Skip to content

Commit 6e211da

Browse files
leonsteinhaeusergithub-actions[bot]
leonsteinhaeuser
and
github-actions[bot]
authored
feat: TPLAT-344 aws dynamic provider credentials (#1)
* feat: added aws oidc iam identity provider * feat: added aws iam role definition * feat: added terraform dynamic credentials setup * docs: added instructions how to use this module * terraform-docs: automated action * fix: file line endings * chore: renamed vars.tf to variables.tf files Signed-off-by: leonsteinhaeuser <leon.steinhaeuser@tagesspiegel.de> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
1 parent 0e7f667 commit 6e211da

File tree

16 files changed

+588
-47
lines changed

16 files changed

+588
-47
lines changed

‎.terraform.lock.hcl‎

Lines changed: 82 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎README.md‎

Lines changed: 96 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -1,70 +1,119 @@
1-
# terraform-module-template
2-
3-
A template repository to provide a basic setup for Terraform modules.
4-
5-
## Module structure
6-
7-
The module structure is based on the [Terraform module documentation](https://www.terraform.io/docs/modules/index.html#standard-module-structure). The following tree shows the structure of the module.
8-
9-
```txt
10-
├── .gitignore
11-
├── LICENSE
12-
├── README.md
13-
├── docs
14-
│ └── README.md
15-
├── examples
16-
│ ├── complete
17-
│ │ ├── main.tf
18-
│ │ ├── outputs.tf
19-
│ │ ├── variables.tf
20-
│ │ └── versions.tf
21-
│ ├── minimal
22-
│ │ ├── main.tf
23-
│ │ ├── outputs.tf
24-
│ │ ├── variables.tf
25-
│ │ └── versions.tf
26-
├── main.tf
27-
├── outputs.tf
28-
├── variables.tf
29-
└── versions.tf
1+
# Terraform AWS dynamic provider credentials
2+
3+
This module creates a dynamic credentials setup between AWS and Terraform Cloud (project). It creates an IAM policy, IAM role, and IAM role policy attachment. It also creates a Terraform Cloud variable set with the AWS configurations. For more information on dynamic provider credentials, see [Dynamic Provider Credentials](https://developer.hashicorp.com/terraform/cloud-docs/workspaces/dynamic-provider-credentials).
4+
5+
## Usage
6+
7+
```terraform
8+
// one-time credentials to setup the dynamic credentials
9+
// this is the only time you need to provide credentials
10+
// after this, the dynamic credentials will be used.
11+
// If the setup was successful, `access_key` and `secret_key` should be removed.
12+
provider "aws" {
13+
region = var.aws_region
14+
access_key = var.access_key
15+
secret_key = var.secret_key
16+
}
17+
18+
module "aws_dynamic_provider_credentials" {
19+
source = "tagesspiegel/dynamic-provider-credentials/aws"
20+
version = "1.0.0"
21+
22+
tfc_organization = "my-org"
23+
tfc_project = "my-project"
24+
25+
tfc_workspaces = [{
26+
name_override = "my-project-auth"
27+
workspace = "*"
28+
run_phase = "*"
29+
policies = [
30+
{
31+
Effect = "Allow"
32+
Action = [
33+
"ec2:*"
34+
]
35+
Resource = "*"
36+
},
37+
{
38+
Effect = "Allow"
39+
Action = [
40+
"ram:*"
41+
]
42+
Resource = "*"
43+
},
44+
{
45+
Effect = "Allow"
46+
Action = [
47+
"cloudwatch:*"
48+
]
49+
Resource = "*"
50+
},
51+
{
52+
Effect = "Allow"
53+
Action = [
54+
"logs:*"
55+
]
56+
Resource = "*"
57+
},
58+
{
59+
Effect = "Allow"
60+
Action = [
61+
"kms:*"
62+
]
63+
Resource = "*"
64+
}
65+
]
66+
}]
67+
}
3068
```
3169

32-
## Working with this template
33-
34-
In order to use this template, you can use the GitHub template feature. This will create a new repository based on this template. After that, you can clone the repository and start working on it.
35-
36-
### Creating a new repository based on this template
37-
38-
To get started with this template, you have to navigate https://github.com/new and select the Tagesspiegel organization. After that, you can select the `terraform-module-template` repository, enter a name for your new repository and click on `Create repository`. Please note that you have to define a name for your new repository that is not already taken and follows the naming conventions (`terraform-<provider>-<name>`).
39-
40-
![Create GitHub repository based on template](docs/github_create_repository.png)
41-
42-
If everything worked as expected, you should now have a new repository based on this template. You can now clone the repository and start working on it.
43-
4470
<!-- BEGIN_TF_DOCS -->
4571
## Requirements
4672

4773
| Name | Version |
4874
|------|---------|
4975
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | ~> 1.5.6 |
76+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 5.3.0 |
5077

5178
## Providers
5279

53-
No providers.
80+
| Name | Version |
81+
|------|---------|
82+
| <a name="provider_tfe"></a> [tfe](#provider\_tfe) | 0.48.0 |
5483

5584
## Modules
5685

57-
No modules.
86+
| Name | Source | Version |
87+
|------|--------|---------|
88+
| <a name="module_aws_identity_provider"></a> [aws\_identity\_provider](#module\_aws\_identity\_provider) | ./modules/iam_identity_provider | n/a |
89+
| <a name="module_aws_tfc_dynamic_credentials_iam_roles"></a> [aws\_tfc\_dynamic\_credentials\_iam\_roles](#module\_aws\_tfc\_dynamic\_credentials\_iam\_roles) | ./modules/iam_roles | n/a |
5890

5991
## Resources
6092

61-
No resources.
93+
| Name | Type |
94+
|------|------|
95+
| [tfe_project_variable_set.tfc_project](https://registry.terraform.io/providers/hashicorp/tfe/latest/docs/resources/project_variable_set) | resource |
96+
| [tfe_variable.tfe_aws_provider_auth](https://registry.terraform.io/providers/hashicorp/tfe/latest/docs/resources/variable) | resource |
97+
| [tfe_variable.tfe_aws_provider_auth_arn](https://registry.terraform.io/providers/hashicorp/tfe/latest/docs/resources/variable) | resource |
98+
| [tfe_variable_set.tfc_aws_dynamic_credentials](https://registry.terraform.io/providers/hashicorp/tfe/latest/docs/resources/variable_set) | resource |
99+
| [tfe_project.tfc_project](https://registry.terraform.io/providers/hashicorp/tfe/latest/docs/data-sources/project) | data source |
62100

63101
## Inputs
64102

65-
No inputs.
103+
| Name | Description | Type | Default | Required |
104+
|------|-------------|------|---------|:--------:|
105+
| <a name="input_tfc_aws_audience"></a> [tfc\_aws\_audience](#input\_tfc\_aws\_audience) | AWS audience | `string` | `"aws.workload.identity"` | no |
106+
| <a name="input_tfc_hostname"></a> [tfc\_hostname](#input\_tfc\_hostname) | The hostname of the TFC or TFE instance you'd like to use with AWS | `string` | `"app.terraform.io"` | no |
107+
| <a name="input_tfc_organization"></a> [tfc\_organization](#input\_tfc\_organization) | Name of the organization | `string` | n/a | yes |
108+
| <a name="input_tfc_project"></a> [tfc\_project](#input\_tfc\_project) | Name of the terraform cloud/enterprise project | `string` | n/a | yes |
109+
| <a name="input_tfc_workspaces"></a> [tfc\_workspaces](#input\_tfc\_workspaces) | List of workspaces to create IAM roles for | <pre>list(object({<br> name_override = string<br> workspace = string<br> run_phase = string<br> policies = list(object({<br> Effect = string<br> Action = list(string)<br> Resource = string<br> }))<br> }))</pre> | n/a | yes |
66110

67111
## Outputs
68112

69-
No outputs.
70-
<!-- END_TF_DOCS -->
113+
| Name | Description |
114+
|------|-------------|
115+
| <a name="output_aws_tfc_audience"></a> [aws\_tfc\_audience](#output\_aws\_tfc\_audience) | n/a |
116+
| <a name="output_full_names"></a> [full\_names](#output\_full\_names) | A list of all 'full\_name' values |
117+
| <a name="output_oidc_claims"></a> [oidc\_claims](#output\_oidc\_claims) | A map of 'full\_name' as key and 'openid\_claims' as value |
118+
| <a name="output_role_arns"></a> [role\_arns](#output\_role\_arns) | A map of 'full\_name' as key and 'role\_arn' as value |
119+
<!-- END_TF_DOCS -->

‎main.tf‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
// import the aws oidc identity provider module
2+
// this module allows us to authenticate from terraform cloud to aws using oidc
3+
module "aws_identity_provider" {
4+
source = "./modules/iam_identity_provider"
5+
tfc_organization = var.tfc_organization
6+
tfc_aws_audience = var.tfc_aws_audience
7+
tfc_hostname = var.tfc_hostname
8+
}
9+
10+
// aws iam roles that are created to grant permissions to terraform cloud
11+
module "aws_tfc_dynamic_credentials_iam_roles" {
12+
source = "./modules/iam_roles"
13+
14+
depends_on = [
15+
module.aws_identity_provider
16+
]
17+
18+
for_each = { for workspace in var.tfc_workspaces : "${workspace.name_override}" => workspace }
19+
20+
tfc_organization_name = var.tfc_organization
21+
tfc_project_name = var.tfc_project
22+
23+
tfc_oidc_provider_arn = module.aws_identity_provider.aws_oidc_tfc_provider_arn
24+
tfc_oidc_provider_client_id_list = module.aws_identity_provider.aws_oidc_tfc_provider_client_id_list
25+
26+
aws_iam_role_name_override = each.value.name_override
27+
tfc_workspace_name = each.value.workspace
28+
tfc_run_phase = each.value.run_phase
29+
aws_iam_custom_policies = each.value.policies
30+
}
31+
32+
// create a variable set
33+
resource "tfe_variable_set" "tfc_aws_dynamic_credentials" {
34+
name = "aws-dynamic-credentials-${var.tfc_project}"
35+
description = "AWS dynamic credentials"
36+
organization = var.tfc_organization
37+
}
38+
39+
// get the project id
40+
data "tfe_project" "tfc_project" {
41+
name = var.tfc_project
42+
organization = var.tfc_organization
43+
}
44+
45+
// assign the variable set to the project
46+
resource "tfe_project_variable_set" "tfc_project" {
47+
variable_set_id = tfe_variable_set.tfc_aws_dynamic_credentials.id
48+
project_id = data.tfe_project.tfc_project.id
49+
}
50+
51+
// create the variables
52+
resource "tfe_variable" "tfe_aws_provider_auth" {
53+
key = "TFC_AWS_PROVIDER_AUTH"
54+
value = "true"
55+
category = "env"
56+
description = "AWS provider auth"
57+
variable_set_id = tfe_variable_set.tfc_aws_dynamic_credentials.id
58+
}
59+
60+
resource "tfe_variable" "tfe_aws_provider_auth_arn" {
61+
key = "TFC_AWS_RUN_ROLE_ARN"
62+
value = module.aws_tfc_dynamic_credentials_iam_roles["${var.tfc_project}-auth"].role_arn
63+
category = "env"
64+
description = "AWS provider auth"
65+
variable_set_id = tfe_variable_set.tfc_aws_dynamic_credentials.id
66+
}

‎modules/iam_identity_provider/.terraform.lock.hcl‎

Lines changed: 63 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)