- Description
- Setup - The basics of getting started with hiera_aws_secrets_manager
- Usage - Configuration options and additional functionality
- Reference - An under-the-hood peek at what the module is doing and how
- Limitations - OS compatibility, etc.
- Development - Guide for contributing to the module
Backend for Hiera 5 which allows lookups against Amazon Secrets Manager.
Based on the design of hiera-vault
Requires the aws-sdk
gem to be installed and available to your
Puppetmaster.
package {'aws-sdk':
ensure => installed
provider => puppetserver_gem
}
The following is a reference of a Hiera hierarchy using hiera_aws_sm.
---
hierarchy:
- name: "Hiera-AWS-SM lookup"
lookup_key: hiera_aws_sm
options:
continue_if_not_found: false
aws_access_key: <aws_access_key>
aws_secret_key: <aws_secret_key>
region: us-east-1
delimiter: /
prefixes:
- "%{::environment}/%{::trusted.certname}"
- "%{::environment}/common/"
- secret/puppet/%{::trusted.certname}/
- secret/puppet/common/
confine_to_keys:
- '^aws_.*'
### Mandatory Option Keys
name
: Human readable level name
lookup_key
: Must be set to hiera_aws_sm
continue_if_not_found
: Allow Puppet to lookup other data sources if the
key is not found in SecretsManager
aws_access_key
: IAM access key to be used to connect to AWS. Should only
be used for Puppet masters running outside of AWS. Puppet masters running
within AWS should have their access to SecretsManager granted via IAM
roles.
aws_secret_key
: IAM secret access key to be used to connect to AWS.
region
: AWS region to query against
delimiter
: Character used to join prefixes and keys if specified.
Defaults to /
. Not required if prefixes
is not set.
prefixes
: Optional array of prefixes to prepend to each lookup. For each
prefix, the function will perform a lookup of [prefix, key].join(delimiter)
against
SecretsManager. This allows you to specify multiple paths in
SecretsManager for the function to explore, as described above.
confine_to_keys
: List of regex expressions on which to search
SecretsManager. If specified, hiera_aws_sm will only query SecretsManager
for keys matching at least one specified regex. If none match, Puppet is
allowed to lookup against other data sources.
This module is only compatible with Hiera 5 (Puppet 4.9+)
pdk test unit
Author: David Hayes [[email protected]]
See LICENSE
### Steps required to publish module
rake module:bump_commit:<patch|minor|full>
rake module:tag
git push --tags
Travis will detect tagged commits, will build them, and push as a new release to the PuppetForge.
- Wrap secret values in Puppet's sensitive data types in examples.
- Expand README on usage and installation