Skip to content

Commit

Permalink
Migrate readme yaml (#2)
Browse files Browse the repository at this point in the history 
* Migrate readme yaml
  • Loading branch information
@vadim-hleif
vadim-hleif authored Jul 24, 2018
1 parent 0444f5f commit 58cdae5
Show file tree
Hide file tree
Showing 7 changed files with 329 additions and 56 deletions.
3 changes: 3 additions & 0 deletions .gitignore
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,3 +4,6 @@
**/terraform.tfstate
**/terraform.tfstate.backup
**/terraform.tfvars

.build-harness
build-harness
6 changes: 5 additions & 1 deletion Makefile
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,10 @@
SHELL := /bin/bash

# List of targets the `readme` target should call before generating the readme
export README_DEPS ?= docs/targets.md docs/terraform.md

-include $(shell curl -sSL -o .build-harness "https://git.io/build-harness"; echo .build-harness)

## Lint terraform code
lint:
$(SELF) terraform/install terraform/get-modules terraform/get-plugins terraform/lint terraform/validate
$(SELF) terraform/install terraform/get-modules terraform/get-plugins terraform/lint terraform/validate
188 changes: 136 additions & 52 deletions README.md
View file
Original file line number Diff line number Diff line change
@@ -1,18 +1,38 @@
# terraform-aws-ssm-iam-role [![Build Status](https://travis-ci.org/cloudposse/terraform-aws-ssm-iam-role.svg?branch=master)](https://travis-ci.org/cloudposse/terraform-aws-ssm-iam-role) [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com)
<!-- This file was automatically generated by the `build-harness`. Make all changes to `README.yaml` and run `make readme` to rebuild this file. -->

[![Cloud Posse](https://cloudposse.com/logo-300x69.svg)](https://cloudposse.com)

# terraform-aws-ssm-iam-role [![Build Status](https://travis-ci.org/cloudposse/terraform-aws-ssm-iam-role.svg?branch=master)](https://travis-ci.org/cloudposse/terraform-aws-ssm-iam-role) [![Latest Release](https://img.shields.io/github/release/cloudposse/terraform-aws-ssm-iam-role.svg)](https://github.com/cloudposse/terraform-aws-ssm-iam-role/releases/latest) [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com)


Terraform module to provision an IAM role with configurable permissions to access [SSM Parameter Store](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-paramstore.html).


---

This project is part of our comprehensive ["SweetOps"](https://docs.cloudposse.com) approach towards DevOps.


It's 100% Open Source and licensed under the [APACHE2](LICENSE).









## Introduction

For more information on how to control access to Systems Manager parameters by using AWS Identity and Access Management, see [Controlling Access to Systems Manager Parameters](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-access.html).

For more information on how to use parameter hierarchies to help organize and manage parameters, see [Organizing Parameters into Hierarchies](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-su-organize.html).

__NOTE:__ This module can be used to provision IAM roles with SSM permissions for [chamber](https://docs.cloudposse.com/tools/chamber/).

__NOTE:__ This module can be used to provision IAM roles with SSM permissions for [chamber](https://docs.cloudposse.com/tools/chamber/).

## Usage

### Basic Example

This example creates a role with the name `cp-prod-app-all` with permission to read all SSM parameters,
and gives permission to the entities specified in `assume_role_arns` to assume the role.

Expand All @@ -32,6 +52,11 @@ module "ssm_iam_role" {
}
```




## Examples

### Example With Permission For Specific Resources

This example creates a role with the name `cp-prod-app-secrets` with permission to read the SSM parameters that begin with `secret-`,
Expand Down Expand Up @@ -94,41 +119,82 @@ module "ssm_iam_role" {
```


## Variables

| Name | Default | Description | Required |
|:-----------------------|:----------------|:---------------------------------------------------------------------------------|:--------:|
| namespace | `` | Namespace (_e.g._ `cp` or `cloudposse`) | Yes |
| stage | `` | Stage (_e.g._ `prod`, `dev`, `staging`) | Yes |
| name | `` | Name (e.g. `app` or `chamber`) | Yes |
| region | `` | AWS Region | Yes |
| account_id | `` | AWS account ID | Yes |
| kms_key_arn | `` | ARN of the KMS key which will encrypt/decrypt SSM secret strings | Yes |
| assume_role_arns | `` | List of ARNs to allow assuming the role. Could be AWS services or accounts, Kops nodes, IAM users or groups | Yes |
| ssm_actions | `["ssm:GetParametersByPath", "ssm:GetParameters"]` | SSM actions to allow | Yes |
| ssm_parameters | `` | List of SSM parameters to apply the actions. A parameter can include a path and a name pattern that you define by using forward slashes, e.g. `kops/secret-*` | Yes |
| max_session_duration | 3600 | The maximum session duration (in seconds) for the role. Can have a value from 1 hour to 12 hours | No |
| attributes | `[]` | Additional attributes (_e.g._ `1`) | No |
| tags | `{}` | Additional tags (_e.g._ `map("Cluster","us-east-1.cloudposse.co")` | No |
| delimiter | `-` | Delimiter to be used between `namespace`, `stage`, `name` and `attributes` | No |
## Makefile Targets
```
Available targets:
help This help screen
help/all Display help for all targets
lint Lint terraform code
```

## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|:----:|:-----:|:-----:|
| account_id | AWS account ID | string | - | yes |
| assume_role_arns | List of ARNs to allow assuming the role. Could be AWS services or accounts, Kops nodes, IAM users or groups | list | - | yes |
| attributes | Additional attributes (e.g. `1`) | list | `<list>` | no |
| delimiter | Delimiter to be used between `namespace`, `stage`, `name` and `attributes` | string | `-` | no |
| kms_key_arn | ARN of the KMS key which will encrypt/decrypt SSM secret strings | string | - | yes |
| max_session_duration | The maximum session duration (in seconds) for the role. Can have a value from 1 hour to 12 hours | string | `3600` | no |
| name | Name (e.g. `app` or `chamber`) | string | - | yes |
| namespace | Namespace (e.g. `cp` or `cloudposse`) | string | - | yes |
| region | AWS Region | string | - | yes |
| ssm_actions | SSM actions to allow | list | `<list>` | no |
| ssm_parameters | List of SSM parameters to apply the actions. A parameter can include a path and a name pattern that you define by using forward slashes, e.g. `kops/secret-*` | list | - | yes |
| stage | Stage (e.g. `prod`, `dev`, `staging`) | string | - | yes |
| tags | Additional tags (e.g. map(`BusinessUnit`,`XYZ`) | map | `<map>` | no |

## Outputs

| Name | Description |
|:------------------|:----------------------------------------------------|
| role_name | The name of the crated role |
| role_id | The stable and unique string identifying the role |
| role_arn | The Amazon Resource Name (ARN) specifying the role |
| Name | Description |
|------|-------------|
| role_arn | The Amazon Resource Name (ARN) specifying the role |
| role_id | The stable and unique string identifying the role |
| role_name | The name of the crated role |




## Related Projects

Check out these related projects.

- [terraform-aws-ssm-parameter-store](https://github.com/cloudposse/terraform-aws-ssm-parameter-store) - Terraform module to populate AWS Systems Manager (SSM) Parameter Store with values from Terraform. Works great with Chamber.
- [terraform-aws-ssm-parameter-store-policy-documents](https://github.com/cloudposse/terraform-aws-ssm-parameter-store-policy-documents) - A Terraform module that generates JSON documents for access for common AWS SSM Parameter Store policies
- [terraform-aws-iam-chamber-user](https://github.com/cloudposse/terraform-aws-iam-chamber-user) - Terraform module to provision a basic IAM chamber user with access to SSM parameters and KMS key to decrypt secrets, suitable for CI/CD systems (e.g. TravisCI, CircleCI, CodeFresh) or systems which are external to AWS that cannot leverage AWS IAM Instance Profiles



## Help

**Got a question?**

Review the [docs](https://docs.cloudposse.com/), ask a [question](https://docs.cloudposse.com/discuss-new), file a GitHub [issue](https://github.com/cloudposse/terraform-aws-ssm-iam-role/issues), send us an [email](mailto:hello@cloudposse.com) or reach out to us on [Slack](https://slack.cloudposse.com).
File a GitHub [issue](https://github.com/cloudposse/terraform-aws-ssm-iam-role/issues), send us an [email][email] or join our [Slack Community][slack].

## Commercial Support

Work directly with our team of DevOps experts via email, slack, and video conferencing.

We provide [*commercial support*][commercial_support] for all of our [Open Source][github] projects. As a *Dedicated Support* customer, you have access to our team of subject matter experts at a fraction of the cost of a full-time engineer.

[![E-Mail](https://img.shields.io/badge/email-hello@cloudposse.com-blue.svg)](mailto:hello@cloudposse.com)

- **Questions.** We'll use a Shared Slack channel between your team and ours.
- **Troubleshooting.** We'll help you triage why things aren't working.
- **Code Reviews.** We'll review your Pull Requests and provide constructive feedback.
- **Bug Fixes.** We'll rapidly work to fix any bugs in our projects.
- **Build New Terraform Modules.** We'll develop original modules to provision infrastructure.
- **Cloud Architecture.** We'll assist with your cloud strategy and design.
- **Implementation.** We'll provide hands-on support to implement our reference architectures.


## Community Forum

Get access to our [Open Source Community Forum][slack] on Slack. It's **FREE** to join for everyone! Our "SweetOps" community is where you get to talk with others who share a similar vision for how to rollout and manage infrastructure. This is the best place to talk shop, ask questions, solicit feedback, and work together as a community to build *sweet* infrastructure.

## Contributing

Expand All @@ -138,22 +204,28 @@ Please use the [issue tracker](https://github.com/cloudposse/terraform-aws-ssm-i

### Developing

If you are interested in being a contributor and want to get involved in developing `terraform-aws-ssm-iam-role`, we would love to hear from you! Shoot us an [email](mailto:hello@cloudposse.com).
If you are interested in being a contributor and want to get involved in developing this project or [help out](https://github.com/orgs/cloudposse/projects/3) with our other projects, we would love to hear from you! Shoot us an [email](mailto:hello@cloudposse.com).

In general, PRs are welcome. We follow the typical "fork-and-pull" Git workflow.

1. **Fork** the repo on GitHub
2. **Clone** the project to your own machine
3. **Commit** changes to your own branch
4. **Push** your work back up to your fork
5. Submit a **Pull request** so that we can review your changes
5. Submit a **Pull Request** so that we can review your changes

**NOTE:** Be sure to merge the latest changes from "upstream" before making a pull request!


**NOTE:** Be sure to merge the latest from "upstream" before making a pull request!
## Copyright

Copyright © 2017-2018 [Cloud Posse, LLC](https://cloudposse.com)

## License

[APACHE 2.0](LICENSE) © 2018 [Cloud Posse, LLC](https://cloudposse.com)

## License

[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)

See [LICENSE](LICENSE) for full details.

Expand All @@ -165,7 +237,7 @@ See [LICENSE](LICENSE) for full details.
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0
https://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
Expand All @@ -175,35 +247,47 @@ See [LICENSE](LICENSE) for full details.
under the License.


## About

This project is maintained and funded by [Cloud Posse, LLC][website].

![Cloud Posse](https://cloudposse.com/logo-300x69.png)


Like it? Please let us know at <hello@cloudposse.com>

We love [Open Source Software](https://github.com/cloudposse/)!

See [our other projects][community]
or [hire us][hire] to help build your next cloud platform.

## Trademarks

All other trademarks referenced herein are the property of their respective owners.

## About

This project is maintained and funded by [Cloud Posse, LLC][website]. Like it? Please let us know at <hello@cloudposse.com>

[![Cloud Posse](https://cloudposse.com/logo-300x69.svg)](https://cloudposse.com)

We're a [DevOps Professional Services][hire] company based in Los Angeles, CA. We love [Open Source Software](https://github.com/cloudposse/)!

We offer paid support on all of our projects.

Check out [our other projects][github], [apply for a job][jobs], or [hire us][hire] to help with your cloud strategy and implementation.

[docs]: https://docs.cloudposse.com/
[website]: https://cloudposse.com/
[community]: https://github.com/cloudposse/
[github]: https://github.com/cloudposse/
[commercial_support]: https://github.com/orgs/cloudposse/projects
[jobs]: https://cloudposse.com/jobs/
[hire]: https://cloudposse.com/contact/
[slack]: https://slack.cloudposse.com/
[linkedin]: https://www.linkedin.com/company/cloudposse
[twitter]: https://twitter.com/cloudposse/
[email]: mailto:hello@cloudposse.com


### Contributors

| [![Andriy Knysh][aknysh_avatar]][aknysh_homepage]<br/>[Andriy Knysh][aknysh_homepage] |
|---|

## Contributors
[aknysh_homepage]: https://github.com/aknysh
[aknysh_avatar]: https://github.com/aknysh.png?size=150

| [![Erik Osterman][erik_img]][erik_web]<br/>[Erik Osterman][erik_web] | [![Andriy Knysh][andriy_img]][andriy_web]<br/>[Andriy Knysh][andriy_web] |[![Igor Rodionov][igor_img]][igor_web]<br/>[Igor Rodionov][igor_img]|[![Sarkis Varozian][sarkis_img]][sarkis_web]<br/>[Sarkis Varozian][sarkis_web] |
|-------------------------------------------------------|------------------------------------------------------------------|------------------------------------------------------------------|------------------------------------------------------------------|

[erik_img]: http://s.gravatar.com/avatar/88c480d4f73b813904e00a5695a454cb?s=144
[erik_web]: https://github.com/osterman/
[andriy_img]: https://avatars0.githubusercontent.com/u/7356997?v=4&u=ed9ce1c9151d552d985bdf5546772e14ef7ab617&s=144
[andriy_web]: https://github.com/aknysh/
[igor_img]: http://s.gravatar.com/avatar/bc70834d32ed4517568a1feb0b9be7e2?s=144
[igor_web]: https://github.com/goruha/
[sarkis_img]: https://avatars3.githubusercontent.com/u/42673?s=144&v=4
[sarkis_web]: https://github.com/sarkis/
Loading

0 comments on commit 58cdae5

Please sign in to comment.