README.yaml

#
# This is the canonical configuration for the `README.md`
# Run `make readme` to rebuild the `README.md`
#

# Name of this project
name: terraform-aws-ssm-parameter-store-policy-documents

# License of this project
license: "APACHE2"

# Canonical GitHub repo
github_repo: cloudposse/terraform-aws-ssm-parameter-store-policy-documents

# Badges to display
badges:
  - name: Latest Release
    image: https://img.shields.io/github/release/cloudposse/terraform-aws-ssm-parameter-store-policy-documents.svg?style=for-the-badge
    url: https://github.com/cloudposse/terraform-aws-ssm-parameter-store-policy-documents/releases/latest
  - name: Last Updated
    image: https://img.shields.io/github/last-commit/cloudposse/terraform-aws-ssm-parameter-store-policy-documents.svg?style=for-the-badge
    url: https://github.com/cloudposse/terraform-aws-ssm-parameter-store-policy-documents/commits
  - name: Slack Community
    image: https://slack.cloudposse.com/for-the-badge.svg
    url: https://slack.cloudposse.com

# List any related terraform modules that this module may be used with or that this module depends on.
related:
  - name: "terraform-aws-ssm-parameter-store"
    description: "Terraform module to populate AWS Systems Manager (SSM) Parameter Store with values from Terraform. Works great with Chamber."
    url: "https://github.com/cloudposse/terraform-aws-ssm-parameter-store"
  - name: "terraform-aws-ssm-iam-role"
    description: "Terraform module to provision an IAM role with configurable permissions to access SSM Parameter Store"
    url: "https://github.com/cloudposse/terraform-aws-ssm-iam-role"
  - name: "terraform-aws-kms-key"
    description: "Terraform module to provision a KMS key with alias"
    url: "https://github.com/cloudposse/terraform-aws-kms-key"

# Short description of this project
description: |-
  This module generates JSON documents for restricted permission sets for AWS SSM Parameter Store access.
  Helpful when combined with [terraform-aws-ssm-parameter-store](https://github.com/cloudposse/terraform-aws-ssm-parameter-store)

# How to use this project
examples: |-
  Create a policy that allows access to write all parameters
  ```hcl
  module "ps_policy" {
    source = "git::https://github.com/cloudposse/terraform-aws-ssm-parameter-store-policy-documents.git?ref=master"
  }

  resource "aws_iam_policy" "ps_write" {
    name_prefix   = "write_any_parameter_store_value"
    path   = "/"
    policy = "${module.ps_policy.write_parameter_store_policy}"
  }
  ```

  Create a policy that allows managing all policies
  ```hcl
  module "ps_policy" {
    source = "git::https://github.com/cloudposse/terraform-aws-ssm-parameter-store-policy-documents.git?ref=master"
  }

  resource "aws_iam_policy" "ps_manage" {
    name_prefix   = "manage_any_parameter_store_value"
    path   = "/"
    policy = "${module.ps_policy.manage_parameter_store_policy}"
  }
  ```

  Create a policy that allows reading all parameters that start with a certain prefix
  ```hcl
  module "ps_policy" {
    source              = "git::https://github.com/cloudposse/terraform-aws-ssm-parameter-store-policy-documents.git?ref=master"
    parameter_root_name = "/cp/dev/app"

  }

  resource "aws_iam_policy" "ps_manage" {
    name_prefix   = "write_specific_parameter_store_value"
    path   = "/"
    policy = "${module.ps_policy.manage_parameter_store_policy}"
  }
  ```

  Create a kms policy to allow decrypting of the parameter store values
  ```hcl
  module "kms_key" {
    source                  = "git::https://github.com/cloudposse/terraform-aws-kms-key.git?ref=master"
    namespace               = "cp"
    stage                   = "prod"
    name                    = "app"
    description             = "KMS key"
    deletion_window_in_days = 10
    enable_key_rotation     = "true"
    alias                   = "alias/parameter_store_key"
  }

  module "ps_policy" {
    source              = "git::https://github.com/cloudposse/terraform-aws-ssm-parameter-store-policy-documents.git?ref=master"
    parameter_root_name = "/cp/dev/app"
    kms_key             = "${module.kms_key.key_arn}"

  }

  resource "aws_iam_policy" "ps_kms" {
    name_prefix   = "decrypt_parameter_store_value"
    path   = "/"
    policy = "${module.ps_policy.manage_kms_store_policy}"
  }
  ```

  Create a policy for another account, or region
  ```hcl
  module "ps_policy" {
    source              = "git::https://github.com/cloudposse/terraform-aws-ssm-parameter-store-policy-documents.git?ref=master"
    parameter_root_name = "/cp/dev/app"
    account_id          = "783649272629220"
    region              = "ap-southeast-2"

  }

  resource "aws_iam_policy" "ps_manage" {
    name_prefix   = "manage_any_parameter_store_value"
    path   = "/"
    policy = "${module.ps_policy.manage_parameter_store_policy}"
  }
  ```

# Other files to include in this README from the project folder
include:
  - "docs/terraform.md"
  - "docs/targets.md"

# Contributors to this project
contributors: []