Add initial module configuration

.chglog/CHANGELOG.tpl.md

@@ -0,0 +1,111 @@
+# Change Log
+
+All notable changes to this project will be documented in this file.
+
+{{ if .Versions -}}
+<a name="unreleased"></a>
+## [Unreleased]
+{{ if .Unreleased.CommitGroups -}}
+{{ range .Unreleased.CommitGroups -}}
+### {{ .Title }}
+{{ range .Commits -}}
+{{/* SKIPPING RULES - START */ -}}
+{{- if not (hasPrefix .Subject "Updated CHANGELOG") -}}
+{{- if not (contains .Subject "[ci skip]") -}}
+{{- if not (contains .Subject "[skip ci]") -}}
+{{- if not (hasPrefix .Subject "Merge pull request ") -}}
+{{- if not (hasPrefix .Subject "Added CHANGELOG") -}}
+{{- /* SKIPPING RULES - END */ -}}
+- {{ if .Scope }}**{{ .Scope }}:** {{ end }}{{ .Subject }}
+{{/* SKIPPING RULES - START */ -}}
+{{ end -}}
+{{ end -}}
+{{ end -}}
+{{ end -}}
+{{ end -}}
+{{/* SKIPPING RULES - END */ -}}
+{{ end }}
+{{ end -}}
+{{ else }}
+{{ range .Unreleased.Commits -}}
+{{/* SKIPPING RULES - START */ -}}
+{{- if not (hasPrefix .Subject "Updated CHANGELOG") -}}
+{{- if not (contains .Subject "[ci skip]") -}}
+{{- if not (contains .Subject "[skip ci]") -}}
+{{- if not (hasPrefix .Subject "Merge pull request ") -}}
+{{- if not (hasPrefix .Subject "Added CHANGELOG") -}}
+{{- /* SKIPPING RULES - END */ -}}
+- {{ if .Scope }}**{{ .Scope }}:** {{ end }}{{ .Subject }}
+{{/* SKIPPING RULES - START */ -}}
+{{ end -}}
+{{ end -}}
+{{ end -}}
+{{ end -}}
+{{ end -}}
+{{/* SKIPPING RULES - END */ -}}
+{{ end }}
+{{ end -}}
+{{ end -}}
+
+{{ range .Versions }}
+<a name="{{ .Tag.Name }}"></a>
+## {{ if .Tag.Previous }}[{{ .Tag.Name }}]{{ else }}{{ .Tag.Name }}{{ end }} - {{ datetime "2006-01-02" .Tag.Date }}
+{{ if .CommitGroups -}}
+{{ range .CommitGroups -}}
+### {{ .Title }}
+{{ range .Commits -}}
+{{/* SKIPPING RULES - START */ -}}
+{{- if not (hasPrefix .Subject "Updated CHANGELOG") -}}
+{{- if not (contains .Subject "[ci skip]") -}}
+{{- if not (contains .Subject "[skip ci]") -}}
+{{- if not (hasPrefix .Subject "Merge pull request ") -}}
+{{- if not (hasPrefix .Subject "Added CHANGELOG") -}}
+{{- /* SKIPPING RULES - END */ -}}
+- {{ if .Scope }}**{{ .Scope }}:** {{ end }}{{ .Subject }}
+{{/* SKIPPING RULES - START */ -}}
+{{ end -}}
+{{ end -}}
+{{ end -}}
+{{ end -}}
+{{ end -}}
+{{/* SKIPPING RULES - END */ -}}
+{{ end }}
+{{ end -}}
+{{ else }}
+{{ range .Commits -}}
+{{/* SKIPPING RULES - START */ -}}
+{{- if not (hasPrefix .Subject "Updated CHANGELOG") -}}
+{{- if not (contains .Subject "[ci skip]") -}}
+{{- if not (contains .Subject "[skip ci]") -}}
+{{- if not (hasPrefix .Subject "Merge pull request ") -}}
+{{- if not (hasPrefix .Subject "Added CHANGELOG") -}}
+{{- /* SKIPPING RULES - END */ -}}
+- {{ if .Scope }}**{{ .Scope }}:** {{ end }}{{ .Subject }}
+{{/* SKIPPING RULES - START */ -}}
+{{ end -}}
+{{ end -}}
+{{ end -}}
+{{ end -}}
+{{ end -}}
+{{/* SKIPPING RULES - END */ -}}
+{{ end }}
+{{ end -}}
+
+{{- if .NoteGroups -}}
+{{ range .NoteGroups -}}
+### {{ .Title }}
+{{ range .Notes }}
+{{ .Body }}
+{{ end }}
+{{ end -}}
+{{ end -}}
+{{ end -}}
+
+{{- if .Versions }}
+[Unreleased]: {{ .Info.RepositoryURL }}/compare/{{ $latest := index .Versions 0 }}{{ $latest.Tag.Name }}...HEAD
+{{ range .Versions -}}
+{{ if .Tag.Previous -}}
+[{{ .Tag.Name }}]: {{ $.Info.RepositoryURL }}/compare/{{ .Tag.Previous.Name }}...{{ .Tag.Name }}
+{{ end -}}
+{{ end -}}
+{{ end -}}

.chglog/config.yml

@@ -0,0 +1,10 @@
+style: github
+template: CHANGELOG.tpl.md
+info:
+  title: CHANGELOG
+  repository_url: https://github.com/marcincuber/terraform-aws-ssm-parameters
+options:
+  header:
+    pattern: "^(.*)$"
+    pattern_maps:
+      - Subject

.pre-commit-config.yaml

@@ -0,0 +1,25 @@
+repos:
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v2.5.0
+  hooks:
+  - id: check-added-large-files
+    args: ['--maxkb=500']
+  - id: check-executables-have-shebangs
+  - id: pretty-format-json
+    args: ['--autofix', '--no-sort-keys', '--indent=2']
+  - id: check-byte-order-marker
+  - id: check-case-conflict
+  - id: check-executables-have-shebangs
+  - id: check-merge-conflict
+  - id: check-symlinks
+  - id: detect-private-key
+  - id: check-merge-conflict
+  - id: detect-aws-credentials
+    args: ['--allow-missing-credentials']
+  - id: trailing-whitespace
+- repo: git://github.com/antonbabenko/pre-commit-terraform
+  rev: v1.30.0
+  hooks:
+  - id: terraform_fmt
+  - id: terraform_docs
+  - id: terraform_tflint

LICENSE

@@ -0,0 +1,11 @@
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

Makefile

@@ -0,0 +1,19 @@
+ifneq (,)
+.error This Makefile requires GNU Make.
+endif
+
+.PHONY: hooks validate changelog
+
+help:
+	@grep -E '^[a-zA-Z0-9_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
+
+hooks: ## Commit hooks setup
+	@pre-commit install
+	@pre-commit gc
+	@pre-commit autoupdate
+
+validate: ## Validate files with pre-commit hooks
+	@pre-commit run --all-files
+
+changelog:
+	git-chglog -o CHANGELOG.md

README.md

@@ -1,2 +1,105 @@
 # terraform-aws-ssm-parameters
-Terraform module creating encrypted and non-encrypted AWS SSM parameters 
+Terraform module creating encrypted and non-encrypted AWS SSM parameters
+
+## Terraform versions
+
+Terraform 0.12. Pin module version to `~> v1.0`. Submit pull-requests to `master` branch.
+
+## Usage
+
+```hcl
+module "ssm-parameters" {
+  source = "umotif-public/ssm-parameters/aws"
+  version = "~> 1.0.0"
+
+  name_prefix = "test/example-path"
+
+  parameters = {
+    "audit" = "cloudwatch"
+  }
+
+  secure_parameters = {
+    "secure-audit" = "cloudwatch"
+  }
+
+  advanced_tier = [
+    "secure-audit"
+  ]
+
+  prevent_overwrite = [
+    "audit"
+  ]
+
+  kms_key_id = module.kms.key_id
+
+  tags = {
+    "Environment" = "test"
+  }
+}
+```
+
+## Assumptions
+
+Module is to be used with Terraform > 0.12.
+
+## Examples
+
+* [SSM Parameters](https://github.com/umotif-public/terraform-aws-ssm-parameters/tree/master/examples/core)
+
+## Authors
+
+Module managed by [Marcin Cuber](https://github.com/marcincuber) [LinkedIn](https://www.linkedin.com/in/marcincuber/).
+
+<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+## Requirements
+
+No requirements.
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| aws | n/a |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| advanced\_tier | List of parameter names that should have tier set to Advanced | `list(string)` | `[]` | no |
+| kms\_key\_id | The KMS key to use for encryption | `string` | `""` | no |
+| name\_prefix | Path used for each SSM parameter created by the module | `any` | n/a | yes |
+| parameters | Non-encrypted parameters | `map(any)` | `{}` | no |
+| prevent\_overwrite | List of parameter names to prevent overwrite for | `list(string)` | `[]` | no |
+| secure\_parameters | Secure parameters | `map(any)` | `{}` | no |
+| tags | n/a | `map(any)` | `{}` | no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| parameter\_path | n/a |
+| parameters | n/a |
+| secure\_parameters | n/a |
+
+<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+
+## License
+
+See LICENSE for full details.
+
+## Pre-commit hooks
+
+### Install dependencies
+
+* [`pre-commit`](https://pre-commit.com/#install)
+* [`terraform-docs`](https://github.com/segmentio/terraform-docs) required for `terraform_docs` hooks.
+* [`TFLint`](https://github.com/terraform-linters/tflint) required for `terraform_tflint` hook.
+
+#### MacOS
+
+```bash
+brew install pre-commit terraform-docs tflint
+
+brew tap git-chglog/git-chglog
+brew install git-chglog
+```

examples/core/README.md

@@ -0,0 +1,9 @@
+
+## Example deployment flow
+
+```bash
+terraform init
+terraform validate
+terraform plan
+terraform apply --auto-approve
+```

examples/core/main.tf

@@ -0,0 +1,37 @@
+provider "aws" {
+  region = "eu-west-1"
+}
+
+module "kms" {
+  source  = "umotif-public/kms/aws"
+  version = "1.0.0"
+
+  alias_name = "test-key"
+}
+
+module "parameters" {
+  source = "../.."
+
+  name_prefix = "test/example-path"
+  parameters = {
+    "audit" = "cloudwatch"
+  }
+
+  secure_parameters = {
+    "secure-audit" = "cloudwatch"
+  }
+
+  advanced_tier = [
+    "secure-audit"
+  ]
+
+  prevent_overwrite = [
+    "audit"
+  ]
+
+  kms_key_id = module.kms.key_id
+
+  tags = {
+    "Environment" = "test"
+  }
+}

main.tf

@@ -0,0 +1,26 @@
+resource "aws_ssm_parameter" "parameters" {
+  for_each = var.parameters
+
+  name  = "/${var.name_prefix}/${each.key}"
+  type  = "String"
+  value = each.value
+
+  tier      = contains(var.advanced_tier, each.key) ? "Advanced" : "Standard"
+  overwrite = contains(var.prevent_overwrite, each.key) ? false : true
+
+  tags = var.tags
+}
+
+resource "aws_ssm_parameter" "secure_parameters" {
+  for_each = var.secure_parameters
+
+  name   = "/${var.name_prefix}/${each.key}"
+  type   = "SecureString"
+  value  = each.value
+  key_id = var.kms_key_id != "" ? var.kms_key_id : null
+
+  tier      = contains(var.advanced_tier, each.key) ? "Advanced" : "Standard"
+  overwrite = contains(var.prevent_overwrite, each.key) ? false : true
+
+  tags = var.tags
+}

outputs.tf

@@ -0,0 +1,11 @@
+output "parameter_path" {
+  value = var.name_prefix
+}
+
+output "parameters" {
+  value = aws_ssm_parameter.parameters
+}
+
+output "secure_parameters" {
+  value = aws_ssm_parameter.secure_parameters
+}