Merge pull request #14 from fvazquez-caylent/CA-10-Tag-based-authorization

Ca 10 tag based authorization

Author: fvazquez-caylent

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Tamr Terraform AWS Elasticsearch Repo
 
+## v2.1.0 - July 12nd 2021
+* Adds new variable `tags` to set tags for all resources
+* Deprecates `es_tags` in favor of `tags`
+
 ## v2.0.0 - October 13th 2020
 * New input variables for the main module:
     * `security_group_ids`

README.md

@@ -40,7 +40,7 @@ No provider.
 | enable\_http | If set to true, enables SSH | `bool` | `true` | no |
 | enable\_https | If set to true, enables SSH | `bool` | `true` | no |
 | enforce\_https | Whether or not to require HTTPS on the domain endpoint | `bool` | `true` | no |
-| es\_tags | Additional tags to be attached to the ES domain | `map(string)` | `{}` | no |
+| es\_tags | [DEPRECATED: Use `tags` instead] Additional tags to be attached to the ES domain and associated resources. | `map(string)` | `{}` | no |
 | es\_version | Version of ES to deploy | `string` | `"6.8"` | no |
 | ingress\_cidr\_blocks | CIDR blocks to attach to security groups for ingress | `list(string)` | `[]` | no |
 | ingress\_security\_groups | Existing security groups to attch to new security groups for ingress | `list(string)` | `[]` | no |
@@ -54,6 +54,7 @@ No provider.
 | sg\_name | Security Group to create | `string` | `"es-security-group"` | no |
 | sg\_tags | Additional tags to be attached to the security group | `map(string)` | `{}` | no |
 | snapshot\_start\_hour | Hour when an automated daily snapshot of the indices is taken | `number` | `0` | no |
+| tags | A map of tags to add to all resources. Replaces `es_tags`. | `map(string)` | `{}` | no |
 | tls\_security\_policy | The name of the TLS security policy that needs to be applied to the HTTPS endpoint.<br>  Valid values: Policy-Min-TLS-1-0-2019-07 and Policy-Min-TLS-1-2-2019-07. | `string` | `"Policy-Min-TLS-1-2-2019-07"` | no |
 
 ## Outputs

VERSION

@@ -1 +1 @@
-2.0.0
+2.1.0

examples/minimal/README.md

@@ -14,6 +14,7 @@ No requirements.
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | name-prefix | A string to prepend to names of resources created by this example | `any` | n/a | yes |
+| tags | A map of tags to add to all resources created by this example. | `map(string)` | <pre>{<br>  "Author": "Tamr",<br>  "Environment": "Example"<br>}</pre> | no |
 
 ## Outputs
 

examples/minimal/main.tf

@@ -1,10 +1,12 @@
 resource "aws_vpc" "es_vpc" {
   cidr_block = "1.2.3.0/24"
+  tags = var.tags
 }
 
 resource "aws_subnet" "es_subnet" {
   vpc_id     = aws_vpc.es_vpc.id
   cidr_block = "1.2.3.0/24"
+  tags = var.tags
 }
 
 module "sg-ports" {
@@ -23,6 +25,7 @@ module "aws-sg" {
   ]
   ingress_ports  = module.sg-ports.ingress_ports
   sg_name_prefix = var.name-prefix
+  tags = var.tags
 }
 
 module "tamr-es-cluster" {
@@ -33,4 +36,5 @@ module "tamr-es-cluster" {
   # Only needed once per account, so may need to set this to false
   create_new_service_role = true
   security_group_ids      = module.aws-sg.security_group_ids
+  tags = var.tags
 }

examples/minimal/variables.tf

@@ -1,3 +1,12 @@
 variable "name-prefix" {
   description = "A string to prepend to names of resources created by this example"
 }
+variable "tags" {
+  type        = map(string)
+  description = "A map of tags to add to all resources created by this example."
+  default = {
+    Author      = "Tamr"
+    Environment = "Example"
+  }
+}
+

main.tf

@@ -1,3 +1,7 @@
+locals {
+  effective_tags = length(var.tags) > 0 ? var.tags : var.es_tags
+}
+
 module "tamr-es-cluster" {
   source                          = "./modules/aws-es"
   domain_name                     = var.domain_name
@@ -11,7 +15,7 @@ module "tamr-es-cluster" {
   ebs_iops                        = var.ebs_iops
   ebs_volume_size                 = var.ebs_volume_size
   ebs_volume_type                 = var.ebs_volume_type
-  additional_tags                 = var.es_tags
+  tags                            = local.effective_tags
   aws_region                      = var.aws_region
   create_new_service_role         = var.create_new_service_role
   kms_key_id                      = var.kms_key_id

modules/aws-es/README.md

@@ -36,7 +36,6 @@ This modules creates:
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | subnet\_ids | List of subnet IDs for the ES domain to be created in | `list(string)` | n/a | yes |
-| additional\_tags | Additional tags to be attached to the ES domain | `map(string)` | `{}` | no |
 | arn\_partition | The partition in which the resource is located. A partition is a group of AWS Regions.<br>  Each AWS account is scoped to one partition.<br>  The following are the supported partitions:<br>    aws -AWS Regions<br>    aws-cn - China Regions<br>    aws-us-gov - AWS GovCloud (US) Regions | `string` | `"aws"` | no |
 | aws\_region | AWS region to launch in | `string` | `"us-east-1"` | no |
 | create\_new\_service\_role | Whether to create a new IAM service linked role for ES. This only needs to happen once per account. If false, linked\_service\_role is required | `bool` | `"true"` | no |
@@ -54,6 +53,7 @@ This modules creates:
 | node\_to\_node\_encryption\_enabled | Whether to enable node-to-node encryption | `bool` | `true` | no |
 | security\_group\_ids | List of security group IDs to be applied to the ES domain | `list(string)` | `[]` | no |
 | snapshot\_start\_hour | Hour when an automated daily snapshot of the indices is taken | `number` | `0` | no |
+| tags | A map of tags to add to all resources. | `map(string)` | `{}` | no |
 | tls\_security\_policy | The name of the TLS security policy that needs to be applied to the HTTPS endpoint.<br>  Valid values: Policy-Min-TLS-1-0-2019-07 and Policy-Min-TLS-1-2-2019-07. | `string` | `"Policy-Min-TLS-1-2-2019-07"` | no |
 
 ## Outputs

modules/aws-es/main.tf

@@ -39,7 +39,7 @@ resource "aws_elasticsearch_domain" "tamr-es-cluster" {
   }
 
 
-  tags = var.additional_tags
+  tags = var.tags
 
   depends_on = [
     var.linked_service_role,

modules/aws-es/variables.tf

@@ -66,10 +66,10 @@ variable "ebs_volume_type" {
   description = "The type of EBS volumes attached to data nodes"
 }
 
-variable "additional_tags" {
+variable "tags" {
   default     = {}
   type        = map(string)
-  description = "Additional tags to be attached to the ES domain"
+  description = "A map of tags to add to all resources."
 }
 
 variable "aws_region" {