ -76,6 +82,8 @@ resource "aws_kms_replica_key" "this" { resource "aws_kms_replica_external_key" "this" { count = var.create && !var.create_replica && !var.create_external && var.create_replica_external ? 1 : 0 + region = var.region + bypass_policy_lockout_safety_check = var.bypass_policy_lockout_safety_check deletion_window_in_days = var.deletion_window_in_days description = var.description @@ -379,40 +387,40 @@ data "aws_iam_policy_document" "this" { } dynamic "condition" { - for_each = var.route53_dnssec_sources + for_each = var.route53_dnssec_sources != null ? var.route53_dnssec_sources : [] content { test = "StringEquals" variable = "aws:SourceAccount" - values = try(condition.value.account_ids, [local.account_id]) + values = coalescelist(condition.value.account_ids, [local.account_id]) } } dynamic "condition" { - for_each = var.route53_dnssec_sources + for_each = var.route53_dnssec_sources != null ? var.route53_dnssec_sources : [] content { test = "ArnLike" variable = "aws:SourceArn" - values = [try(condition.value.hosted_zone_arn, "arn:${local.partition}:route53:::hostedzone/*")] + values = [coalesce(condition.value.hosted_zone_arn, "arn:${local.partition}:route53:::hostedzone/*")] } } } } dynamic "statement" { - for_each = var.key_statements + for_each = var.key_statements != null ? var.key_statements : [] content { - sid = try(statement.value.sid, null) - actions = try(statement.value.actions, null) - not_actions = try(statement.value.not_actions, null) - effect = try(statement.value.effect, null) - resources = try(statement.value.resources, null) - not_resources = try(statement.value.not_resources, null) + sid = statement.value.sid + actions = statement.value.actions + not_actions = statement.value.not_actions + effect = statement.value.effect + resources = statement.value.resources + not_resources = statement.value.not_resources dynamic "principals" { - for_each = try(statement.value.principals, []) + for_each = statement.value.principals != null ? statement.value.principals : [] content { type = principals.value.type @@ -421,7 +429,7 @@ data "aws_iam_policy_document" "this" { } dynamic "not_principals" { - for_each = try(statement.value.not_principals, []) + for_each = statement.value.not_principals != null ? statement.value.not_principals : [] content { type = not_principals.value.type @@ -430,7 +438,7 @@ data "aws_iam_policy_document" "this" { } dynamic "condition" { - for_each = try(statement.value.conditions, []) + for_each = statement.value.condition != null ? statement.value.condition : [] content { test = condition.value.test @@ -453,6 +461,8 @@ locals { resource "aws_kms_alias" "this" { for_each = { for k, v in merge(local.aliases, var.computed_aliases) : k => v if var.create } + region = var.region + name = var.aliases_use_name_prefix ? null : "alias/${each.value.name}" name_prefix = var.aliases_use_name_prefix ? "alias/${each.value.name}-" : null target_key_id = try(aws_kms_key.this[0].key_id, aws_kms_external_key.this[0].id, aws_kms_replica_key.this[0].key_id, aws_kms_replica_external_key.this[0].key_id) @@ -463,23 +473,24 @@ resource "aws_kms_alias" "this" { ################################################################################ resource "aws_kms_grant" "this" { - for_each = { for k, v in var.grants : k => v if var.create } + for_each = var.create && var.grants != null ? var.grants : {} - name = try(each.value.name, each.key) - key_id = try(aws_kms_key.this[0].key_id, aws_kms_external_key.this[0].id, aws_kms_replica_key.this[0].key_id, aws_kms_replica_external_key.this[0].key_id) - grantee_principal = each.value.grantee_principal - operations = each.value.operations + region = var.region dynamic "constraints" { - for_each = length(lookup(each.value, "constraints", {})) == 0 ? [] : [each.value.constraints] + for_each = each.value.constraints != null ? each.value.constraints : [] content { - encryption_context_equals = try(constraints.value.encryption_context_equals, null) - encryption_context_subset = try(constraints.value.encryption_context_subset, null) + encryption_context_equals = constraints.value.encryption_context_equals + encryption_context_subset = constraints.value.encryption_context_subset } } - retiring_principal = try(each.value.retiring_principal, null) - grant_creation_tokens = try(each.value.grant_creation_tokens, null) - retire_on_delete = try(each.value.retire_on_delete, null) + grant_creation_tokens = each.value.grant_creation_tokens + grantee_principal = each.value.grantee_principal + key_id = try(aws_kms_key.this[0].key_id, aws_kms_external_key.this[0].id, aws_kms_replica_key.this[0].key_id, aws_kms_replica_external_key.this[0].key_id) + name = coalesce(each.value.name, each.key) + operations = each.value.operations + retire_on_delete = each.value.retire_on_delete + retiring_principal = each.value.retiring_principal } diff --git a/outputs.tf b/outputs.tf index d002a3c..dd73e78 100644 --- a/outputs.tf +++ b/outputs.tf @@ -12,6 +12,11 @@ output "key_id" { value = try(aws_kms_key.this[0].key_id, aws_kms_external_key.this[0].id, aws_kms_replica_key.this[0].key_id, aws_kms_replica_external_key.this[0].key_id, null) } +output "key_region" { + description = "The region for the key" + value = try(aws_kms_key.this[0].region, aws_kms_external_key.this[0].region, aws_kms_replica_key.this[0].region, aws_kms_replica_external_key.this[0].region, null) +} + output "key_policy" { description = "The IAM resource policy set on the key" value = try(aws_kms_key.this[0].policy, aws_kms_external_key.this[0].policy, aws_kms_replica_key.this[0].policy, aws_kms_replica_external_key.this[0].policy, null) diff --git a/variables.tf b/variables.tf index b66b126..60e7983 100644 --- a/variables.tf +++ b/variables.tf @@ -4,6 +4,12 @@ variable "create" { default = true } +variable "region" { + description = "Region where the resource(s) will be managed. Defaults to the Region set in the provider configuration" + type = string + default = null +} + variable "tags" { description = "A map of tags to add to all resources" type = map(string) @@ -154,8 +160,28 @@ variable "key_asymmetric_sign_verify_users" { variable "key_statements" { description = "A map of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for custom permission usage" - type = any - default = {} + type = list(object({ + sid = optional(string) + actions = optional(list(string)) + not_actions = optional(list(string)) + effect = optional(string) + resources = optional(list(string)) + not_resources = optional(list(string)) + principals = optional(list(object({ + type = string + identifiers = list(string) + }))) + not_principals = optional(list(object({ + type = string + identifiers = list(string) + }))) + condition = optional(list(object({ + test = string + values = list(string) + variable = string + }))) + })) + default = null } variable "source_policy_documents" { @@ -178,8 +204,11 @@ variable "enable_route53_dnssec" { variable "route53_dnssec_sources" { description = "A list of maps containing `account_ids` and Route53 `hosted_zone_arn` that will be allowed to sign DNSSEC records" - type = list(any) - default = [] + type = list(object({ + account_ids = optional(list(string)) + hosted_zone_arn = optional(string) + })) + default = null } variable "rotation_period_in_days" { @@ -232,8 +261,10 @@ variable "aliases" { variable "computed_aliases" { description = "A map of aliases to create. Values provided via the `name` key of the map can be computed from upstream resources" - type = any - default = {} + type = map(object({ + name = string + })) + default = {} } variable "aliases_use_name_prefix" { @@ -248,6 +279,17 @@ variable "aliases_use_name_prefix" { variable "grants" { description = "A map of grant definitions to create" - type = any - default = {} + type = map(object({ + constraints = optional(list(object({ + encryption_context_equals = optional(map(string)) + encryption_context_subset = optional(map(string)) + }))) + grant_creation_tokens = optional(list(string)) + grantee_principal = string + name = optional(string) # Will fall back to use map key + operations = list(string) + retire_on_delete = optional(bool) + retiring_principal = optional(string) + })) + default = null } diff --git a/versions.tf b/versions.tf index f96e1b1..db13b0a 100644 --- a/versions.tf +++ b/versions.tf @@ -1,10 +1,10 @@ terraform { - required_version = ">= 1.3" + required_version = ">= 1.5.7" required_providers { aws = { source = "hashicorp/aws" - version = ">= 5.49" + version = ">= 6.0" } } } diff --git a/wrappers/main.tf b/wrappers/main.tf index 6e2ebca..2a5e231 100644 --- a/wrappers/main.tf +++ b/wrappers/main.tf @@ -18,7 +18,7 @@ module "wrapper" { enable_default_policy = try(each.value.enable_default_policy, var.defaults.enable_default_policy, true) enable_key_rotation = try(each.value.enable_key_rotation, var.defaults.enable_key_rotation, true) enable_route53_dnssec = try(each.value.enable_route53_dnssec, var.defaults.enable_route53_dnssec, false) - grants = try(each.value.grants, var.defaults.grants, {}) + grants = try(each.value.grants, var.defaults.grants, null) is_enabled = try(each.value.is_enabled, var.defaults.is_enabled, null) key_administrators = try(each.value.key_administrators, var.defaults.key_administrators, []) key_asymmetric_public_encryption_users = try(each.value.key_asymmetric_public_encryption_users, var.defaults.key_asymmetric_public_encryption_users, []) @@ -28,7 +28,7 @@ module "wrapper" { key_owners = try(each.value.key_owners, var.defaults.key_owners, []) key_service_roles_for_autoscaling = try(each.value.key_service_roles_for_autoscaling, var.defaults.key_service_roles_for_autoscaling, []) key_service_users = try(each.value.key_service_users, var.defaults.key_service_users, []) - key_statements = try(each.value.key_statements, var.defaults.key_statements, {}) + key_statements = try(each.value.key_statements, var.defaults.key_statements, null) key_symmetric_encryption_users = try(each.value.key_symmetric_encryption_users, var.defaults.key_symmetric_encryption_users, []) key_usage = try(each.value.key_usage, var.defaults.key_usage, null) key_users = try(each.value.key_users, var.defaults.key_users, []) @@ -37,8 +37,9 @@ module "wrapper" { policy = try(each.value.policy, var.defaults.policy, null) primary_external_key_arn = try(each.value.primary_external_key_arn, var.defaults.primary_external_key_arn, null) primary_key_arn = try(each.value.primary_key_arn, var.defaults.primary_key_arn, null) + region = try(each.value.region, var.defaults.region, null) rotation_period_in_days = try(each.value.rotation_period_in_days, var.defaults.rotation_period_in_days, null) - route53_dnssec_sources = try(each.value.route53_dnssec_sources, var.defaults.route53_dnssec_sources, []) + route53_dnssec_sources = try(each.value.route53_dnssec_sources, var.defaults.route53_dnssec_sources, null) source_policy_documents = try(each.value.source_policy_documents, var.defaults.source_policy_documents, []) tags = try(each.value.tags, var.defaults.tags, {}) valid_to = try(each.value.valid_to, var.defaults.valid_to, null) diff --git a/wrappers/versions.tf b/wrappers/versions.tf index f96e1b1..db13b0a 100644 --- a/wrappers/versions.tf +++ b/wrappers/versions.tf @@ -1,10 +1,10 @@ terraform { - required_version = ">= 1.3" + required_version = ">= 1.5.7" required_providers { aws = { source = "hashicorp/aws" - version = ">= 5.49" + version = ">= 6.0" } } }