From a078309b1f1160245d4822c53073f89bc1526178 Mon Sep 17 00:00:00 2001 From: Loren Yu Date: Sun, 26 May 2024 11:05:44 -0700 Subject: [PATCH] Manually pull in template changes --- .template-version | 2 +- .../environment-variables-and-secrets.md | 18 ++++++++----- .../env-config/environment-variables.tf | 17 ++++++++---- infra/app/app-config/env-config/outputs.tf | 2 +- infra/app/service/main.tf | 7 ++++- infra/app/service/secrets.tf | 16 ++++++++++++ infra/modules/secret/main.tf | 26 +++++++++++++++++++ infra/modules/secret/outputs.tf | 3 +++ infra/modules/secret/variables.tf | 22 ++++++++++++++++ infra/modules/service/access-control.tf | 2 +- infra/modules/service/main.tf | 2 +- infra/modules/service/secrets.tf | 14 ---------- infra/modules/service/variables.tf | 4 +-- 13 files changed, 102 insertions(+), 33 deletions(-) create mode 100644 infra/app/service/secrets.tf create mode 100644 infra/modules/secret/main.tf create mode 100644 infra/modules/secret/outputs.tf create mode 100644 infra/modules/secret/variables.tf delete mode 100644 infra/modules/service/secrets.tf diff --git a/.template-version b/.template-version index 32422d7..168a3f0 100644 --- a/.template-version +++ b/.template-version @@ -1 +1 @@ -e5160b3201d0032198121aa1a59d5972b21a9fea +85830e5923085569c8424ab2a182c69ecd9e162d diff --git a/docs/infra/environment-variables-and-secrets.md b/docs/infra/environment-variables-and-secrets.md index f05d39d..82ee627 100644 --- a/docs/infra/environment-variables-and-secrets.md +++ b/docs/infra/environment-variables-and-secrets.md @@ -40,19 +40,23 @@ module "dev_config" { Secrets are a specific category of environment variables that need to be handled sensitively. Examples of secrets are authentication credentials such as API keys for external services. Secrets first need to be stored in AWS SSM Parameter Store as a `SecureString`. This section then describes how to make those secrets accessible to the ECS task as environment variables through the `secrets` configuration in the container definition (see AWS documentation on [retrieving Secrets Manager secrets through environment variables](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/secrets-envvar-secrets-manager.html)). -Secrets are defined in the same file that non-sensitive environment variables are defined, in the `app-config` module in the [environment-variables.tf file](/infra/app/app-config/env-config/environment-variables.tf). Modify the `secrets` list to define the secrets that the application will have access to. For each secret, `name` defines the environment variable name, and `ssm_param_name` defines the SSM parameter name that stores the secret value. For example: +Secrets are defined in the same file that non-sensitive environment variables are defined, in the `app-config` module in the [environment-variables.tf file](/infra/app/app-config/env-config/environment-variables.tf). Modify the `secrets` map to define the secrets that the application will have access to. For each secret, the map key defines the environment variable name. The `managed_by` property, which can be set to `"generated"` or `"manual"`, defines whether or not to generate a random secret or to reference an existing secret that was manually created and stored into AWS SSM. The `secret_store_name` property defines the SSM parameter name that stores the secret value. If `managed_by = "generated"`, then `secret_store_name` is where terraform will store the secret. If `managed_by = "manual"`, then `secret_store_name` is where terraform will look for the existing secret. For example: ```terraform # environment-variables.tf locals { - secrets = [ - { - name = "SOME_API_KEY" - ssm_param_name = "/${var.app_name}-${var.environment}/secret-sauce" + secrets = { + GENERATED_SECRET = { + manage_method = "generated" + secret_store_name = "/${var.app_name}-${var.environment}/generated-secret" } - ] + MANUALLY_CREATED_SECRET = { + manage_method = "manual" + secret_store_name = "/${var.app_name}-${var.environment}/manually-created-secret" + } + } } ``` -> ⚠️ Make sure you store the secret in SSM Parameter Store before you try to add secrets to your application service, or else the service won't be able to start since the ECS Task Executor won't be able to fetch the configured secret. +> ⚠️ For secrets with `managed_by = "manual"`, make sure you store the secret in SSM Parameter Store *before* you try to add configure your application service with the secrets, or else the service won't be able to start since the ECS Task Executor won't be able to fetch the configured secret. diff --git a/infra/app/app-config/env-config/environment-variables.tf b/infra/app/app-config/env-config/environment-variables.tf index 5423e06..eca84a9 100644 --- a/infra/app/app-config/env-config/environment-variables.tf +++ b/infra/app/app-config/env-config/environment-variables.tf @@ -12,9 +12,16 @@ locals { # Configuration for secrets # List of configurations for defining environment variables that pull from SSM parameter # store. Configurations are of the format - # { name = "ENV_VAR_NAME", ssm_param_name = "/ssm/param/name" } - secrets = [{ - name = "API_AUTH_TOKEN" - ssm_param_name = "/${var.app_name}-${var.environment}/api-auth-token" - }] + # { + # ENV_VAR_NAME = { + # manage_method = "generated" # or "manual" for a secret that was created and stored in SSM manually + # secret_store_name = "/ssm/param/name" + # } + # } + secrets = { + API_AUTH_TOKEN = { + manage_method = "generated" + secret_store_name = "/${var.app_name}-${var.environment}/api-auth-token" + } + } } diff --git a/infra/app/app-config/env-config/outputs.tf b/infra/app/app-config/env-config/outputs.tf index 360bc7e..43b6d39 100644 --- a/infra/app/app-config/env-config/outputs.tf +++ b/infra/app/app-config/env-config/outputs.tf @@ -30,7 +30,7 @@ output "service_config" { var.service_override_extra_environment_variables ) - secrets = toset(local.secrets) + secrets = local.secrets file_upload_jobs = { for job_name, job_config in local.file_upload_jobs : diff --git a/infra/app/service/main.tf b/infra/app/service/main.tf index f212e9b..f06cc2d 100644 --- a/infra/app/service/main.tf +++ b/infra/app/service/main.tf @@ -155,7 +155,12 @@ module "service" { BUCKET_NAME = local.storage_config.bucket_name }, local.service_config.extra_environment_variables) - secrets = local.service_config.secrets + secrets = [ + for secret_name in keys(local.service_config.secrets) : { + name = secret_name + valueFrom = module.secrets[secret_name].secret_arn + } + ] extra_policies = { feature_flags_access = module.feature_flags.access_policy_arn, diff --git a/infra/app/service/secrets.tf b/infra/app/service/secrets.tf new file mode 100644 index 0000000..e65eaa0 --- /dev/null +++ b/infra/app/service/secrets.tf @@ -0,0 +1,16 @@ +module "secrets" { + for_each = local.service_config.secrets + + source = "../../modules/secret" + + # When generating secrets and storing them in parameter store, append the + # terraform workspace to the secret store path if the environment is temporary + # to avoid conflicts with existing environments. + # Don't do this for secrets that are managed manually since the temporary + # environments will need to share those secrets. + secret_store_name = (each.value.manage_method == "generated" && local.is_temporary ? + "${each.value.secret_store_name}/${terraform.workspace}" : + each.value.secret_store_name + ) + manage_method = each.value.manage_method +} diff --git a/infra/modules/secret/main.tf b/infra/modules/secret/main.tf new file mode 100644 index 0000000..8619c86 --- /dev/null +++ b/infra/modules/secret/main.tf @@ -0,0 +1,26 @@ +locals { + secret = var.manage_method == "generated" ? aws_ssm_parameter.secret[0] : data.aws_ssm_parameter.secret[0] + access_policy_name = "${trimprefix(replace(local.secret.name, "/", "-"), "/")}-access" +} + +resource "random_password" "secret" { + count = var.manage_method == "generated" ? 1 : 0 + + length = 64 + special = true + override_special = "!#$%&*()-_=+[]{}<>:?" +} + +resource "aws_ssm_parameter" "secret" { + count = var.manage_method == "generated" ? 1 : 0 + + name = var.secret_store_name + type = "SecureString" + value = random_password.secret[0].result +} + +data "aws_ssm_parameter" "secret" { + count = var.manage_method == "manual" ? 1 : 0 + + name = var.secret_store_name +} diff --git a/infra/modules/secret/outputs.tf b/infra/modules/secret/outputs.tf new file mode 100644 index 0000000..57ebfcf --- /dev/null +++ b/infra/modules/secret/outputs.tf @@ -0,0 +1,3 @@ +output "secret_arn" { + value = local.secret.arn +} diff --git a/infra/modules/secret/variables.tf b/infra/modules/secret/variables.tf new file mode 100644 index 0000000..53d00e0 --- /dev/null +++ b/infra/modules/secret/variables.tf @@ -0,0 +1,22 @@ +variable "manage_method" { + type = string + description = <