Skip to content

Commit 7643203

Browse files
goruhagoruha
authored
Use only Principals Access Model (#22)
## What * Remove creation role if no participants provided ## Why * To prevent wrong using of terraform module
1 parent daf7796 commit 7643203

File tree

5 files changed

+23
-119
lines changed

5 files changed

+23
-119
lines changed

‎README.md

Lines changed: 4 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -112,17 +112,18 @@ Available targets:
112112
lint Lint terraform code
113113
114114
```
115-
116115
## Inputs
117116

118117
| Name | Description | Type | Default | Required |
119118
|------|-------------|:----:|:-----:|:-----:|
120119
| attributes | Additional attributes (e.g. `policy` or `role`) | list | `<list>` | no |
121120
| delimiter | Delimiter to be used between `name`, `namespace`, `stage`, etc. | string | `-` | no |
121+
| enabled | Set to false to prevent the module from creating any resources | string | `true` | no |
122122
| max_image_count | How many Docker Image versions AWS ECR will store | string | `7` | no |
123123
| name | The Name of the application or solution (e.g. `bastion` or `portal`) | string | - | yes |
124124
| namespace | Namespace (e.g. `cp` or `cloudposse`) | string | - | yes |
125-
| roles | Principal IAM roles to provide with access to the ECR | list | `<list>` | no |
125+
| principals_full_access | Principal ARN to provide with full access to the ECR | list | `<list>` | no |
126+
| principals_readonly_access | Principal ARN to provide with readonly access to the ECR | list | `<list>` | no |
126127
| stage | Stage (e.g. `prod`, `dev`, `staging`) | string | - | yes |
127128
| tags | Additional tags (e.g. `map('BusinessUnit','XYZ')`) | map | `<map>` | no |
128129
| use_fullname | Set 'true' to use `namespace-stage-name` for ecr repository name, else `name` | string | `true` | no |
@@ -131,17 +132,9 @@ Available targets:
131132

132133
| Name | Description |
133134
|------|-------------|
134-
| policy_login_arn | The IAM Policy ARN to be given access to login in ECR |
135-
| policy_login_name | The IAM Policy name to be given access to login in ECR |
136-
| policy_read_arn | The IAM Policy ARN to be given access to pull images from ECR |
137-
| policy_read_name | The IAM Policy name to be given access to pull images from ECR |
138-
| policy_write_arn | The IAM Policy ARN to be given access to push images to ECR |
139-
| policy_write_name | The IAM Policy name to be given access to push images to ECR |
140135
| registry_id | Registry ID |
141136
| registry_url | Registry URL |
142137
| repository_name | Registry name |
143-
| role_arn | Assume Role ARN to get registry access |
144-
| role_name | Assume Role name to get registry access |
145138

146139

147140

@@ -224,7 +217,7 @@ In general, PRs are welcome. We follow the typical "fork-and-pull" Git workflow.
224217

225218
## Copyright
226219

227-
Copyright © 2017-2018 [Cloud Posse, LLC](https://cpco.io/copyright)
220+
Copyright © 2017-2019 [Cloud Posse, LLC](https://cpco.io/copyright)
228221

229222

230223

‎docs/terraform.md

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,15 @@
1-
21
## Inputs
32

43
| Name | Description | Type | Default | Required |
54
|------|-------------|:----:|:-----:|:-----:|
65
| attributes | Additional attributes (e.g. `policy` or `role`) | list | `<list>` | no |
76
| delimiter | Delimiter to be used between `name`, `namespace`, `stage`, etc. | string | `-` | no |
7+
| enabled | Set to false to prevent the module from creating any resources | string | `true` | no |
88
| max_image_count | How many Docker Image versions AWS ECR will store | string | `7` | no |
99
| name | The Name of the application or solution (e.g. `bastion` or `portal`) | string | - | yes |
1010
| namespace | Namespace (e.g. `cp` or `cloudposse`) | string | - | yes |
11-
| roles | Principal IAM roles to provide with access to the ECR | list | `<list>` | no |
11+
| principals_full_access | Principal ARN to provide with full access to the ECR | list | `<list>` | no |
12+
| principals_readonly_access | Principal ARN to provide with readonly access to the ECR | list | `<list>` | no |
1213
| stage | Stage (e.g. `prod`, `dev`, `staging`) | string | - | yes |
1314
| tags | Additional tags (e.g. `map('BusinessUnit','XYZ')`) | map | `<map>` | no |
1415
| use_fullname | Set 'true' to use `namespace-stage-name` for ecr repository name, else `name` | string | `true` | no |
@@ -17,15 +18,7 @@
1718

1819
| Name | Description |
1920
|------|-------------|
20-
| policy_login_arn | The IAM Policy ARN to be given access to login in ECR |
21-
| policy_login_name | The IAM Policy name to be given access to login in ECR |
22-
| policy_read_arn | The IAM Policy ARN to be given access to pull images from ECR |
23-
| policy_read_name | The IAM Policy name to be given access to pull images from ECR |
24-
| policy_write_arn | The IAM Policy ARN to be given access to push images to ECR |
25-
| policy_write_name | The IAM Policy name to be given access to push images to ECR |
2621
| registry_id | Registry ID |
2722
| registry_url | Registry URL |
2823
| repository_name | Registry name |
29-
| role_arn | Assume Role ARN to get registry access |
30-
| role_name | Assume Role name to get registry access |
3124

‎main.tf

Lines changed: 8 additions & 85 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,12 @@
11
locals {
2-
principals_readonly_access_count = "${length(var.principals_readonly_access)}"
32
principals_readonly_access_non_empty = "${signum(length(var.principals_readonly_access))}"
4-
principals_readonly_access_empty = "${signum(length(var.principals_readonly_access)) == 0 ? 1 : 0}"
5-
6-
principals_full_access_count = "${length(var.principals_full_access)}"
7-
principals_full_access_non_empty = "${signum(length(var.principals_full_access))}"
8-
principals_full_access_empty = "${signum(length(var.principals_full_access)) == 0 ? 1 : 0}"
9-
10-
principals_total_count = "${length(var.principals_readonly_access) + length(var.principals_full_access)}"
11-
principals_total_non_empty = "${signum(length(var.principals_readonly_access) + length(var.principals_full_access))}"
12-
principals_total_empty = "${signum(length(var.principals_readonly_access) + length(var.principals_full_access)) == 0 ? 1 : 0}"
3+
principals_full_access_non_empty = "${signum(length(var.principals_full_access))}"
4+
ecr_need_policy = "${length(var.principals_full_access) + length(var.principals_readonly_access) > 0 ? "true" : "false"}"
135
}
146

157
module "label" {
168
source = "git::https://github.com/cloudposse/terraform-null-label.git?ref=tags/0.3.3"
9+
enabled = "${var.enabled}"
1710
namespace = "${var.namespace}"
1811
stage = "${var.stage}"
1912
name = "${var.name}"
@@ -23,10 +16,12 @@ module "label" {
2316
}
2417

2518
resource "aws_ecr_repository" "default" {
26-
name = "${var.use_fullname == "true" ? module.label.id : module.label.name}"
19+
count = "${var.enabled == "true" ? 1 : 0}"
20+
name = "${var.use_fullname == "true" ? module.label.id : module.label.name}"
2721
}
2822

2923
resource "aws_ecr_lifecycle_policy" "default" {
24+
count = "${var.enabled == "true" ? 1 : 0}"
3025
repository = "${aws_ecr_repository.default.name}"
3126

3227
policy = <<EOF
@@ -48,77 +43,6 @@ resource "aws_ecr_lifecycle_policy" "default" {
4843
EOF
4944
}
5045

51-
## If roles are empty
52-
## Create default role to provide full access.
53-
## The role can be attached or assumed
54-
55-
data "aws_iam_policy_document" "assume_role" {
56-
count = "${local.principals_total_empty}"
57-
58-
statement {
59-
sid = "EC2AssumeRole"
60-
effect = "Allow"
61-
actions = ["sts:AssumeRole"]
62-
63-
principals = {
64-
type = "Service"
65-
identifiers = ["ec2.amazonaws.com"]
66-
}
67-
}
68-
}
69-
70-
resource "aws_iam_role" "default" {
71-
count = "${local.principals_total_empty}"
72-
name = "${module.label.id}"
73-
assume_role_policy = "${data.aws_iam_policy_document.assume_role.json}"
74-
}
75-
76-
resource "aws_iam_instance_profile" "default" {
77-
count = "${local.principals_total_empty}"
78-
name = "${module.label.id}"
79-
role = "${aws_iam_role.default.name}"
80-
}
81-
82-
## Grant access to default role
83-
data "aws_iam_policy_document" "default_ecr" {
84-
count = "${local.principals_total_empty}"
85-
86-
statement {
87-
sid = "ECR"
88-
effect = "Allow"
89-
90-
principals = {
91-
type = "AWS"
92-
93-
identifiers = [
94-
"${aws_iam_role.default.arn}",
95-
]
96-
}
97-
98-
actions = [
99-
"ecr:GetDownloadUrlForLayer",
100-
"ecr:BatchGetImage",
101-
"ecr:BatchCheckLayerAvailability",
102-
"ecr:PutImage",
103-
"ecr:InitiateLayerUpload",
104-
"ecr:UploadLayerPart",
105-
"ecr:CompleteLayerUpload",
106-
"ecr:DescribeRepositories",
107-
"ecr:ListImages",
108-
"ecr:DescribeImages",
109-
]
110-
}
111-
}
112-
113-
resource "aws_ecr_repository_policy" "default_ecr" {
114-
count = "${local.principals_total_empty}"
115-
repository = "${aws_ecr_repository.default.name}"
116-
policy = "${data.aws_iam_policy_document.default_ecr.json}"
117-
}
118-
119-
## If any roles provided
120-
## Grant access to them
121-
12246
data "aws_iam_policy_document" "empty" {}
12347

12448
data "aws_iam_policy_document" "resource_readonly_access" {
@@ -178,14 +102,13 @@ data "aws_iam_policy_document" "resource_full_access" {
178102
}
179103

180104
data "aws_iam_policy_document" "resource" {
181-
count = "${local.principals_total_non_empty}"
182-
183105
source_json = "${local.principals_readonly_access_non_empty ? data.aws_iam_policy_document.resource_readonly_access.json : data.aws_iam_policy_document.empty.json}"
184106
override_json = "${local.principals_full_access_non_empty ? data.aws_iam_policy_document.resource_full_access.json : data.aws_iam_policy_document.empty.json}"
107+
"statement" = []
185108
}
186109

187110
resource "aws_ecr_repository_policy" "default" {
188-
count = "${local.principals_total_non_empty}"
111+
count = "${(local.ecr_need_policy == "true" && var.enabled == "true") ? 1 : 0}"
189112
repository = "${aws_ecr_repository.default.name}"
190113
policy = "${data.aws_iam_policy_document.resource.json}"
191114
}

‎output.tf

Lines changed: 3 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,14 @@
11
output "registry_id" {
2-
value = "${aws_ecr_repository.default.registry_id}"
2+
value = "${join("", aws_ecr_repository.default.*.registry_id)}"
33
description = "Registry ID"
44
}
55

66
output "registry_url" {
7-
value = "${aws_ecr_repository.default.repository_url}"
7+
value = "${join("", aws_ecr_repository.default.*.repository_url)}"
88
description = "Registry URL"
99
}
1010

1111
output "repository_name" {
12-
value = "${aws_ecr_repository.default.name}"
12+
value = "${join("", aws_ecr_repository.default.*.name)}"
1313
description = "Registry name"
1414
}
15-
16-
output "role_name" {
17-
value = "${join("", aws_iam_role.default.*.name)}"
18-
description = "Assume Role name to get registry access"
19-
}
20-
21-
output "role_arn" {
22-
value = "${join("", aws_iam_role.default.*.arn)}"
23-
description = "Assume Role ARN to get registry access"
24-
}

‎variables.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,11 @@ variable "stage" {
1010
description = "Stage (e.g. `prod`, `dev`, `staging`)"
1111
}
1212

13+
variable "enabled" {
14+
description = "Set to false to prevent the module from creating any resources"
15+
default = "true"
16+
}
17+
1318
variable "use_fullname" {
1419
type = "string"
1520
default = "true"

0 commit comments

Comments
 (0)