From bb380b0cb14bd0b85e34d6d18d6adccc0d23e557 Mon Sep 17 00:00:00 2001 From: Archit Chopra Date: Fri, 11 Aug 2023 20:58:12 +0530 Subject: [PATCH] feat: Added example for replica key. --- .github/dependabot.yml | 59 ++++++++++- .github/workflows/tf-checks.yml | 10 +- README.yaml | 18 ++-- _example/external_replica_key/example.tf | 125 +++++++++++++++++++++++ _example/external_replica_key/outputs.tf | 19 ++++ _example/replica_key/example.tf | 124 ++++++++++++++++++++++ _example/replica_key/outputs.tf | 19 ++++ main.tf | 3 +- variables.tf | 2 +- 9 files changed, 363 insertions(+), 16 deletions(-) create mode 100644 _example/external_replica_key/example.tf create mode 100644 _example/external_replica_key/outputs.tf create mode 100644 _example/replica_key/example.tf create mode 100644 _example/replica_key/outputs.tf diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 9067e3f..d16f0ff 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -2,9 +2,18 @@ # package ecosystems to update and where the package manifests are located. # Please see the documentation for all configuration options: # https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates - version: 2 updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "daily" + open-pull-requests-limit: 3 + assignees: + - "clouddrove-ci" + reviewers: + - "approvers" + - package-ecosystem: "terraform" # See documentation for possible values directory: "/" # Location of package manifests schedule: @@ -15,8 +24,24 @@ updates: # Add reviewer reviewers: - "approvers" + # Allow up to 3 open pull requests for pip dependencies + open-pull-requests-limit: 3 + + - package-ecosystem: "terraform" # See documentation for possible values + directory: "/_example/complete" # Location of package manifests + schedule: + interval: "weekly" + # Add assignees + assignees: + - "clouddrove-ci" + # Add reviewer + reviewers: + - "approvers" + # Allow up to 3 open pull requests for pip dependencies + open-pull-requests-limit: 3 + - package-ecosystem: "terraform" # See documentation for possible values - directory: "_example/" # Location of package manifests + directory: "/_example/external_key" # Location of package manifests schedule: interval: "weekly" # Add assignees @@ -24,4 +49,32 @@ updates: - "clouddrove-ci" # Add reviewer reviewers: - - "approvers" \ No newline at end of file + - "approvers" + # Allow up to 3 open pull requests for pip dependencies + open-pull-requests-limit: 3 + + - package-ecosystem: "terraform" # See documentation for possible values + directory: "/_example/external_replica_key" # Location of package manifests + schedule: + interval: "weekly" + # Add assignees + assignees: + - "clouddrove-ci" + # Add reviewer + reviewers: + - "approvers" + # Allow up to 3 open pull requests for pip dependencies + open-pull-requests-limit: 3 + + - package-ecosystem: "terraform" # See documentation for possible values + directory: "/_example/replica_key" # Location of package manifests + schedule: + interval: "weekly" + # Add assignees + assignees: + - "clouddrove-ci" + # Add reviewer + reviewers: + - "approvers" + # Allow up to 3 open pull requests for pip dependencies + open-pull-requests-limit: 3 \ No newline at end of file diff --git a/.github/workflows/tf-checks.yml b/.github/workflows/tf-checks.yml index c50c45f..a5cabf8 100644 --- a/.github/workflows/tf-checks.yml +++ b/.github/workflows/tf-checks.yml @@ -12,4 +12,12 @@ jobs: external_key: uses: clouddrove/github-shared-workflows/.github/workflows/tf-checks.yml@master with: - working_directory: './_example/external_key/' \ No newline at end of file + working_directory: './_example/external_key/' + external_replica_key: + uses: clouddrove/github-shared-workflows/.github/workflows/tf-checks.yml@master + with: + working_directory: './_example/external_replica_key/' + replica_key: + uses: clouddrove/github-shared-workflows/.github/workflows/tf-checks.yml@master + with: + working_directory: './_example/replica_key/' \ No newline at end of file diff --git a/README.yaml b/README.yaml index b5acaf5..6e16984 100644 --- a/README.yaml +++ b/README.yaml @@ -15,19 +15,19 @@ github_repo: clouddrove/terraform-aws-kms # Badges to display badges: - - name: "Terraform" - image: "https://img.shields.io/badge/Terraform-v1.1.7-green" - url: "https://www.terraform.io" + - name: "Latest Release" + image: "https://img.shields.io/github/release/clouddrove/terraform-aws-subnet.svg" + url: "https://github.com/clouddrove/terraform-aws-subnet/releases/latest" + - name: "tfsec" + image: "https://github.com/clouddrove/terraform-aws-subnet/actions/workflows/tfsec.yml/badge.svg" + url: "https://github.com/clouddrove/terraform-aws-kms/actions/workflows/tfsec.yml" - name: "Licence" image: "https://img.shields.io/badge/License-APACHE-blue.svg" url: "LICENSE.md" - - name: "tfsec" - image: "https://github.com/clouddrove/terraform-aws-kms/actions/workflows/tfsec.yml/badge.svg" - url: "https://github.com/clouddrove/terraform-aws-kms/actions/workflows/tfsec.yml" - - name: "static-checks" - image: "https://github.com/clouddrove/terraform-aws-kms/actions/workflows/terraform.yml/badge.svg" - url: "https://github.com/clouddrove/terraform-aws-kms/actions/workflows/terraform.yml" +prerequesties: + - name: Terraform 1.5.4 + url: https://learn.hashicorp.com/terraform/getting-started/install.html # description of this project description: |- This terraform module creates a KMS Customer Master Key (CMK) and its alias. diff --git a/_example/external_replica_key/example.tf b/_example/external_replica_key/example.tf new file mode 100644 index 0000000..e1ca10d --- /dev/null +++ b/_example/external_replica_key/example.tf @@ -0,0 +1,125 @@ +####---------------------------------------------------------------------------------- +## Provider block added, Use the Amazon Web Services (AWS) provider to interact with the many resources supported by AWS. +####---------------------------------------------------------------------------------- +provider "aws" { + region = "us-east-1" +} + +####---------------------------------------------------------------------------------- +## AWS External KMS Key Replica. +## Should be deployed in different region as of primary key. +####---------------------------------------------------------------------------------- +module "kms_key" { + source = "./../../" + name = "kms" + environment = "test" + deletion_window_in_days = 7 + alias = "alias/replicate_key" + kms_key_enabled = false + create_replica_external_enabled = true + enabled = true + multi_region = false + key_material_base64 = "Wblj06fduthWggmsT0cLVoIMOkeLbc2kVfMud77i/JY=" + primary_key_arn = "arn:aws:kms:xxxxxxxxxxxxxxxxxxxxx" + policy = data.aws_iam_policy_document.default.json +} + +data "aws_caller_identity" "current" {} +data "aws_partition" "current" {} + +##---------------------------------------------------------------------------------- +## Data block called to get Permissions that will be used in creating policy. +##---------------------------------------------------------------------------------- +data "aws_iam_policy_document" "default" { + version = "2012-10-17" + statement { + sid = "Enable IAM User Permissions" + effect = "Allow" + principals { + type = "AWS" + identifiers = [ + format( + "arn:%s:iam::%s:root", + join("", data.aws_partition.current.*.partition), + data.aws_caller_identity.current.account_id + ) + ] + } + actions = ["kms:*"] + resources = ["*"] + } + statement { + sid = "Allow CloudTrail to encrypt logs" + effect = "Allow" + principals { + type = "Service" + identifiers = ["cloudtrail.amazonaws.com"] + } + actions = ["kms:GenerateDataKey*"] + resources = ["*"] + condition { + test = "StringLike" + variable = "kms:EncryptionContext:aws:cloudtrail:arn" + values = ["arn:aws:cloudtrail:*:XXXXXXXXXXXX:trail/*"] + } + } + + statement { + sid = "Allow CloudTrail to describe key" + effect = "Allow" + principals { + type = "Service" + identifiers = ["cloudtrail.amazonaws.com"] + } + actions = ["kms:DescribeKey"] + resources = ["*"] + } + + statement { + sid = "Allow principals in the account to decrypt log files" + effect = "Allow" + principals { + type = "AWS" + identifiers = [ + format( + "arn:%s:iam::%s:root", + join("", data.aws_partition.current.*.partition), + data.aws_caller_identity.current.account_id + ) + ] + } + actions = [ + "kms:Decrypt", + "kms:ReEncryptFrom" + ] + resources = ["*"] + condition { + test = "StringEquals" + variable = "kms:CallerAccount" + values = [ + "XXXXXXXXXXXX"] + } + condition { + test = "StringLike" + variable = "kms:EncryptionContext:aws:cloudtrail:arn" + values = ["arn:aws:cloudtrail:*:XXXXXXXXXXXX:trail/*"] + } + } + + statement { + sid = "Allow alias creation during setup" + effect = "Allow" + principals { + type = "AWS" + identifiers = [ + format( + "arn:%s:iam::%s:root", + join("", data.aws_partition.current.*.partition), + data.aws_caller_identity.current.account_id + ) + ] + } + actions = ["kms:CreateAlias"] + resources = ["*"] + } +} \ No newline at end of file diff --git a/_example/external_replica_key/outputs.tf b/_example/external_replica_key/outputs.tf new file mode 100644 index 0000000..6a1f266 --- /dev/null +++ b/_example/external_replica_key/outputs.tf @@ -0,0 +1,19 @@ +output "key_arn" { + value = module.kms_key.key_arn + description = "Key ARN." +} + +output "tags" { + value = module.kms_key.tags + description = "A mapping of tags to assign to the KMS." +} + +output "key_id" { + value = module.kms_key.key_id + description = "The globally unique identifier for the key." +} + +output "target_key_id" { + value = module.kms_key.target_key_id + description = "Identifier for the key for which the alias is for, can be either an ARN or key_id." +} \ No newline at end of file diff --git a/_example/replica_key/example.tf b/_example/replica_key/example.tf new file mode 100644 index 0000000..09cc803 --- /dev/null +++ b/_example/replica_key/example.tf @@ -0,0 +1,124 @@ +####---------------------------------------------------------------------------------- +## Provider block added, Use the Amazon Web Services (AWS) provider to interact with the many resources supported by AWS. +####---------------------------------------------------------------------------------- +provider "aws" { + region = "us-east-1" +} + +####---------------------------------------------------------------------------------- +## AWS KMS Key Replica. +## Should be deployed in different region as of primary key. +####---------------------------------------------------------------------------------- +module "kms_key" { + source = "./../../" + name = "kms" + environment = "test" + deletion_window_in_days = 7 + alias = "alias/replicate_key" + kms_key_enabled = false + create_replica_enabled = true + enabled = true + multi_region = false + primary_key_arn = "arn:aws:kms:xxxxxxxxxxxxxxxxxxxxx" + policy = data.aws_iam_policy_document.default.json +} + +data "aws_caller_identity" "current" {} +data "aws_partition" "current" {} + +##---------------------------------------------------------------------------------- +## Data block called to get Permissions that will be used in creating policy. +##---------------------------------------------------------------------------------- +data "aws_iam_policy_document" "default" { + version = "2012-10-17" + statement { + sid = "Enable IAM User Permissions" + effect = "Allow" + principals { + type = "AWS" + identifiers = [ + format( + "arn:%s:iam::%s:root", + join("", data.aws_partition.current.*.partition), + data.aws_caller_identity.current.account_id + ) + ] + } + actions = ["kms:*"] + resources = ["*"] + } + statement { + sid = "Allow CloudTrail to encrypt logs" + effect = "Allow" + principals { + type = "Service" + identifiers = ["cloudtrail.amazonaws.com"] + } + actions = ["kms:GenerateDataKey*"] + resources = ["*"] + condition { + test = "StringLike" + variable = "kms:EncryptionContext:aws:cloudtrail:arn" + values = ["arn:aws:cloudtrail:*:XXXXXXXXXXXX:trail/*"] + } + } + + statement { + sid = "Allow CloudTrail to describe key" + effect = "Allow" + principals { + type = "Service" + identifiers = ["cloudtrail.amazonaws.com"] + } + actions = ["kms:DescribeKey"] + resources = ["*"] + } + + statement { + sid = "Allow principals in the account to decrypt log files" + effect = "Allow" + principals { + type = "AWS" + identifiers = [ + format( + "arn:%s:iam::%s:root", + join("", data.aws_partition.current.*.partition), + data.aws_caller_identity.current.account_id + ) + ] + } + actions = [ + "kms:Decrypt", + "kms:ReEncryptFrom" + ] + resources = ["*"] + condition { + test = "StringEquals" + variable = "kms:CallerAccount" + values = [ + "XXXXXXXXXXXX"] + } + condition { + test = "StringLike" + variable = "kms:EncryptionContext:aws:cloudtrail:arn" + values = ["arn:aws:cloudtrail:*:XXXXXXXXXXXX:trail/*"] + } + } + + statement { + sid = "Allow alias creation during setup" + effect = "Allow" + principals { + type = "AWS" + identifiers = [ + format( + "arn:%s:iam::%s:root", + join("", data.aws_partition.current.*.partition), + data.aws_caller_identity.current.account_id + ) + ] + } + actions = ["kms:CreateAlias"] + resources = ["*"] + } +} \ No newline at end of file diff --git a/_example/replica_key/outputs.tf b/_example/replica_key/outputs.tf new file mode 100644 index 0000000..6a1f266 --- /dev/null +++ b/_example/replica_key/outputs.tf @@ -0,0 +1,19 @@ +output "key_arn" { + value = module.kms_key.key_arn + description = "Key ARN." +} + +output "tags" { + value = module.kms_key.tags + description = "A mapping of tags to assign to the KMS." +} + +output "key_id" { + value = module.kms_key.key_id + description = "The globally unique identifier for the key." +} + +output "target_key_id" { + value = module.kms_key.target_key_id + description = "Identifier for the key for which the alias is for, can be either an ARN or key_id." +} \ No newline at end of file diff --git a/main.tf b/main.tf index b7ae004..d881afc 100644 --- a/main.tf +++ b/main.tf @@ -57,8 +57,7 @@ resource "aws_kms_replica_key" "replica" { primary_key_arn = var.primary_key_arn enabled = var.is_enabled policy = var.policy - - tags = module.labels.tags + tags = module.labels.tags } ####---------------------------------------------------------------------------------- diff --git a/variables.tf b/variables.tf index 6125ee1..b0b94fb 100644 --- a/variables.tf +++ b/variables.tf @@ -102,7 +102,7 @@ variable "multi_region" { variable "bypass_policy_lockout_safety_check" { type = bool - default = null + default = false description = "A flag to indicate whether to bypass the key policy lockout safety check. Setting this value to true increases the risk that the KMS key becomes unmanageable" }