Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit 7f3f748

Browse files
sfn encryption (#66)
1 parent 14d5135 commit 7f3f748

File tree

7 files changed

+77
-9
lines changed

7 files changed

+77
-9
lines changed

‎README.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -134,13 +134,13 @@ module "step_function" {
134134
| Name | Version |
135135
|------|---------|
136136
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
137-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.6 |
137+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.61 |
138138

139139
## Providers
140140

141141
| Name | Version |
142142
|------|---------|
143-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.6 |
143+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.61 |
144144

145145
## Modules
146146

@@ -192,6 +192,7 @@ No modules.
192192
| <a name="input_create"></a> [create](#input\_create) | Whether to create Step Function resource | `bool` | `true` | no |
193193
| <a name="input_create_role"></a> [create\_role](#input\_create\_role) | Whether to create IAM role for the Step Function | `bool` | `true` | no |
194194
| <a name="input_definition"></a> [definition](#input\_definition) | The Amazon States Language definition of the Step Function | `string` | `""` | no |
195+
| <a name="input_encryption_configuration"></a> [encryption\_configuration](#input\_encryption\_configuration) | Defines what encryption configuration is used to encrypt data in the State Machine. | `any` | `{}` | no |
195196
| <a name="input_logging_configuration"></a> [logging\_configuration](#input\_logging\_configuration) | Defines what execution history events are logged and where they are logged | `map(string)` | `{}` | no |
196197
| <a name="input_name"></a> [name](#input\_name) | The name of the Step Function | `string` | `""` | no |
197198
| <a name="input_number_of_policies"></a> [number\_of\_policies](#input\_number\_of\_policies) | Number of policies to attach to IAM role | `number` | `0` | no |

‎examples/complete/README.md

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,15 +23,15 @@ Note that this example may create resources which cost money. Run `terraform des
2323
| Name | Version |
2424
|------|---------|
2525
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
26-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.6 |
26+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.61 |
2727
| <a name="requirement_null"></a> [null](#requirement\_null) | >= 2 |
2828
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 2 |
2929

3030
## Providers
3131

3232
| Name | Version |
3333
|------|---------|
34-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.6 |
34+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.61 |
3535
| <a name="provider_null"></a> [null](#provider\_null) | >= 2 |
3636
| <a name="provider_random"></a> [random](#provider\_random) | >= 2 |
3737

@@ -40,6 +40,7 @@ Note that this example may create resources which cost money. Run `terraform des
4040
| Name | Source | Version |
4141
|------|--------|---------|
4242
| <a name="module_disabled_step_function"></a> [disabled\_step\_function](#module\_disabled\_step\_function) | ../../ | n/a |
43+
| <a name="module_kms"></a> [kms](#module\_kms) | terraform-aws-modules/kms/aws | ~> 1.0 |
4344
| <a name="module_lambda_function"></a> [lambda\_function](#module\_lambda\_function) | terraform-aws-modules/lambda/aws | ~> 2.0 |
4445
| <a name="module_step_function"></a> [step\_function](#module\_step\_function) | ../../ | n/a |
4546
| <a name="module_step_function_with_existing_log_group"></a> [step\_function\_with\_existing\_log\_group](#module\_step\_function\_with\_existing\_log\_group) | ../../ | n/a |
@@ -52,6 +53,8 @@ Note that this example may create resources which cost money. Run `terraform des
5253
| [aws_sqs_queue.queue](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue) | resource |
5354
| [null_resource.download_package](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
5455
| [random_pet.this](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/pet) | resource |
56+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
57+
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
5558

5659
## Inputs
5760

‎examples/complete/main.tf

Lines changed: 51 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,14 @@ provider "aws" {
55
skip_metadata_api_check = true
66
skip_region_validation = true
77
skip_credentials_validation = true
8-
skip_requesting_account_id = true
98
}
109

10+
data "aws_caller_identity" "current" {}
11+
data "aws_region" "current" {}
12+
1113
locals {
14+
name = "ex-${basename(path.cwd)}"
15+
1216
definition_template = <<EOF
1317
{
1418
"Comment": "A Hello World example of the Amazon States Language using Pass states",
@@ -27,6 +31,12 @@ locals {
2731
}
2832
}
2933
EOF
34+
35+
tags = {
36+
Example = local.name
37+
GithubRepo = "terraform-aws-step-functions"
38+
GithubOrg = "terraform-aws-modules"
39+
}
3040
}
3141

3242
module "step_function" {
@@ -39,6 +49,12 @@ module "step_function" {
3949
definition = local.definition_template
4050
publish = true
4151

52+
encryption_configuration = {
53+
type = "CUSTOMER_MANAGED_KMS_KEY"
54+
kms_key_id = module.kms.key_arn
55+
kms_data_key_reuse_period_seconds = 600
56+
}
57+
4258
logging_configuration = {
4359
include_execution_data = true
4460
level = "ALL"
@@ -145,6 +161,16 @@ EOF
145161
actions = ["s3:HeadObject", "s3:GetObject"],
146162
resources = ["arn:aws:s3:::my-bucket/*"]
147163
}
164+
kms = {
165+
effect = "Allow"
166+
actions = ["kms:Decrypt", "kms:GenerateDataKey"]
167+
resources = [module.kms.key_arn]
168+
condition = [{
169+
test = "StringEquals"
170+
variable = "kms:EncryptionContext:aws:states:stateMachineArn"
171+
values = ["arn:aws:states:${data.aws_region.current.id}:${data.aws_caller_identity.current.account_id}:stateMachine:${random_pet.this.id}"]
172+
}]
173+
}
148174
}
149175

150176
###########################
@@ -157,9 +183,9 @@ EOF
157183
update = "30m"
158184
}
159185

160-
tags = {
186+
tags = merge(local.tags, {
161187
Module = "step_function"
162-
}
188+
})
163189
}
164190

165191
###############################################
@@ -168,6 +194,8 @@ EOF
168194

169195
resource "aws_cloudwatch_log_group" "external" {
170196
name = "${random_pet.this.id}-my-log-group"
197+
198+
tags = local.tags
171199
}
172200

173201
module "step_function_with_existing_log_group" {
@@ -187,6 +215,8 @@ module "step_function_with_existing_log_group" {
187215
level = "ERROR"
188216
}
189217

218+
tags = local.tags
219+
190220
depends_on = [aws_cloudwatch_log_group.external]
191221
}
192222

@@ -222,6 +252,8 @@ module "lambda_function" {
222252

223253
create_package = false
224254
local_existing_package = local.downloaded
255+
256+
tags = local.tags
225257
}
226258

227259
###########
@@ -244,4 +276,20 @@ resource "random_pet" "this" {
244276

245277
resource "aws_sqs_queue" "queue" {
246278
name = random_pet.this.id
279+
280+
tags = local.tags
281+
}
282+
283+
module "kms" {
284+
source = "terraform-aws-modules/kms/aws"
285+
version = "~> 1.0"
286+
description = "KMS key for step functions"
287+
288+
# Aliases
289+
aliases = [local.name]
290+
aliases_use_name_prefix = true
291+
292+
key_owners = [data.aws_caller_identity.current.arn]
293+
294+
tags = local.tags
247295
}

‎examples/complete/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.6"
7+
version = ">= 5.61"
88
}
99
random = {
1010
source = "hashicorp/random"

‎main.tf

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,16 @@ resource "aws_sfn_state_machine" "this" {
2121
definition = var.definition
2222
publish = var.publish
2323

24+
dynamic "encryption_configuration" {
25+
for_each = length(var.encryption_configuration) > 0 ? [var.encryption_configuration] : []
26+
27+
content {
28+
type = encryption_configuration.value.type
29+
kms_key_id = try(encryption_configuration.value.kms_key_id, null)
30+
kms_data_key_reuse_period_seconds = try(encryption_configuration.value.kms_data_key_reuse_period_seconds, null)
31+
}
32+
}
33+
2434
dynamic "logging_configuration" {
2535
for_each = local.enable_logging ? [true] : []
2636

‎variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,12 @@ variable "publish" {
7373
default = false
7474
}
7575

76+
variable "encryption_configuration" {
77+
description = "Defines what encryption configuration is used to encrypt data in the State Machine."
78+
type = any
79+
default = {}
80+
}
81+
7682
#################
7783
# CloudWatch Logs
7884
#################

‎versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.6"
7+
version = ">= 5.61"
88
}
99
}
1010
}

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /