Skip to content

Commit ab410cd

Browse files
Scott WinklerScott Winkler
Scott Winkler
authored and
Scott Winkler
committed
add chapter 12
1 parent 4724f9a commit ab410cd

File tree

40 files changed

+487
-81
lines changed

40 files changed

+487
-81
lines changed

‎chapter1/archive/listing1.4/main.tf

-14
This file was deleted.

‎chapter1/listing1.1/main.tf

+4-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
resource "aws_instance" "helloworld" {
2-
ami = "ami-944162ec"
2+
ami = "ami-09dd2e08d601bff67"
33
instance_type = "t2.micro"
4+
tags = {
5+
Name = "HelloWorld"
6+
}
47
}

‎chapter1/listing1.2/main.tf

+5-2
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,12 @@
11
provider "aws" {
2-
version = "2.12.0"
2+
version = "2.65.0"
33
region = "us-west-2"
44
}
55

66
resource "aws_instance" "helloworld" {
7-
ami = "ami-944162ec"
7+
ami = "ami-09dd2e08d601bff67"
88
instance_type = "t2.micro"
9+
tags = {
10+
Name = "HelloWorld"
11+
}
912
}

‎chapter1/listing1.3/main.tf

+7-4
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,23 @@
11
provider "aws" {
2-
version = "2.12.0"
3-
region = "us-west-2"
2+
version = "2.65.0"
3+
region = "us-west-2"
44
}
55

66
data "aws_ami" "ubuntu" {
77
most_recent = true
88

99
filter {
1010
name = "name"
11-
values = ["ubuntu/images/hvm-ssd/ubuntu-bionic-18.04-amd64-server-*"]
11+
values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"]
1212
}
1313

1414
owners = ["099720109477"]
1515
}
1616

1717
resource "aws_instance" "helloworld" {
18-
ami = data.aws_ami.ubuntu.id
18+
ami = data.aws_ami.ubuntu.id
1919
instance_type = "t2.micro"
20+
tags = {
21+
Name = "HelloWorld"
22+
}
2023
}

‎chapter1/snippet1.1/cf.json

+10-4
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,17 @@
11
{
22
"Resources": {
3-
"helloworld": {
3+
"Example": {
44
"Type": "AWS::EC2::Instance",
55
"Properties": {
6-
"ImageId": "ami-944162ec",
7-
"InstanceType": "t2.micro"
6+
"ImageId": "ami-09dd2e08d601bff67",
7+
"InstanceType": "t2.micro",
8+
"Tags": [
9+
{
10+
"Key": "Name",
11+
"Value": "HelloWorld"
12+
}
13+
]
814
}
915
}
1016
}
11-
}
17+
}

‎chapter12/listing12.1/state.json

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"mode": "managed",
3+
"type": "aws_db_instance",
4+
"name": "database",
5+
"provider": "provider.aws",
6+
"instances": [
7+
{
8+
"schema_version": 1,
9+
"attributes": {
10+
"password": "hunter2",
11+
"performance_insights_enabled": false,
12+
"performance_insights_kms_key_id": "",
13+
"performance_insights_retention_period": 0,
14+
"port": 5432,
15+
"publicly_accessible": false,
16+
"replicas": [],
17+
"replicate_source_db": "",
18+
"resource_id": "db-O6TUYBMS2HGAY7GKSLTL5H4JEM",
19+
"s3_import": [],
20+
"security_group_names": null,
21+
"skip_final_snapshot": false,
22+
"snapshot_identifier": null,
23+
"status": "available",
24+
"storage_encrypted": false,
25+
"storage_type": "gp2",
26+
"tags": null,
27+
"timeouts": null,
28+
"timezone": "",
29+
"username": "AzureDiamond"
30+
}
31+
}
32+
]
33+
}

‎chapter12/listing12.10/block.sentinel

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
import "tfconfig/v2" as tfconfig
2+
3+
keywordInProvisioners = func(s){
4+
bad_provisioners = filter tfconfig.provisioners as _, p {
5+
p.type is "local-exec" and
6+
p.config.command["constant_value"] matches s
7+
}
8+
return length(bad_provisioners) > 0
9+
}
10+
11+
no_access_keys = rule {
12+
not keywordInProvisioners("AWS_ACCESS_KEY_ID")
13+
}
14+
15+
no_secret_keys = rule {
16+
not keywordInProvisioners("AWS_SECRET_ACCESS_KEY")
17+
}
18+
19+
main = rule {
20+
no_access_keys and
21+
no_secret_keys
22+
}

‎chapter12/listing12.2/main.tf

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
resource "aws_lambda_function" "lambda" {
2+
filename = "code.zip"
3+
function_name = "${local.namespace}-lambda"
4+
role = aws_iam_role.lambda.arn
5+
handler = "exports.main"
6+
7+
source_code_hash = filebase64sha256("code.zip")
8+
runtime = "nodejs12.x"
9+
10+
environment {
11+
variables = {
12+
USERNAME = var.username
13+
PASSWORD = var.password
14+
}
15+
}
16+
}

‎chapter12/listing12.3/main.tf

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
resource "aws_lambda_function" "lambda" {
2+
filename = "code.zip"
3+
function_name = "${local.namespace}-lambda"
4+
role = aws_iam_role.lambda.arn
5+
handler = "exports.main"
6+
7+
source_code_hash = filebase64sha256("code.zip")
8+
runtime = "nodejs12.x"
9+
10+
environment {
11+
variables = {
12+
SECRET_ID = var.secret_id #A
13+
}
14+
}
15+
}

‎chapter12/listing12.4/lambda.go

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
package main
2+
3+
import (
4+
"context"
5+
"fmt"
6+
"os"
7+
8+
"github.com/aws/aws-lambda-go/lambda"
9+
"github.com/aws/aws-sdk-go/aws"
10+
11+
"github.com/aws/aws-sdk-go/aws/session"
12+
"github.com/aws/aws-sdk-go/service/secretsmanager"
13+
)
14+
15+
func HandleRequest(ctx context.Context) error {
16+
client := secretsmanager.New(session.New())
17+
config := &secretsmanager.GetSecretValueInput{
18+
SecretId: aws.String(os.Getenv("SECRET_ID")),
19+
}
20+
val, err := client.GetSecretValue(config) #A
21+
if err != nil {
22+
return err
23+
}
24+
25+
// do something with secret value
26+
fmt.Printf("Secret is: %s", *val.SecretString)
27+
28+
return nil
29+
}
30+
31+
func main() {
32+
lambda.Start(HandleRequest)
33+
}

‎chapter12/listing12.5/policy.json

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Sid": "",
6+
"Effect": "Allow",
7+
"Action": "s3:ListBucket",
8+
"Resource": "arn:aws:s3:::tia-state-bucket"
9+
},
10+
{
11+
"Sid": "",
12+
"Effect": "Allow",
13+
"Action": [
14+
"s3:PutObject",
15+
"s3:GetObject"
16+
],
17+
"Resource": "arn:aws:s3:::tia-state-bucket/team1/*"
18+
},
19+
{
20+
"Sid": "",
21+
"Effect": "Allow",
22+
"Action": [
23+
"dynamodb:PutItem",
24+
"dynamodb:GetItem",
25+
"dynamodb:DeleteItem"
26+
],
27+
"Resource": "arn:aws:dynamodb:us-west-2:215974853022:table/tia-state-lock"
28+
}
29+
]
30+
}

‎chapter12/listing12.6/log.txt

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
Trying to get account information via sts:GetCallerIdentity
2+
[aws-sdk-go] DEBUG: Request sts/GetCallerIdentity Details:
3+
---[ REQUEST POST-SIGN ]-----------------------------
4+
POST / HTTP/1.1
5+
Host: sts.amazonaws.com
6+
User-Agent: aws-sdk-go/1.30.16 (go1.13.7; darwin; amd64) APN/1.0 HashiCorp/1.0 Terraform/0.12.24 (+https://www.terraform.io)
7+
Content-Length: 43
8+
Authorization: AWS4-HMAC-SHA256 Credential=AKIATESI2XGPMMVVB7XL/20200504/us-east-1/sts/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-date, Signature=c4df301a200eb46d278ce1b6b9ead1cfbe64f045caf9934a14e9b7f8c207c3f8
9+
#A
10+
Content-Type: application/x-www-form-urlencoded; charset=utf-8
11+
X-Amz-Date: 20200504T084221Z
12+
Accept-Encoding: gzip
13+
Action=GetCallerIdentity&Version=2011-06-15
14+
-----------------------------------------------------
15+
[aws-sdk-go] DEBUG: Response sts/GetCallerIdentity Details:
16+
---[ RESPONSE ]--------------------------------------
17+
HTTP/1.1 200 OK
18+
Connection: close
19+
Content-Length: 405
20+
Content-Type: text/xml
21+
Date: Mon, 04 May 2020 07:37:21 GMT
22+
X-Amzn-Requestid: 74b2886b-43bc-475c-bda3-846123059142
23+
-----------------------------------------------------
24+
[aws-sdk-go] <GetCallerIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
25+
<GetCallerIdentityResult>
26+
<Arn>arn:aws:iam::215974853022:user/swinkler</Arn> #B
27+
<UserId>AIDAJKZ3K7CTQHZ5F4F52</UserId> #B
28+
<Account>215974853022</Account> #B
29+
</GetCallerIdentityResult>
30+
<ResponseMetadata>
31+
<RequestId>74b2886b-43bc-475c-bda3-846123059142</RequestId>
32+
</ResponseMetadata>
33+
</GetCallerIdentityResponse>

‎chapter12/listing12.7/log.txt

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
$ curl -L -X POST 'https://sts.amazonaws.com' \
2+
-H 'Host: sts.amazonaws.com' \
3+
-H 'Authorization: AWS4-HMAC-SHA256 Credential=AKIATESI2XGPMMVVB7XL/20200504/us-east-1/sts/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-date, Signature=c4df301a200eb46d278ce1b6b9ead1cfbe64f045caf9934a14e9b7f8c207c3f8' \
4+
-H 'Content-Type: application/x-www-form-urlencoded; charset=utf-8' \
5+
-H 'X-Amz-Date: 20200504T084221Z' \
6+
-H 'Accept-Encoding: gzip' \
7+
--data-urlencode 'Action=GetCallerIdentity' \
8+
--data-urlencode 'Version=2011-06-15'
9+
10+
<GetCallerIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
11+
<GetCallerIdentityResult>
12+
<Arn>arn:aws:iam::215974853022:user/swinkler</Arn>
13+
<UserId>AIDAJKZ3K7CTQHZ5F4F52</UserId>
14+
<Account>215974853022</Account>
15+
</GetCallerIdentityResult>
16+
<ResponseMetadata>
17+
<RequestId>e6870ff6-a09e-4479-8860-c3ca08b323b5</RequestId>
18+
</ResponseMetadata>
19+
</GetCallerIdentityResponse>

‎chapter12/listing12.8/main.tf

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
provider "vault" {
2+
address = var.vault_address
3+
}
4+
5+
data "vault_aws_access_credentials" "creds" {
6+
backend = "aws"
7+
role = "prod-role"
8+
}
9+
10+
provider "aws" {
11+
access_key = data.vault_aws_access_credentials.creds.access_key
12+
secret_key = data.vault_aws_access_credentials.creds.secret_key
13+
region = "us-west-2"
14+
}

‎chapter12/listing12.9/main.tf

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
data "aws_secretsmanager_secret_version" "db" {
2+
secret_id = var.secret_id
3+
}
4+
5+
locals {
6+
creds = jsondecode(data.aws_secretsmanager_secret_version.db.secret_string)
7+
}
8+
9+
resource "aws_db_instance" "database" {
10+
allocated_storage = 20
11+
engine = "postgres"
12+
engine_version = "12.2"
13+
instance_class = "db.t2.micro"
14+
name = "ptfe"
15+
username = local.creds["username"]
16+
password = local.creds["password"]
17+
}

‎chapter12/snippet12.1/main.tf

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
resource "aws_db_instance" "database" {
2+
allocated_storage = 20
3+
engine = "postgres"
4+
engine_version = "9.5"
5+
instance_class = "db.t3.medium"
6+
name = "ptfe"
7+
username = var.username
8+
password = var.password
9+
}

‎chapter12/snippet12.10/main.tf

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
resource "local_file" "aws" {
2+
filename = "credentials.txt"
3+
content = <<-EOF
4+
access_key = ${var.access_key}
5+
secret_key = ${var.secret_key}
6+
EOF
7+
}

‎chapter12/snippet12.11/main.tf

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
resource "aws_s3_bucket_object" "aws" {
2+
key = "creds.txt"
3+
bucket = var.bucket_name
4+
content = <<-EOF
5+
access_key = ${var.access_key}
6+
secret_key = ${var.secret_key}
7+
EOF
8+
}

‎chapter12/snippet12.12/main.tf

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
provider "aws" {
2+
region = "us-west-2"
3+
}

‎chapter12/snippet12.13/main.tf

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
data "local_file" "credentials" {
2+
filename = "/Users/Admin/.aws/credentials"
3+
}

‎chapter12/snippet12.14/main.tf

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
resource "aws_db_instance" "database" {
2+
allocated_storage = 20
3+
engine = "postgres"
4+
engine_version = "9.5"
5+
instance_class = "db.t3.medium"
6+
name = "ptfe"
7+
username = var.username
8+
password = var.password
9+
}

‎chapter12/snippet12.15/log.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
$ terraform apply \
2+
-var-file="secrets.tfvars" \
3+
-var-file="production.tfvars"

‎chapter12/snippet12.16/trivial.sentinel

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
main = rule {
2+
true
3+
}

‎chapter12/snippet12.17/main.tf

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
resource "null_resource" "uh_oh" {
2+
provisioner "local-exec" {
3+
command = <<-EOF
4+
echo "access_key=$AWS_ACCESS_KEY_ID"
5+
echo "secret_key=$AWS_SECRET_ACCESS_KEY"
6+
EOF
7+
}
8+
}

0 commit comments

Comments
 (0)