add ability to write secrets for amplify app #33
Conversation
kevcube
added
minor
|
/terratest |
|
💥 This pull request now has conflicts. Could you fix it @kevcube? 🙏 |
|
This PR was closed due to inactivity and merge conflicts. 😭 |
|
💥 This pull request now has conflicts. Could you fix it @kevcube? 🙏 |
…plify-app into write_secrets
|
/terratest |
It can be written externally, if someone wants to use remote-state or something to grab the amplify ID that's an option, but because amplify has the ability to access secrets stored at these predefined paths I thought it made sense to package in this module because they can be considered a part of the amplify application stack |
|
/terratest |
| module "write_ssm_secrets" { | ||
| source = "cloudposse/ssm-parameter-store/aws" | ||
| version = "0.13.0" | ||
|
|
||
| for_each = local.environments | ||
|
|
||
| parameter_write = [for secret_key, secret_value in each.value.secrets : { | ||
| name = format("/amplify/%s/%s/%s", one(aws_amplify_app.default[*].id), each.key, secret_key) | ||
| value = secret_value | ||
| type = "SecureString" | ||
| description = "AWS Amplify secret." | ||
| }] | ||
|
|
||
| context = module.this.context | ||
| } |
There was a problem hiding this comment.
| module "write_ssm_secrets" { | |
| source = "cloudposse/ssm-parameter-store/aws" | |
| version = "0.13.0" | |
| for_each = local.environments | |
| parameter_write = [for secret_key, secret_value in each.value.secrets : { | |
| name = format("/amplify/%s/%s/%s", one(aws_amplify_app.default[*].id), each.key, secret_key) | |
| value = secret_value | |
| type = "SecureString" | |
| description = "AWS Amplify secret." | |
| }] | |
| context = module.this.context | |
| } | |
| resource "aws_ssm_parameter" "default" { | |
| for_each = local.environments | |
| name = format("/amplify/%s/%s/%s", one(aws_amplify_app.default[*].id), each.key, secret_key) | |
| description = "AWS Amplify secret." | |
| type = "SecureString" | |
| tier = "Standard" | |
| value = secret_value | |
| overwrite = "false" | |
| data_type = "text" | |
| tags = module.this.tags | |
| } |
|
💥 This pull request now has conflicts. Could you fix it @kevcube? 🙏 |
|
This PR was closed due to inactivity and merge conflicts. 😭 |
what
Amplify can access secrets during build and runtime
This PR allows the
why
It may be useful depending on a user's secrets management pattern to write secrets here when creating the amplify app.
references
https://docs.aws.amazon.com/amplify/latest/userguide/environment-variables.html#environment-secrets
fixes #31