diff --git a/.terraform.lock.hcl b/.terraform.lock.hcl index fd306e4..393131c 100644 --- a/.terraform.lock.hcl +++ b/.terraform.lock.hcl @@ -2,24 +2,62 @@ # Manual edits may be lost in future updates. provider "registry.terraform.io/hashicorp/aws" { - version = "5.82.2" + version = "5.86.0" constraints = ">= 4.20.1" hashes = [ - "h1:RuPaHbllUB8a2TGTyc149wJfoh6zhIEjUvFYKR6iP2E=", - "zh:0262fc96012fb7e173e1b7beadd46dfc25b1dc7eaef95b90e936fc454724f1c8", - "zh:397413613d27f4f54d16efcbf4f0a43c059bd8d827fe34287522ae182a992f9b", - "zh:436c0c5d56e1da4f0a4c13129e12a0b519d12ab116aed52029b183f9806866f3", - "zh:4d942d173a2553d8d532a333a0482a090f4e82a2238acf135578f163b6e68470", - "zh:624aebc549bfbce06cc2ecfd8631932eb874ac7c10eb8466ce5b9a2fbdfdc724", + "h1:dVxrQ67Ikqv/1/rfopK/wvCdETlUbQ6ZFuNOH+vEWqs=", + "zh:1587c6a0199dc33d066c13e1628bc0dd966d7d6740cb2007b636524a3ec99430", + "zh:15af46cc5bb43a37c24438cb3a36d44209a89d923ea4d4d631b56b1a89717b26", + "zh:166902101ac1cc8ec4f53e3bdcbab2eac7eb448b1c428c2e622adbf9ce1a679c", + "zh:284d116ac9d4a4de74cd1f52486f00e10bc400d9654f92a8990ea0093c43ff78", + "zh:4135e928f20d456172c8ab4ae3d4d8e411b6feddc94aaa1347c92469d52f1e61", + "zh:72b317d17182c3e0ee72f2851d25565d369cb6ee803b12adc9b6c6d3dbfca8d7", "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", - "zh:9e632dee2dfdf01b371cca7854b1ec63ceefa75790e619b0642b34d5514c6733", - "zh:a07567acb115b60a3df8f6048d12735b9b3bcf85ec92a62f77852e13d5a3c096", - "zh:ab7002df1a1be6432ac0eb1b9f6f0dd3db90973cd5b1b0b33d2dae54553dfbd7", - "zh:bc1ff65e2016b018b3e84db7249b2cd0433cb5c81dc81f9f6158f2197d6b9fde", - "zh:bcad84b1d767f87af6e1ba3dc97fdb8f2ad5de9224f192f1412b09aba798c0a8", - "zh:cf917dceaa0f9d55d9ff181b5dcc4d1e10af21b6671811b315ae2a6eda866a2a", - "zh:d8e90ecfb3216f3cc13ccde5a16da64307abb6e22453aed2ac3067bbf689313b", - "zh:d9054e0e40705df729682ad34c20db8695d57f182c65963abd151c6aba1ab0d3", - "zh:ecf3a4f3c57eb7e89f71b8559e2a71e4cdf94eea0118ec4f2cb37e4f4d71a069", + "zh:9dd0e80964e215ff658b708be72ccda8a20f63af7eaebdd6f11eb0461633bb03", + "zh:a18e502c16b7b6b216b888eab9a5c66b1ed103847fce6985850e4fc9e364a3e8", + "zh:c239f12648d7f7bbadbf5db0b57aaa9429abe70b574975b581784b4f17b7ed79", + "zh:c5164ca8254b9973ee985a3841a4b1f776844c7dcbc112ab3a88a0096e7e2198", + "zh:d93ac58092c3fffc5ddc688b39721fbfacc353e8965001060a5a1ce934d97246", + "zh:e877f1be2ebe67a2d163b7488f47cff4c95aca9c541ddfa25ad16c6ecc98f6a8", + "zh:eb71af6dfdd2b5670b5b957397a576d6053587c75750c17acc105fb44ed806eb", + "zh:ff6aa4f88f8e789375391bc8c886c636fb3e4a45a3fd7dc291bca17c2b8d4184", + ] +} + +provider "registry.terraform.io/hashicorp/random" { + version = "3.6.3" + hashes = [ + "h1:Fnaec9vA8sZ8BXVlN3Xn9Jz3zghSETIKg7ch8oXhxno=", + "zh:04ceb65210251339f07cd4611885d242cd4d0c7306e86dda9785396807c00451", + "zh:448f56199f3e99ff75d5c0afacae867ee795e4dfda6cb5f8e3b2a72ec3583dd8", + "zh:4b4c11ccfba7319e901df2dac836b1ae8f12185e37249e8d870ee10bb87a13fe", + "zh:4fa45c44c0de582c2edb8a2e054f55124520c16a39b2dfc0355929063b6395b1", + "zh:588508280501a06259e023b0695f6a18149a3816d259655c424d068982cbdd36", + "zh:737c4d99a87d2a4d1ac0a54a73d2cb62974ccb2edbd234f333abd079a32ebc9e", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:a357ab512e5ebc6d1fda1382503109766e21bbfdfaa9ccda43d313c122069b30", + "zh:c51bfb15e7d52cc1a2eaec2a903ac2aff15d162c172b1b4c17675190e8147615", + "zh:e0951ee6fa9df90433728b96381fb867e3db98f66f735e0c3e24f8f16903f0ad", + "zh:e3cdcb4e73740621dabd82ee6a37d6cfce7fee2a03d8074df65086760f5cf556", + "zh:eff58323099f1bd9a0bec7cb04f717e7f1b2774c7d612bf7581797e1622613a0", + ] +} + +provider "registry.terraform.io/hashicorp/tls" { + version = "4.0.6" + hashes = [ + "h1:dYSb3V94K5dDMtrBRLPzBpkMTPn+3cXZ/kIJdtFL+2M=", + "zh:10de0d8af02f2e578101688fd334da3849f56ea91b0d9bd5b1f7a243417fdda8", + "zh:37fc01f8b2bc9d5b055dc3e78bfd1beb7c42cfb776a4c81106e19c8911366297", + "zh:4578ca03d1dd0b7f572d96bd03f744be24c726bfd282173d54b100fd221608bb", + "zh:6c475491d1250050765a91a493ef330adc24689e8837a0f07da5a0e1269e11c1", + "zh:81bde94d53cdababa5b376bbc6947668be4c45ab655de7aa2e8e4736dfd52509", + "zh:abdce260840b7b050c4e401d4f75c7a199fafe58a8b213947a258f75ac18b3e8", + "zh:b754cebfc5184873840f16a642a7c9ef78c34dc246a8ae29e056c79939963c7a", + "zh:c928b66086078f9917aef0eec15982f2e337914c5c4dbc31dd4741403db7eb18", + "zh:cded27bee5f24de6f2ee0cfd1df46a7f88e84aaffc2ecbf3ff7094160f193d50", + "zh:d65eb3867e8f69aaf1b8bb53bd637c99c6b649ba3db16ded50fa9a01076d1a27", + "zh:ecb0c8b528c7a619fa71852bb3fb5c151d47576c5aab2bf3af4db52588722eeb", + "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c", ] } diff --git a/README.md b/README.md index 522b498..06092c5 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,9 @@ | Name | Version | |------|---------| -| [aws](#provider\_aws) | 5.49.0 | +| [aws](#provider\_aws) | 5.86.0 | +| [random](#provider\_random) | 3.6.3 | +| [tls](#provider\_tls) | 4.0.6 | ## Modules @@ -30,15 +32,19 @@ | Name | Type | |------|------| +| [aws_key_pair.deployer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/key_pair) | resource | | [aws_secretsmanager_secret.secrets](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource | +| [aws_secretsmanager_secret.ssh_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource | | [aws_secretsmanager_secret_version.secrets](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_version) | resource | +| [aws_secretsmanager_secret_version.ssh_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_version) | resource | | [aws_security_group.packer](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource | | [aws_security_group_rule.sg_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource | | [aws_ssm_parameter.managed_parameters](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource | -| [aws_ssm_parameter.nonmanaged_parameters](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource | | [aws_vpc_security_group_egress_rule.allow_all_traffic_ipv4](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_egress_rule) | resource | | [aws_vpc_security_group_egress_rule.allow_all_traffic_ipv6](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_egress_rule) | resource | | [aws_vpc_security_group_ingress_rule.allow_all_ssh_ipv4](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_ingress_rule) | resource | +| [random_pet.keyname](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/pet) | resource | +| [tls_private_key.ssh](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/private_key) | resource | | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | | [aws_iam_policy_document.build_user_default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source | @@ -52,6 +58,7 @@ | [ansible\_bucket](#input\_ansible\_bucket) | Ansible bucket details | 
object({
    name = string,
    key  = string
  })
| `null` | no | | [ansible\_repo](#input\_ansible\_repo) | Source of Ansible Repo | 
object({
    arn             = optional(string)
    repository_name = optional(string, "image-pipeline-ansible-playbooks")
    branch          = optional(string, "main")
  })
| `null` | no | | [ansible\_source\_type](#input\_ansible\_source\_type) | Type of source to be used for the Ansible CodePipeline | `string` | `"CodeCommit"` | no | +| [assets\_bucket\_name](#input\_assets\_bucket\_name) | Name of the S3 bucket used to store the deployment artifacts | `string` | `"image-pipeline-assets"` | no | | [build\_environment\_variables](#input\_build\_environment\_variables) | n/a | 
list(object({
    name  = string
    value = string
    type  = optional(string, "PLAINTEXT")
  }))
| `null` | no | | [build\_project\_source](#input\_build\_project\_source) | Source Code Repo for Playbook | `string` | `"CODEPIPELINE"` | no | | [build\_projects](#input\_build\_projects) | List of Names of the CodeBuild projects to be created | 
list(object({
    name = string,
    vars = optional(map(string), {})
    environment_variables = optional(list(object({
      name  = string
      value = string
      type  = string
    })), [])
    buildspec = optional(string)
  }))
| 
[
  {
    "name": "build"
  },
  {
    "name": "test"
  }
]
| no | @@ -71,6 +78,8 @@ | [goss\_repo](#input\_goss\_repo) | Source of Goss Repo | 
object({
    arn             = optional(string)
    repository_name = optional(string, "image-pipeline-goss-testing")
    branch          = optional(string, "main")
  })
| `null` | no | | [goss\_source\_type](#input\_goss\_source\_type) | Type of source to be used for the Goss CodePipeline | `string` | `"CodeCommit"` | no | | [image](#input\_image) | n/a | 
object({
    dest_tag           = string
    dest_docker_repo   = string
    source_image       = string
    source_tag         = string
    source_docker_repo = string
  })
| `null` | no | +| [image\_volume\_mapping](#input\_image\_volume\_mapping) | n/a | 
list(object({
    device_name           = string
    volume_size           = number
    volume_type           = string
    delete_on_termination = bool
    encrypted             = optional(bool, false)
    iops                  = optional(number, null)
    snapshot_id           = optional(string, null)
    throughput            = optional(number, null)
    virtual_name          = optional(string, null)
    kms_key_id            = optional(string, null)
    mount_path            = optional(string, null)
  }))
| `[]` | no | +| [kms\_key\_id](#input\_kms\_key\_id) | n/a | `string` | `null` | no | | [nonmanaged\_parameters](#input\_nonmanaged\_parameters) | n/a | `list(string)` | 
[
  "dest_tag"
]
| no | | [packer\_bucket](#input\_packer\_bucket) | Source bucket details | 
object({
    name = string,
    key  = string
  })
| `null` | no | | [packer\_config](#input\_packer\_config) | Name of Packer Config in Repo | `string` | `"build.pkr.hcl"` | no | @@ -80,9 +89,11 @@ | [parameter\_arns](#input\_parameter\_arns) | n/a | `list(string)` | `null` | no | | [playbook](#input\_playbook) | n/a | `string` | `null` | no | | [project\_name](#input\_project\_name) | Unique name for this project | `string` | n/a | yes | +| [required\_packages](#input\_required\_packages) | n/a | 
list(object({
    src  = string
    dest = string
  }))
| `[]` | no | | [secret\_arns](#input\_secret\_arns) | n/a | `list(string)` | `null` | no | | [secrets](#input\_secrets) | n/a | `map(string)` | `{}` | no | | [shared\_accounts](#input\_shared\_accounts) | n/a | `list(string)` | `null` | no | +| [shared\_kms\_key\_arns](#input\_shared\_kms\_key\_arns) | n/a | `list(string)` | `[]` | no | | [ssh\_user](#input\_ssh\_user) | SSH username | `string` | `null` | no | | [stage\_input](#input\_stage\_input) | Tags to be attached to the CodePipeline | 
list(object({
    name             = string,
    category         = string,
    owner            = string,
    provider         = string,
    input_artifacts  = list(string),
    output_artifacts = list(string)
  }))
| 
[
  {
    "category": "Build",
    "input_artifacts": [
      "SourceOutput",
      "SourceAnsibleOutput"
    ],
    "name": "build",
    "output_artifacts": [
      "BuildOutput"
    ],
    "owner": "AWS",
    "provider": "CodeBuild"
  },
  {
    "category": "Build",
    "input_artifacts": [
      "SourceOutput",
      "SourceGossOutput"
    ],
    "name": "test",
    "output_artifacts": [
      "BuildTestOutput"
    ],
    "owner": "AWS",
    "provider": "CodeBuild"
  }
]
| no | | [state](#input\_state) | n/a | 
object({
    bucket         = string
    key            = string
    region         = string
    dynamodb_table = string
  })
| n/a | yes | @@ -102,9 +113,9 @@ | [iam\_arn](#output\_iam\_arn) | The ARN of the IAM Role used by the CodePipeline | | [kms\_arn](#output\_kms\_arn) | The ARN of the KMS key used in the codepipeline | | [managed\_parameters](#output\_managed\_parameters) | n/a | -| [nonmanaged\_parameters](#output\_nonmanaged\_parameters) | n/a | | [s3\_arn](#output\_s3\_arn) | The ARN of the S3 Bucket | | [s3\_bucket](#output\_s3\_bucket) | The Name of the S3 Bucket | | [sec\_group](#output\_sec\_group) | n/a | | [secrets](#output\_secrets) | n/a | +| [user](#output\_user) | n/a | \ No newline at end of file diff --git a/locals.tf b/locals.tf index f1f5e2d..b21be66 100644 --- a/locals.tf +++ b/locals.tf @@ -40,6 +40,17 @@ data "aws_iam_policy_document" "build_user_default" { ], var.secret_arns == null ? [] : var.secret_arns) } + + statement { + effect = "Allow" + actions = [ + "s3:*" + ] + resources = concat([ + "arn:${data.aws_partition.current.partition}:s3:::${module.s3_artifacts_bucket.bucket}/*" + ], + var.s3_bucket_arns == null ? [] : var.s3_bucket_arns) + } } locals { diff --git a/main.tf b/main.tf index 8a4acd8..7e0da06 100644 --- a/main.tf +++ b/main.tf @@ -37,6 +37,7 @@ module "build_user" { account_id = local.account_id region = local.region build_user_iam_policy = local.build_user_iam_policy + iam_instance_profile = aws_iam_instance_profile.build_user_instance_profile.name } diff --git a/modules/build_user/main.tf b/modules/build_user/main.tf index cd43389..a27b3f6 100644 --- a/modules/build_user/main.tf +++ b/modules/build_user/main.tf @@ -34,3 +34,8 @@ resource "aws_secretsmanager_secret_version" "credentials" { aws_access_key_id = aws_iam_access_key.build_user.id }) } + +resource "aws_iam_instance_profile" "build_user_instance_profile" { + name = "${var.project_name}-instance-profile" + role = aws_iam_user.build_user.name +}