Skip to content

Commit d3774d7

Browse files
iamnajibradzuaniamnajibradzuan
committed
initial commit
0 parents  commit d3774d7

File tree

10 files changed

+504
-0
lines changed

10 files changed

+504
-0
lines changed

‎.gitignore

Whitespace-only changes.

‎README.md

Lines changed: 185 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,185 @@
1+
<p align="center"> <img src="https://user-images.githubusercontent.com/50652676/62349836-882fef80-b51e-11e9-99e3-7b974309c7e3.png" width="100" height="100"></p>
2+
3+
4+
<h1 align="center">
5+
Terraform AWS KMS
6+
</h1>
7+
8+
<p align="center" style="font-size: 1.2rem;">
9+
This terraform module creates a KMS Customer Master Key (CMK) and its alias.
10+
</p>
11+
12+
<p align="center">
13+
14+
<a href="https://www.terraform.io">
15+
<img src="https://img.shields.io/badge/Terraform-v0.13-green" alt="Terraform">
16+
</a>
17+
<a href="LICENSE.md">
18+
<img src="https://img.shields.io/badge/License-MIT-blue.svg" alt="Licence">
19+
</a>
20+
21+
22+
</p>
23+
<p align="center">
24+
25+
<a href='https://facebook.com/sharer/sharer.php?u=https://github.com/devops4me/terraform-aws-kms'>
26+
<img title="Share on Facebook" src="https://user-images.githubusercontent.com/50652676/62817743-4f64cb80-bb59-11e9-90c7-b057252ded50.png" />
27+
</a>
28+
<a href='https://www.linkedin.com/shareArticle?mini=true&title=Terraform+AWS+KMS&url=https://github.com/devops4mecode/terraform-aws-kms'>
29+
<img title="Share on LinkedIn" src="https://user-images.githubusercontent.com/50652676/62817742-4e339e80-bb59-11e9-87b9-a1f68cae1049.png" />
30+
</a>
31+
<a href='https://twitter.com/intent/tweet/?text=Terraform+AWS+KMS&url=https://github.com/devops4mecode/terraform-aws-kms'>
32+
<img title="Share on Twitter" src="https://user-images.githubusercontent.com/50652676/62817740-4c69db00-bb59-11e9-8a79-3580fbbf6d5c.png" />
33+
</a>
34+
35+
</p>
36+
<hr>
37+
## Prerequisites
38+
39+
This module has a few dependencies:
40+
41+
- [Terraform 0.13](https://learn.hashicorp.com/terraform/getting-started/install.html)
42+
- [Go](https://golang.org/doc/install)
43+
- [github.com/stretchr/testify/assert](https://github.com/stretchr/testify)
44+
- [github.com/gruntwork-io/terratest/modules/terraform](https://github.com/gruntwork-io/terratest)
45+
46+
## Examples
47+
48+
49+
**IMPORTANT:** Since the `master` branch used in `source` varies based on new modifications, we suggest that you use the release versions [here](https://github.com/devops4mecode/terraform-aws-kms/releases).
50+
51+
52+
### Simple Example
53+
Here is an example of how you can use this module in your inventory structure:
54+
```hcl
55+
module "kms_key" {
56+
source = "devops4mecode/kms/aws"
57+
version = "0.13.0"
58+
name = "kms"
59+
application = "devops4me"
60+
environment = "test"
61+
label_order = ["environment", "application", "name"]
62+
enabled = true
63+
description = "KMS key for cloudtrail"
64+
deletion_window_in_days = 7
65+
enable_key_rotation = true
66+
alias = "alias/cloudtrail"
67+
policy = data.aws_iam_policy_document.default.json
68+
}
69+
70+
data "aws_iam_policy_document" "default" {
71+
version = "2012-10-17"
72+
statement {
73+
sid = "Enable IAM User Permissions"
74+
effect = "Allow"
75+
principals {
76+
type = "AWS"
77+
identifiers = ["*"]
78+
}
79+
actions = ["kms:*"]
80+
resources = ["*"]
81+
}
82+
statement {
83+
sid = "Allow CloudTrail to encrypt logs"
84+
effect = "Allow"
85+
principals {
86+
type = "Service"
87+
identifiers = ["cloudtrail.amazonaws.com"]
88+
}
89+
actions = ["kms:GenerateDataKey*"]
90+
resources = ["*"]
91+
condition {
92+
test = "StringLike"
93+
variable = "kms:EncryptionContext:aws:cloudtrail:arn"
94+
values = ["arn:aws:cloudtrail:*:XXXXXXXXXXXX:trail/*"]
95+
}
96+
}
97+
98+
statement {
99+
sid = "Allow CloudTrail to describe key"
100+
effect = "Allow"
101+
principals {
102+
type = "Service"
103+
identifiers = ["cloudtrail.amazonaws.com"]
104+
}
105+
actions = ["kms:DescribeKey"]
106+
resources = ["*"]
107+
}
108+
109+
statement {
110+
sid = "Allow principals in the account to decrypt log files"
111+
effect = "Allow"
112+
principals {
113+
type = "AWS"
114+
identifiers = ["*"]
115+
}
116+
actions = [
117+
"kms:Decrypt",
118+
"kms:ReEncryptFrom"
119+
]
120+
resources = ["*"]
121+
condition {
122+
test = "StringEquals"
123+
variable = "kms:CallerAccount"
124+
values = [
125+
"XXXXXXXXXXXX"]
126+
}
127+
condition {
128+
test = "StringLike"
129+
variable = "kms:EncryptionContext:aws:cloudtrail:arn"
130+
values = ["arn:aws:cloudtrail:*:XXXXXXXXXXXX:trail/*"]
131+
}
132+
}
133+
134+
statement {
135+
sid = "Allow alias creation during setup"
136+
effect = "Allow"
137+
principals {
138+
type = "AWS"
139+
identifiers = ["*"]
140+
}
141+
actions = ["kms:CreateAlias"]
142+
resources = ["*"]
143+
}
144+
}
145+
146+
```
147+
148+
## Inputs
149+
150+
| Name | Description | Type | Default | Required |
151+
|------|-------------|------|---------|:--------:|
152+
| alias | The display name of the alias. The name must start with the word `alias` followed by a forward slash. | `string` | `""` | no |
153+
| application | Application (e.g. `do4m` or `devops4me`). | `string` | `""` | no |
154+
| attributes | Additional attributes (e.g. `1`). | `list(string)` | `[]` | no |
155+
| customer\_master\_key\_spec | Specifies whether the key contains a symmetric key or an asymmetric key pair and the encryption algorithms or signing algorithms that the key supports. Valid values: SYMMETRIC\_DEFAULT, RSA\_2048, RSA\_3072, RSA\_4096, ECC\_NIST\_P256, ECC\_NIST\_P384, ECC\_NIST\_P521, or ECC\_SECG\_P256K1. Defaults to SYMMETRIC\_DEFAULT. | `string` | `"SYMMETRIC_DEFAULT"` | no |
156+
| deletion\_window\_in\_days | Duration in days after which the key is deleted after destruction of the resource. | `number` | `10` | no |
157+
| description | The description of the key as viewed in AWS console. | `string` | `"Parameter Store KMS master key"` | no |
158+
| enable\_key\_rotation | Specifies whether key rotation is enabled. | `bool` | `true` | no |
159+
| enabled | Specifies whether the kms is enabled or disabled. | `bool` | `true` | no |
160+
| environment | Environment (e.g. `prod`, `dev`, `staging`). | `string` | `""` | no |
161+
| is\_enabled | Specifies whether the key is enabled. | `bool` | `true` | no |
162+
| key\_usage | Specifies the intended use of the key. Defaults to ENCRYPT\_DECRYPT, and only symmetric encryption and decryption are supported. | `string` | `"ENCRYPT_DECRYPT"` | no |
163+
| label\_order | label order, e.g. `name`,`application`. | `list` | `[]` | no |
164+
| managedby | ManagedBy, eg 'DevOps4Me' or 'NajibRadzuan'. | `string` | `"najibradzuan@devops4me.com"` | no |
165+
| name | Name (e.g. `app` or `cluster`). | `string` | `""` | no |
166+
| policy | A valid policy JSON document. For more information about building AWS IAM policy documents with Terraform. | `string` | `""` | no |
167+
| tags | Additional tags (e.g. map(`BusinessUnit`,`XYZ`). | `map(string)` | `{}` | no |
168+
169+
## Outputs
170+
171+
| Name | Description |
172+
|------|-------------|
173+
| alias\_arn | Alias ARN. |
174+
| alias\_name | Alias name. |
175+
| key\_arn | Key ARN. |
176+
| key\_id | Key ID. |
177+
| tags | A mapping of tags to assign to the resource. |
178+
179+
## Testing
180+
In this module testing is performed with [terratest](https://github.com/gruntwork-io/terratest) and it creates a small piece of infrastructure, matches the output like ARN, ID and Tags name etc and destroy infrastructure in your AWS account. This testing is written in GO, so you need a [GO environment](https://golang.org/doc/install) in your system.
181+
182+
You need to run the following command in the testing folder:
183+
```hcl
184+
go test -run Test
185+
```

‎gorun/kms.tf

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
provider "aws" {
2+
region = "ap-southeast-1"
3+
}
4+
5+
module "kms_key" {
6+
source = "./../"
7+
8+
name = "kms"
9+
application = "devops4me"
10+
environment = "test"
11+
label_order = ["environment", "application", "name"]
12+
enabled = true
13+
14+
description = "KMS key for cloudtrail"
15+
deletion_window_in_days = 7
16+
enable_key_rotation = true
17+
alias = "alias/cloudtrail_Name"
18+
policy = data.aws_iam_policy_document.default.json
19+
}
20+
21+
data "aws_iam_policy_document" "default" {
22+
version = "2012-10-17"
23+
statement {
24+
sid = "Enable IAM User Permissions"
25+
effect = "Allow"
26+
principals {
27+
type = "AWS"
28+
identifiers = ["*"]
29+
}
30+
actions = ["kms:*"]
31+
resources = ["*"]
32+
}
33+
statement {
34+
sid = "Allow CloudTrail to encrypt logs"
35+
effect = "Allow"
36+
principals {
37+
type = "Service"
38+
identifiers = ["cloudtrail.amazonaws.com"]
39+
}
40+
actions = ["kms:GenerateDataKey*"]
41+
resources = ["*"]
42+
condition {
43+
test = "StringLike"
44+
variable = "kms:EncryptionContext:aws:cloudtrail:arn"
45+
values = ["arn:aws:cloudtrail:*:XXXXXXXXXXXX:trail/*"]
46+
}
47+
}
48+
49+
statement {
50+
sid = "Allow CloudTrail to describe key"
51+
effect = "Allow"
52+
principals {
53+
type = "Service"
54+
identifiers = ["cloudtrail.amazonaws.com"]
55+
}
56+
actions = ["kms:DescribeKey"]
57+
resources = ["*"]
58+
}
59+
60+
statement {
61+
sid = "Allow principals in the account to decrypt log files"
62+
effect = "Allow"
63+
principals {
64+
type = "AWS"
65+
identifiers = ["*"]
66+
}
67+
actions = [
68+
"kms:Decrypt",
69+
"kms:ReEncryptFrom"
70+
]
71+
resources = ["*"]
72+
condition {
73+
test = "StringEquals"
74+
variable = "kms:CallerAccount"
75+
values = [
76+
"XXXXXXXXXXXX"]
77+
}
78+
condition {
79+
test = "StringLike"
80+
variable = "kms:EncryptionContext:aws:cloudtrail:arn"
81+
values = ["arn:aws:cloudtrail:*:XXXXXXXXXXXX:trail/*"]
82+
}
83+
}
84+
85+
statement {
86+
sid = "Allow alias creation during setup"
87+
effect = "Allow"
88+
principals {
89+
type = "AWS"
90+
identifiers = ["*"]
91+
}
92+
actions = ["kms:CreateAlias"]
93+
resources = ["*"]
94+
}
95+
}

‎gorun/output.tf

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
output "key_arn" {
2+
value = module.kms_key.key_arn
3+
description = "Key ARN."
4+
}
5+
6+
output "tags" {
7+
value = module.kms_key.tags
8+
description = "A mapping of tags to assign to the KMS."
9+
}

‎main.tf

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
## Managed By : DevOps4Me
2+
# Description : This Script is used to create Cloudfront CDN on AWS.
3+
## Copyright @ DevOps4Me. All Right Reserved.
4+
5+
#Module : label
6+
#Description : This terraform module is designed to generate consistent label names and tags
7+
# for resources. You can use terraform-labels to implement a strict naming
8+
# convention.
9+
module "labels" {
10+
source = "git::https://gitlab.com/devops4me-automation/terraform-label.git"
11+
12+
name = var.name
13+
application = var.application
14+
environment = var.environment
15+
managedby = var.managedby
16+
label_order = var.label_order
17+
}
18+
19+
# Module : KMS KEY
20+
# Description : This terraform module creates a KMS Customer Master Key (CMK) and its alias.
21+
resource "aws_kms_key" "default" {
22+
count = var.enabled ? 1 : 0
23+
description = var.description
24+
key_usage = var.key_usage
25+
deletion_window_in_days = var.deletion_window_in_days
26+
is_enabled = var.is_enabled
27+
enable_key_rotation = var.enable_key_rotation
28+
customer_master_key_spec = var.customer_master_key_spec
29+
policy = var.policy
30+
tags = module.labels.tags
31+
}
32+
33+
# Module : KMS ALIAS
34+
# Description : Provides an alias for a KMS customer master key..
35+
resource "aws_kms_alias" "default" {
36+
count = var.enabled ? 1 : 0
37+
name = coalesce(var.alias, format("alias/%v", module.labels.id))
38+
target_key_id = join("", aws_kms_key.default.*.id)
39+
}

‎output.tf

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Module : KMS KEY
2+
# Description : This terraform module creates a KMS Customer Master Key (CMK) and its alias.
3+
output "key_arn" {
4+
value = join("", aws_kms_key.default.*.arn)
5+
description = "Key ARN."
6+
}
7+
8+
output "key_id" {
9+
value = join("", aws_kms_key.default.*.key_id)
10+
description = "Key ID."
11+
}
12+
13+
output "alias_arn" {
14+
value = join("", aws_kms_alias.default.*.arn)
15+
description = "Alias ARN."
16+
}
17+
18+
output "alias_name" {
19+
value = join("", aws_kms_alias.default.*.name)
20+
description = "Alias name."
21+
}
22+
23+
output "tags" {
24+
value = module.labels.tags
25+
description = "A mapping of tags to assign to the resource."
26+
}

‎test/go.mod

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
module github.com/devops4mecode/terraform-aws-kms
2+
3+
go 1.13
4+
5+
require (
6+
github.com/gruntwork-io/terratest v0.30.6
7+
github.com/stretchr/testify v1.6.1
8+
)

0 commit comments

Comments
 (0)