Skip to content

Commit 1e7ccd7

Browse files
bryantbiggsbryantbiggs
committed
feat: Initial implementation of Secrets Manager Terraform module 🎉
1 parent 6114fa5 commit 1e7ccd7

File tree

10 files changed

+809
-22
lines changed

10 files changed

+809
-22
lines changed

‎.gitignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,3 +35,6 @@ override.tf.json
3535
# Ignore CLI configuration files
3636
.terraformrc
3737
terraform.rc
38+
39+
# Lambda
40+
builds/

‎README.md

Lines changed: 128 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,59 +2,176 @@
22

33
Terraform module which creates AWS Secrets Manager resources.
44

5+
[![SWUbanner](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/banner2-direct.svg)](https://github.com/vshymanskyy/StandWithUkraine/blob/main/docs/README.md)
6+
57
## Usage
68

7-
See [`examples`](https://github.com/clowdhaus/terraform-aws-secrets-manager/tree/main/examples) directory for working examples to reference:
9+
See [`examples`](https://github.com/terraform-aws-modules/terraform-aws-secrets-manager/tree/master/examples) directory for working examples to reference:
10+
11+
### Standard
12+
13+
```hcl
14+
module "secrets_manager" {
15+
source = "terraform-aws-modules/secrets-manager/aws"
16+
17+
# Secret
18+
name_prefix = "example"
19+
description = "Example Secrets Manager secret"
20+
recovery_window_in_days = 30
21+
22+
# Policy
23+
create_policy = true
24+
block_public_policy = true
25+
policy_statements = {
26+
read = {
27+
sid = "AllowAccountRead"
28+
principals = [{
29+
type = "AWS"
30+
identifiers = ["arn:aws:iam::1234567890:root"]
31+
}]
32+
actions = ["secretsmanager:GetSecretValue"]
33+
resources = ["*"]
34+
}
35+
}
36+
37+
# Version
38+
secret_string = "ThisIsMySuperSecretString12356!&*()"
39+
40+
tags = {
41+
Environment = "Development"
42+
Project = "Example"
43+
}
44+
}
45+
```
46+
47+
### w/ Rotation
848

949
```hcl
1050
module "secrets_manager" {
11-
source = "clowdhaus/secrets-manager/aws"
51+
source = "terraform-aws-modules/secrets-manager/aws"
52+
53+
# Secret
54+
name_prefix = "rotated-example"
55+
description = "Rotated example Secrets Manager secret"
56+
recovery_window_in_days = 7
57+
58+
# Policy
59+
create_policy = true
60+
block_public_policy = true
61+
policy_statements = {
62+
read = {
63+
sid = "LambdaReadWrite"
64+
principals = [{
65+
type = "AWS"
66+
identifiers = ["arn:aws:lambda:us-east-1:123456789012:function:my-function"]
67+
}]
68+
actions = [
69+
"secretsmanager:DescribeSecret",
70+
"secretsmanager:GetSecretValue",
71+
"secretsmanager:PutSecretValue",
72+
"secretsmanager:UpdateSecretVersionStage",
73+
]
74+
resources = ["*"]
75+
}
76+
}
77+
78+
# Version
79+
ignore_secret_changes = true
80+
secret_string = jsonencode({
81+
engine = "mariadb",
82+
host = "mydb.cluster-123456789012.us-east-1.rds.amazonaws.com",
83+
username = "Bill",
84+
password = "Initial"
85+
dbname = "ThisIsMySuperSecretString12356!&*()",
86+
port = 3306
87+
})
88+
89+
# Rotation
90+
enable_rotation = true
91+
rotation_lambda_arn = "arn:aws:lambda:us-east-1:123456789012:function:my-function"
92+
rotation_rules = {
93+
# This should be more sensible in production
94+
schedule_expression = "rate(1 minute)"
95+
}
1296
1397
tags = {
14-
Terraform = "true"
15-
Environment = "dev"
98+
Environment = "Development"
99+
Project = "Example"
16100
}
17101
}
18102
```
19103

20104
## Examples
21105

22-
Examples codified under the [`examples`](https://github.com/clowdhaus/terraform-aws-secrets-manager/tree/main/examples) are intended to give users references for how to use the module(s) as well as testing/validating changes to the source code of the module. If contributing to the project, please be sure to make any appropriate updates to the relevant examples to allow maintainers to test your changes and to keep the examples up to date for users. Thank you!
106+
Examples codified under the [`examples`](https://github.com/terraform-aws-modules/terraform-aws-secrets-manager/tree/master/examples) are intended to give users references for how to use the module(s) as well as testing/validating changes to the source code of the module. If contributing to the project, please be sure to make any appropriate updates to the relevant examples to allow maintainers to test your changes and to keep the examples up to date for users. Thank you!
23107

24-
- [Complete](https://github.com/clowdhaus/terraform-aws-secrets-manager/tree/main/examples/complete)
108+
- [Complete](https://github.com/terraform-aws-modules/terraform-aws-secrets-manager/tree/master/examples/complete)
25109

26110
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
27111
## Requirements
28112

29113
| Name | Version |
30114
|------|---------|
31115
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
32-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.0 |
116+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.0 |
33117

34118
## Providers
35119

36-
No providers.
120+
| Name | Version |
121+
|------|---------|
122+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.0 |
37123

38124
## Modules
39125

40126
No modules.
41127

42128
## Resources
43129

44-
No resources.
130+
| Name | Type |
131+
|------|------|
132+
| [aws_secretsmanager_secret.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource |
133+
| [aws_secretsmanager_secret_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_policy) | resource |
134+
| [aws_secretsmanager_secret_rotation.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_rotation) | resource |
135+
| [aws_secretsmanager_secret_version.ignore_changes](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_version) | resource |
136+
| [aws_secretsmanager_secret_version.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_version) | resource |
137+
| [aws_iam_policy_document.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
45138

46139
## Inputs
47140

48141
| Name | Description | Type | Default | Required |
49142
|------|-------------|------|---------|:--------:|
143+
| <a name="input_block_public_policy"></a> [block\_public\_policy](#input\_block\_public\_policy) | Makes an optional API call to Zelkova to validate the Resource Policy to prevent broad access to your secret | `bool` | `null` | no |
50144
| <a name="input_create"></a> [create](#input\_create) | Determines whether resources will be created (affects all resources) | `bool` | `true` | no |
145+
| <a name="input_create_policy"></a> [create\_policy](#input\_create\_policy) | Determines whether a policy will be created | `bool` | `false` | no |
146+
| <a name="input_description"></a> [description](#input\_description) | A description of the secret | `string` | `null` | no |
147+
| <a name="input_enable_rotation"></a> [enable\_rotation](#input\_enable\_rotation) | Determines whether secret rotation is enabled | `bool` | `false` | no |
148+
| <a name="input_force_overwrite_replica_secret"></a> [force\_overwrite\_replica\_secret](#input\_force\_overwrite\_replica\_secret) | Accepts boolean value to specify whether to overwrite a secret with the same name in the destination Region | `bool` | `null` | no |
149+
| <a name="input_ignore_secret_changes"></a> [ignore\_secret\_changes](#input\_ignore\_secret\_changes) | Determines whether or not Terraform will ignore changes made externally to `secret_string` or `secret_binary`. Changing this value after creation is a destructive operation | `bool` | `false` | no |
150+
| <a name="input_kms_key_id"></a> [kms\_key\_id](#input\_kms\_key\_id) | ARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named `aws/secretsmanager` | `string` | `null` | no |
151+
| <a name="input_name"></a> [name](#input\_name) | Friendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: `/_+=.@-` | `string` | `null` | no |
152+
| <a name="input_name_prefix"></a> [name\_prefix](#input\_name\_prefix) | Creates a unique name beginning with the specified prefix | `string` | `null` | no |
153+
| <a name="input_override_policy_documents"></a> [override\_policy\_documents](#input\_override\_policy\_documents) | List of IAM policy documents that are merged together into the exported document. In merging, statements with non-blank `sid`s will override statements with the same `sid` | `list(string)` | `[]` | no |
154+
| <a name="input_policy_statements"></a> [policy\_statements](#input\_policy\_statements) | A map of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for custom permission usage | `any` | `{}` | no |
155+
| <a name="input_recovery_window_in_days"></a> [recovery\_window\_in\_days](#input\_recovery\_window\_in\_days) | Number of days that AWS Secrets Manager waits before it can delete the secret. This value can be `0` to force deletion without recovery or range from `7` to `30` days. The default value is `30` | `number` | `null` | no |
156+
| <a name="input_replica"></a> [replica](#input\_replica) | Configuration block to support secret replication | `any` | `{}` | no |
157+
| <a name="input_rotation_lambda_arn"></a> [rotation\_lambda\_arn](#input\_rotation\_lambda\_arn) | Specifies the ARN of the Lambda function that can rotate the secret | `string` | `""` | no |
158+
| <a name="input_rotation_rules"></a> [rotation\_rules](#input\_rotation\_rules) | A structure that defines the rotation configuration for this secret | `any` | `{}` | no |
159+
| <a name="input_secret_binary"></a> [secret\_binary](#input\_secret\_binary) | Specifies binary data that you want to encrypt and store in this version of the secret. This is required if `secret_string` is not set. Needs to be encoded to base64 | `string` | `null` | no |
160+
| <a name="input_secret_string"></a> [secret\_string](#input\_secret\_string) | Specifies text data that you want to encrypt and store in this version of the secret. This is required if `secret_binary` is not set | `string` | `null` | no |
161+
| <a name="input_source_policy_documents"></a> [source\_policy\_documents](#input\_source\_policy\_documents) | List of IAM policy documents that are merged together into the exported document. Statements must have unique `sid`s | `list(string)` | `[]` | no |
51162
| <a name="input_tags"></a> [tags](#input\_tags) | A map of tags to add to all resources | `map(string)` | `{}` | no |
163+
| <a name="input_version_stages"></a> [version\_stages](#input\_version\_stages) | Specifies a list of staging labels that are attached to this version of the secret. A staging label must be unique to a single version of the secret | `list(string)` | `null` | no |
52164

53165
## Outputs
54166

55-
No outputs.
167+
| Name | Description |
168+
|------|-------------|
169+
| <a name="output_secret_arn"></a> [secret\_arn](#output\_secret\_arn) | The ARN of the secret |
170+
| <a name="output_secret_id"></a> [secret\_id](#output\_secret\_id) | The ID of the secret |
171+
| <a name="output_secret_replica"></a> [secret\_replica](#output\_secret\_replica) | Attributes of the replica created |
172+
| <a name="output_secret_version_id"></a> [secret\_version\_id](#output\_secret\_version\_id) | The unique identifier of the version of the secret |
56173
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
57174

58175
## License
59176

60-
Apache-2.0 Licensed. See [LICENSE](https://github.com/clowdhaus/terraform-aws-secrets-manager/blob/main/LICENSE).
177+
Apache-2.0 Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-aws-secrets-manager/blob/master/LICENSE).

‎examples/complete/README.md

Lines changed: 28 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@
22

33
Configuration in this directory creates:
44

5-
- <XXX>
5+
- Standard Secrets Manager Secret
6+
- Secrets Manager Secret with rotation enabled
67

78
## Usage
89

@@ -14,6 +15,12 @@ $ terraform plan
1415
$ terraform apply
1516
```
1617

18+
If you wish to test the rotated secret, after provisioning the resources you can go into the console and under the rotated secret click `Rotate secret immediately`. This will trigger the lambda function to rotate the secret. You can then go to the `Secret value` tab and click `Retrieve secret value` to see the new secret value.
19+
20+
After rotating the secret, you can run `terraform plan` and see that there are no detected changes.
21+
22+
:warning: Replicated secrets are not cleaned up by Terraform. You will need to manually delete these secrets. Ref: https://github.com/hashicorp/terraform-provider-aws/issues/23316
23+
1724
Note that this example may create resources which will incur monetary charges on your AWS bill. Run `terraform destroy` when you no longer need these resources.
1825

1926
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
@@ -26,26 +33,42 @@ Note that this example may create resources which will incur monetary charges on
2633

2734
## Providers
2835

29-
No providers.
36+
| Name | Version |
37+
|------|---------|
38+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.0 |
3039

3140
## Modules
3241

3342
| Name | Source | Version |
3443
|------|--------|---------|
44+
| <a name="module_lambda"></a> [lambda](#module\_lambda) | terraform-aws-modules/lambda/aws | ~> 5.0 |
3545
| <a name="module_secrets_manager"></a> [secrets\_manager](#module\_secrets\_manager) | ../.. | n/a |
3646
| <a name="module_secrets_manager_disabled"></a> [secrets\_manager\_disabled](#module\_secrets\_manager\_disabled) | ../.. | n/a |
47+
| <a name="module_secrets_manager_rotate"></a> [secrets\_manager\_rotate](#module\_secrets\_manager\_rotate) | ../.. | n/a |
3748

3849
## Resources
3950

40-
No resources.
51+
| Name | Type |
52+
|------|------|
53+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
54+
| [aws_iam_policy_document.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
4155

4256
## Inputs
4357

4458
No inputs.
4559

4660
## Outputs
4761

48-
No outputs.
62+
| Name | Description |
63+
|------|-------------|
64+
| <a name="output_rotate_secret_arn"></a> [rotate\_secret\_arn](#output\_rotate\_secret\_arn) | The ARN of the secret |
65+
| <a name="output_rotate_secret_id"></a> [rotate\_secret\_id](#output\_rotate\_secret\_id) | The ID of the secret |
66+
| <a name="output_rotate_secret_replica"></a> [rotate\_secret\_replica](#output\_rotate\_secret\_replica) | Attributes of the replica created |
67+
| <a name="output_rotate_secret_version_id"></a> [rotate\_secret\_version\_id](#output\_rotate\_secret\_version\_id) | The unique identifier of the version of the secret |
68+
| <a name="output_standard_secret_arn"></a> [standard\_secret\_arn](#output\_standard\_secret\_arn) | The ARN of the secret |
69+
| <a name="output_standard_secret_id"></a> [standard\_secret\_id](#output\_standard\_secret\_id) | The ID of the secret |
70+
| <a name="output_standard_secret_replica"></a> [standard\_secret\_replica](#output\_standard\_secret\_replica) | Attributes of the replica created |
71+
| <a name="output_standard_secret_version_id"></a> [standard\_secret\_version\_id](#output\_standard\_secret\_version\_id) | The unique identifier of the version of the secret |
4972
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
5073

51-
Apache-2.0 Licensed. See [LICENSE](https://github.com/clowdhaus/terraform-aws-secrets-manager/blob/main/LICENSE).
74+
Apache-2.0 Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-aws-secrets-manager/blob/master/LICENSE).

0 commit comments

Comments
 (0)