Terraform TLS SSH key pair to SSM initial implementation #2
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
aknysh
reviewed
Jan 10, 2019
LICENSE
Outdated
| @@ -186,7 +186,7 @@ | |||
| same "printed page" as the copyright notice for easier | |||
| identification within third-party archives. | |||
|
|
|||
| Copyright [yyyy] [name of copyright owner] | |||
| Copyright 2018 Cloud Posse, LLC | |||
There was a problem hiding this comment.
Suggested change
| Copyright 2018 Cloud Posse, LLC | |
| Copyright 2019 Cloud Posse, LLC |
aknysh
reviewed
Jan 10, 2019
aknysh
reviewed
Jan 10, 2019
aknysh
reviewed
Jan 10, 2019
aknysh
reviewed
Jan 10, 2019
aknysh
reviewed
Jan 10, 2019
aknysh
reviewed
Jan 10, 2019
aknysh
reviewed
Jan 10, 2019
aknysh
reviewed
Jan 10, 2019
aknysh
reviewed
Jan 10, 2019
main.tf
Outdated
| name = "${local.ssh_private_key_ssm_path}" | ||
| description = "TLS Private Key" | ||
| type = "SecureString" | ||
| value = "${tls_private_key.default_rsa.private_key_pem}" |
There was a problem hiding this comment.
Suggested change
| value = "${tls_private_key.default_rsa.private_key_pem}" | |
| value = "${join("", tls_private_key.default_rsa.*.private_key_pem)}" |
aknysh
reviewed
Jan 10, 2019
main.tf
Outdated
| name = "${local.ssh_public_key_ssm_path}" | ||
| description = "TLS Public Key (OpenSSH - ${var.ssh_key_algorithm})" | ||
| type = "String" | ||
| value = "${tls_private_key.default_rsa.public_key_openssh}" |
There was a problem hiding this comment.
Suggested change
| value = "${tls_private_key.default_rsa.public_key_openssh}" | |
| value = "${join("", tls_private_key.default_rsa.*.public_key_openssh)}" |
aknysh
reviewed
Jan 10, 2019
main.tf
Outdated
| name = "${local.ssh_private_key_ssm_path}" | ||
| description = "TLS Private Key (${var.ssh_key_algorithm})" | ||
| type = "SecureString" | ||
| value = "${tls_private_key.default_ecdsa.private_key_pem}" |
There was a problem hiding this comment.
Suggested change
| value = "${tls_private_key.default_ecdsa.private_key_pem}" | |
| value = "${join("", tls_private_key.default_ecdsa.*.private_key_pem)}" |
aknysh
reviewed
Jan 10, 2019
main.tf
Outdated
| name = "${local.ssh_public_key_ssm_path}" | ||
| description = "TLS Public Key (${var.ssh_key_algorithm})" | ||
| type = "String" | ||
| value = "${tls_private_key.default_ecdsa.public_key_openssh}" |
There was a problem hiding this comment.
Suggested change
| value = "${tls_private_key.default_ecdsa.public_key_openssh}" | |
| value = "${join("", tls_private_key.default_ecdsa.*.public_key_openssh)}" |
aknysh
reviewed
Jan 10, 2019
variables.tf
Outdated
| @@ -0,0 +1,73 @@ | |||
| variable "namespace" { | |||
| type = "string" | |||
| description = "Namespace (e.g. `cp` or `cloudposse`)" | |||
There was a problem hiding this comment.
Suggested change
| description = "Namespace (e.g. `cp` or `cloudposse`)" | |
| description = "Namespace (e.g. `eg` or `cp`)" |
|
@aknysh Have rebased and pushed requested changes, thanks! |
|
@osterman KMS key added and rebased |
joshmyers
force-pushed
the
init_v2
branch
2 times, most recently
from
19df679 to
a0b3d84
Compare
This commit adds some default variables and locals for naming of SSM params. We expect SSM params to be written in the form `/foo/bar` or `/foo/bar_badger` where foo is var.ssm_path_prefix and bar is passed in explicitly, or else we default to label.id where we replace the delimiter with underscores to maintain consistency. Both RSA + ECDSA key algo’s are supported.
osterman
approved these changes
Jan 10, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
what
This PR is an initial implementation for writing SSH keys to AWS SSM parameter store. It supports both RSA and ECDSA key algos and enforces a convention on how these keys should be written to SSM, name
/foo/baror/foo/bar_badger. If no key name is given for public/private SSH keys, the label module is used, but the delimiter is forced to be underscore for consistency e.g./ssh_keys/cpco_testing_$app_public_key. This can be useful for namespacing SSM IAM permissions when for multiple keys in the same account.why
Rather than mounting an s3 based file system using goofys for secrets, we should write them into SSM, to be fetched by chamber.
notes
Fixes #1