https://github.com/accenture/hiera-aws-sm
A Hiera 5 backend for AWS Secrets Manager
https://github.com/accenture/hiera-aws-sm
Last synced: over 1 year ago
JSON representation
A Hiera 5 backend for AWS Secrets Manager
- Host: GitHub
- URL: https://github.com/accenture/hiera-aws-sm
- Owner: Accenture
- License: other
- Created: 2018-11-06T07:52:54.000Z (over 7 years ago)
- Default Branch: master
- Last Pushed: 2023-08-03T17:56:24.000Z (almost 3 years ago)
- Last Synced: 2025-04-19T20:39:07.442Z (over 1 year ago)
- Language: Ruby
- Homepage:
- Size: 41 KB
- Stars: 5
- Watchers: 12
- Forks: 13
- Open Issues: 4
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- License: LICENSE.md
Awesome Lists containing this project
README
# hiera_aws_sm
[](https://travis-ci.org/Accenture/hiera-aws-sm)
[](https://forge.puppet.com/accenture/hiera_aws_sm)
#### Table of Contents
1. [Description](#description)
2. [Setup - The basics of getting started with hiera_aws_secrets_manager](#setup)
3. [Usage - Configuration options and additional functionality](#usage)
4. [Reference - An under-the-hood peek at what the module is doing and how](#reference)
5. [Limitations - OS compatibility, etc.](#limitations)
6. [Development - Guide for contributing to the module](#development)
## Description
Backend for Hiera 5 which allows lookups against Amazon Secrets Manager.
Based on the design of [hiera-vault](https://github.com/davealden/hiera-vault/blob/master/lib/puppet/functions/hiera_vault.rb)
## Setup
Requires the `aws-sdk` gem to be installed and available to your
Puppetmaster.
```
package {'aws-sdk':
ensure => installed
provider => puppetserver_gem
}
```
## Usage
The following is a reference of a Hiera hierarchy using hiera_aws_sm.
```
---
hierarchy:
- name: "Hiera-AWS-SM lookup"
lookup_key: hiera_aws_sm
options:
continue_if_not_found: false
aws_access_key:
aws_secret_key:
region: us-east-1
delimiter: /
prefixes:
- "%{::environment}/%{::trusted.certname}"
- "%{::environment}/common/"
- secret/puppet/%{::trusted.certname}/
- secret/puppet/common/
confine_to_keys:
- '^aws_.*'
```
### Mandatory Option Keys
`name`: Human readable level name
`lookup_key`: Must be set to `hiera_aws_sm`
### Optional Option Keys
`continue_if_not_found`: Allow Puppet to lookup other data sources if the
key is not found in SecretsManager
`aws_access_key`: IAM access key to be used to connect to AWS. Should only
be used for Puppet masters running outside of AWS. Puppet masters running
within AWS should have their access to SecretsManager granted via IAM
roles.
`aws_secret_key`: IAM secret access key to be used to connect to AWS.
`region`: AWS region to query against
`delimiter`: Character used to join prefixes and keys if specified.
Defaults to `/`. Not required if `prefixes` is not set.
`prefixes`: Optional array of prefixes to prepend to each lookup. For each
prefix, the function will perform a lookup of `[prefix, key].join(delimiter)` against
SecretsManager. This allows you to specify multiple paths in
SecretsManager for the function to explore, as described above.
`confine_to_keys`: List of regex expressions on which to search
SecretsManager. If specified, hiera_aws_sm will only query SecretsManager
for keys matching at least one specified regex. If none match, Puppet is
allowed to lookup against other data sources.
## Limitations
This module is only compatible with Hiera 5 (Puppet 4.9+)
## Testing
```
pdk test unit
```
## Development
Author: David Hayes [d.hayes@accenture.com]
## License
See [LICENSE](LICENSE.md)
## Release Notes
### Steps required to publish module
```
rake module:bump_commit:
rake module:tag
git push --tags
```
Travis will detect tagged commits, will build them, and push as a new
release to the PuppetForge.
## TBD
- Wrap secret values in Puppet's [sensitive data types](https://puppet.com/docs/puppet/5.5/lang_data_sensitive.html) in examples.
- Expand README on usage and installation