terraform-aws-concourse-keys-s3

Terraform module for deploying Concourse TLS / SSH keys to S3.

Usage

TODO

Makefile Targets

Available targets:

  help                                Help screen
  help/all                            Display help for all targets
  help/short                          This help short screen

Requirements

Name	Version
terraform	~> 0.14.0
aws	~> 3.32
external	~> 2.1
http	~> 2.0
local	~> 2.0
template	~> 2.2
utils	~> 0.3

Providers

Name	Version
aws	~> 3.32
tls	n/a

Modules

Name	Source	Version
this	cloudposse/label/null	0.24.1

Resources

Name	Type
aws_iam_role.keys	resource
aws_iam_role_policy.concourse_keys_cross_account	resource
aws_s3_bucket.keys	resource
aws_s3_bucket_object.authorized_worker_keys	resource
aws_s3_bucket_object.session_signing_key	resource
aws_s3_bucket_object.session_signing_pub_key	resource
aws_s3_bucket_object.tsa_host_key	resource
aws_s3_bucket_object.tsa_host_pub_key	resource
aws_s3_bucket_object.worker_key	resource
aws_s3_bucket_object.worker_pub_key	resource
aws_s3_bucket_policy.keys	resource
tls_private_key.session_signing	resource
tls_private_key.tsa_host	resource
tls_private_key.worker	resource
aws_iam_policy_document.assume_role	data source
aws_iam_policy_document.cross_account	data source

Inputs

Name	Description	Type	Default	Required
additional_tag_map	Additional tags for appending to tags_as_list_of_maps. Not added to `tags`.	`map(string)`	`{}`	no
attributes	Additional attributes (e.g. `1`)	`list(string)`	`[]`	no
bucket_force_destroy	A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable	`bool`	`false`	no
context	Single object for setting entire context at once. See description of individual variables for details. Leave string and numeric variables as `null` to use default value. Individual variable settings (non-null) override settings in context object, except for attributes, tags, and additional_tag_map, which are merged.	object({ enabled = bool namespace = string environment = string stage = string name = string delimiter = string attributes = list(string) tags = map(string) additional_tag_map = map(string) regex_replace_chars = string label_order = list(string) id_length_limit = number })	{ "additional_tag_map": {}, "attributes": [], "delimiter": null, "enabled": true, "environment": null, "id_length_limit": null, "label_order": [], "name": null, "namespace": null, "regex_replace_chars": null, "stage": null, "tags": {} }	no
delimiter	Delimiter to be used between `namespace`, `environment`, `stage`, `name` and `attributes`. Defaults to `-` (hyphen). Set to `""` to use no delimiter at all.	`string`	`null`	no
enabled	Set to false to prevent the module from creating any resources	`bool`	`null`	no
environment	Environment, e.g. 'uw2', 'us-west-2', OR 'prod', 'staging', 'dev', 'UAT'	`string`	`null`	no
generate_keys	If set to `true` this module will generate the necessary RSA keys with the `tls_private_key` resource and upload them to S3 (server-side encrypted). Be aware that this will store the generated unencrypted keys in the Terraform state, so be sure to use a secure state backend (e.g. S3 encrypted), or set this to `false` and generate the keys manually	`string`	`true`	no
id_length_limit	Limit `id` to this many characters. Set to `0` for unlimited length. Set to `null` for default, which is `0`. Does not affect `id_full`.	`number`	`null`	no
keys_version	Change this if you want to re-generate Concourse keys	`string`	`"1"`	no
label_order	The naming order of the id output and Name tag. Defaults to ["namespace", "environment", "stage", "name", "attributes"]. You can omit any of the 5 elements, but at least one must be present.	`list(string)`	`null`	no
name	Solution name, e.g. 'app' or 'jenkins'	`string`	`null`	no
namespace	Namespace, which could be your organization name or abbreviation, e.g. 'eg' or 'cp'	`string`	`null`	no
regex_replace_chars	Regex to replace chars with empty string in `namespace`, `environment`, `stage` and `name`. If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits.	`string`	`null`	no
stage	Stage, e.g. 'prod', 'staging', 'dev', OR 'source', 'build', 'test', 'deploy', 'release'	`string`	`null`	no
tags	Additional tags (e.g. `map('BusinessUnit','XYZ')`	`map(string)`	`{}`	no
worker_iam_role_arns	List of ARNs for the IAM roles that will be able to assume the role to access concourse keys in S3. Normally you'll include the Concourse worker IAM role here	`list(string)`	n/a	yes

Outputs

Name	Description
bucket_arn	The ARN of the S3 bucket where the concourse keys are stored
bucket_id	The id (name) of the S3 bucket where the concourse keys are stored
cross_account_role_arn	IAM role ARN that Concourse workers on other AWS accounts will need to assume to access the Concourse keys bucket

Related Projects

Check out these related projects.

terraform-aws-concourse-web - Terraform module for deploying Concourse on ECS
terraform-aws-concourse-ec2-worker - Terraform module for deploying a Concourse EC2 worker ASG
terraform-aws-concourse-sidecred-lambda - Terraform module to create a sidecred lambda for injecting and rotating credentials into SSM
terraform-root-modules - Terraform root modules to provision top level account

Contributing

Bug Reports & Feature Requests

Please use the issue tracker to report any bugs or file feature requests.

Developing

In general, PRs are welcome. We follow the typical "fork-and-pull" Git workflow.

Fork the repo on GitHub
Clone the project to your own machine
Commit changes to your own branch
Push your work back up to your fork
Submit a Pull Request so that we can review your changes

NOTE: Be sure to merge the latest changes from "upstream" before making a pull request!

Copyrights

Trademarks

All other trademarks referenced herein are the property of their respective owners.

About

This project is maintained and funded by Carnegie Robotics, LLC.

carnegierobotics/terraform-aws-concourse-keys-s3