Skip to content

Commit cd5ebdb

Browse files
bryantbiggsbryantbiggs
authored
feat!: Update supported versions and add support for private key creation (#25)
1 parent a03b1fb commit cd5ebdb

File tree

12 files changed

+428
-77
lines changed

12 files changed

+428
-77
lines changed

‎.pre-commit-config.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
repos:
22
- repo: https://github.com/antonbabenko/pre-commit-terraform
3-
rev: v1.62.3
3+
rev: v1.74.1
44
hooks:
55
- id: terraform_fmt
66
- id: terraform_validate
@@ -23,7 +23,7 @@ repos:
2323
- '--args=--only=terraform_standard_module_structure'
2424
- '--args=--only=terraform_workspace_remote'
2525
- repo: https://github.com/pre-commit/pre-commit-hooks
26-
rev: v4.1.0
26+
rev: v4.3.0
2727
hooks:
2828
- id: check-merge-conflict
2929
- id: end-of-file-fixer

‎README.md

Lines changed: 45 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,23 @@
11
# AWS Key Pair Terraform module
22

3-
Terraform module which creates EC2 key pair resource by Terraform AWS provider.
3+
Terraform module which creates EC2 key pair on AWS.
4+
5+
[![SWUbanner](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/banner2-direct.svg)](https://github.com/vshymanskyy/StandWithUkraine/blob/main/docs/README.md)
46

57
## Usage
68

7-
### Create new EC2 key pair
9+
### EC2 Key pair w/ module created key material
10+
11+
```hcl
12+
module "key_pair" {
13+
source = "terraform-aws-modules/key-pair/aws"
14+
15+
key_name = "deployer-one"
16+
create_private_key = true
17+
}
18+
```
19+
20+
### EC2 Key pair w/ externally created public key material
821

922
```hcl
1023
resource "tls_private_key" "this" {
@@ -14,20 +27,19 @@ resource "tls_private_key" "this" {
1427
module "key_pair" {
1528
source = "terraform-aws-modules/key-pair/aws"
1629
17-
key_name = "deployer-one"
18-
public_key = tls_private_key.this.public_key_openssh
30+
key_name = "deployer-two"
31+
public_key = trimspace(tls_private_key.this.public_key_openssh)
1932
}
2033
```
2134

22-
### Import existing public key as EC2 key pair
35+
### EC2 Key pair w/ existing public key material
2336

2437
```hcl
2538
module "key_pair" {
2639
source = "terraform-aws-modules/key-pair/aws"
2740
28-
key_name = "deployer-two"
41+
key_name = "deployer-three"
2942
public_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD3F6tyPEFEzV0LX3X8BsXdMsQz1x2cEikKDEY0aIj41qgxMCP/iteneqXSIFZBp5vizPvaoIR3Um9xK7PGoW8giupGn+EPuxIA4cDM4vzOqOkiMPhz5XK0whEjkVzTo4+S0puvDZuwIsdiW9mxhJc7tgBNL0cYlWSYVkz4G/fslNfRPW5mYAM49f4fhtxPb5ok4Q2Lg9dPKVHO/Bgeu5woMc7RY0p1ej6D4CKFE6lymSDJpW0YHX/wqE9+cfEauh7xZcG0q9t2ta6F6fmX0agvpFyZo8aFbXeUBr7osSCJNgvavWbM/06niWrOvYX2xwWdhXmXSrbX8ZbabVohBK41 [email protected]"
30-
3143
}
3244
```
3345

@@ -40,7 +52,7 @@ Sometimes you need to have a way to create key pair conditionally but Terraform
4052
module "key_pair" {
4153
source = "terraform-aws-modules/key-pair/aws"
4254
43-
create_key_pair = false
55+
create = false
4456
# ... omitted
4557
}
4658
```
@@ -54,14 +66,16 @@ module "key_pair" {
5466

5567
| Name | Version |
5668
|------|---------|
57-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.6 |
58-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 2.46 |
69+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
70+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.21 |
71+
| <a name="requirement_tls"></a> [tls](#requirement\_tls) | >= 3.4 |
5972

6073
## Providers
6174

6275
| Name | Version |
6376
|------|---------|
64-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 2.46 |
77+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.21 |
78+
| <a name="provider_tls"></a> [tls](#provider\_tls) | >= 3.4 |
6579

6680
## Modules
6781

@@ -72,24 +86,36 @@ No modules.
7286
| Name | Type |
7387
|------|------|
7488
| [aws_key_pair.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/key_pair) | resource |
89+
| [tls_private_key.this](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/private_key) | resource |
7590

7691
## Inputs
7792

7893
| Name | Description | Type | Default | Required |
7994
|------|-------------|------|---------|:--------:|
80-
| <a name="input_create_key_pair"></a> [create\_key\_pair](#input\_create\_key\_pair) | Controls if key pair should be created | `bool` | `true` | no |
81-
| <a name="input_key_name"></a> [key\_name](#input\_key\_name) | The name for the key pair. | `string` | `null` | no |
82-
| <a name="input_key_name_prefix"></a> [key\_name\_prefix](#input\_key\_name\_prefix) | Creates a unique name beginning with the specified prefix. Conflicts with key\_name. | `string` | `null` | no |
83-
| <a name="input_public_key"></a> [public\_key](#input\_public\_key) | The public key material. | `string` | `""` | no |
84-
| <a name="input_tags"></a> [tags](#input\_tags) | A map of tags to add to key pair resource. | `map(string)` | `{}` | no |
95+
| <a name="input_create"></a> [create](#input\_create) | Determines whether resources will be created (affects all resources) | `bool` | `true` | no |
96+
| <a name="input_create_private_key"></a> [create\_private\_key](#input\_create\_private\_key) | Determines whether a private key will be created | `bool` | `false` | no |
97+
| <a name="input_key_name"></a> [key\_name](#input\_key\_name) | The name for the key pair. Conflicts with `key_name_prefix` | `string` | `null` | no |
98+
| <a name="input_key_name_prefix"></a> [key\_name\_prefix](#input\_key\_name\_prefix) | Creates a unique name beginning with the specified prefix. Conflicts with `key_name` | `string` | `null` | no |
99+
| <a name="input_private_key_algorithm"></a> [private\_key\_algorithm](#input\_private\_key\_algorithm) | Name of the algorithm to use when generating the private key. Currently-supported values are `RSA` and `ED25519` | `string` | `"RSA"` | no |
100+
| <a name="input_private_key_rsa_bits"></a> [private\_key\_rsa\_bits](#input\_private\_key\_rsa\_bits) | When algorithm is `RSA`, the size of the generated RSA key, in bits (default: `4096`) | `number` | `4096` | no |
101+
| <a name="input_public_key"></a> [public\_key](#input\_public\_key) | The public key material | `string` | `""` | no |
102+
| <a name="input_tags"></a> [tags](#input\_tags) | A map of tags to add to all resources | `map(string)` | `{}` | no |
85103

86104
## Outputs
87105

88106
| Name | Description |
89107
|------|-------------|
90-
| <a name="output_key_pair_fingerprint"></a> [key\_pair\_fingerprint](#output\_key\_pair\_fingerprint) | The MD5 public key fingerprint as specified in section 4 of RFC 4716. |
91-
| <a name="output_key_pair_key_name"></a> [key\_pair\_key\_name](#output\_key\_pair\_key\_name) | The key pair name. |
92-
| <a name="output_key_pair_key_pair_id"></a> [key\_pair\_key\_pair\_id](#output\_key\_pair\_key\_pair\_id) | The key pair ID. |
108+
| <a name="output_key_pair_arn"></a> [key\_pair\_arn](#output\_key\_pair\_arn) | The key pair ARN |
109+
| <a name="output_key_pair_fingerprint"></a> [key\_pair\_fingerprint](#output\_key\_pair\_fingerprint) | The MD5 public key fingerprint as specified in section 4 of RFC 4716 |
110+
| <a name="output_key_pair_id"></a> [key\_pair\_id](#output\_key\_pair\_id) | The key pair ID |
111+
| <a name="output_key_pair_name"></a> [key\_pair\_name](#output\_key\_pair\_name) | The key pair name |
112+
| <a name="output_private_key_id"></a> [private\_key\_id](#output\_private\_key\_id) | Unique identifier for this resource: hexadecimal representation of the SHA1 checksum of the resource |
113+
| <a name="output_private_key_openssh"></a> [private\_key\_openssh](#output\_private\_key\_openssh) | Private key data in OpenSSH PEM (RFC 4716) format |
114+
| <a name="output_private_key_pem"></a> [private\_key\_pem](#output\_private\_key\_pem) | Private key data in PEM (RFC 1421) format |
115+
| <a name="output_public_key_fingerprint_md5"></a> [public\_key\_fingerprint\_md5](#output\_public\_key\_fingerprint\_md5) | The fingerprint of the public key data in OpenSSH MD5 hash format, e.g. `aa:bb:cc:....` Only available if the selected private key format is compatible, similarly to `public_key_openssh` and the ECDSA P224 limitations |
116+
| <a name="output_public_key_fingerprint_sha256"></a> [public\_key\_fingerprint\_sha256](#output\_public\_key\_fingerprint\_sha256) | The fingerprint of the public key data in OpenSSH SHA256 hash format, e.g. `SHA256:....` Only available if the selected private key format is compatible, similarly to `public_key_openssh` and the ECDSA P224 limitations |
117+
| <a name="output_public_key_openssh"></a> [public\_key\_openssh](#output\_public\_key\_openssh) | The public key data in "Authorized Keys" format. This is populated only if the configured private key is supported: this includes all `RSA` and `ED25519` keys |
118+
| <a name="output_public_key_pem"></a> [public\_key\_pem](#output\_public\_key\_pem) | Public key data in PEM (RFC 1421) format |
93119
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
94120

95121
## Authors

‎UPGRADE-2.0.md

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# Upgrade from v1.x to v2.x
2+
3+
Please consult the `examples` directory for reference example configurations. If you find a bug, please open an issue with supporting configuration to reproduce.
4+
5+
## List of backwards incompatible changes
6+
7+
- Minimum supported version of Terraform AWS provider updated to v4.21 to support latest resources
8+
- Minimum supported version of Terraform updated to v1.0
9+
- The variable `create_key_pair` is now simply `create`
10+
11+
## Additional changes
12+
13+
### Added
14+
15+
- Support for creating private key within the module using the commonly used `tls_private_key` resource
16+
17+
### Modified
18+
19+
- None
20+
21+
### Removed
22+
23+
- None
24+
25+
### Variable and output changes
26+
27+
1. Removed variables:
28+
29+
- None
30+
31+
2. Renamed variables:
32+
33+
- `create_key_pair` -> `create`
34+
35+
3. Added variables:
36+
37+
- `create_private_key`
38+
- `private_key_algorithm`
39+
- `private_key_rsa_bits`
40+
41+
4. Removed outputs:
42+
43+
- None
44+
45+
5. Renamed outputs:
46+
47+
- `key_pair_key_pair_id` -> `key_pair_id`
48+
- `key_pair_key_name` -> `key_pair_name`
49+
50+
51+
6. Added outputs:
52+
53+
- `key_pair_arn`
54+
- `private_key_id`
55+
- `private_key_openssh`
56+
- `private_key_pem`
57+
- `public_key_fingerprint_md5`
58+
- `public_key_fingerprint_sha256`
59+
- `public_key_openssh`
60+
- `public_key_pem`
61+
62+
## Upgrade Migrations
63+
64+
### State Move Commands
65+
66+
None required

‎examples/README.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Examples
2+
3+
Please note - the examples provided serve two primary means:
4+
5+
1. Show users working examples of the various ways in which the module can be configured and features supported
6+
2. A means of testing/validating module changes
7+
8+
Please do not mistake the examples provided as "best practices". It is up to users to consult the AWS service documentation for best practices, usage recommendations, etc.

‎examples/complete/README.md

Lines changed: 30 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@
22

33
Configuration in this directory creates EC2 key pair
44

5+
- One key pair with a module created private key (private/public key pair)
6+
- One key pair with external provided public key material
7+
58
## Usage
69

710
To run this example you need to execute:
@@ -19,30 +22,28 @@ Note that this example may create resources which cost money. Run `terraform des
1922

2023
| Name | Version |
2124
|------|---------|
22-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.6 |
23-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 2.46 |
24-
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 2.0 |
25-
| <a name="requirement_tls"></a> [tls](#requirement\_tls) | >= 1.0 |
25+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
26+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.21 |
27+
| <a name="requirement_tls"></a> [tls](#requirement\_tls) | >= 3.4 |
2628

2729
## Providers
2830

2931
| Name | Version |
3032
|------|---------|
31-
| <a name="provider_random"></a> [random](#provider\_random) | >= 2.0 |
32-
| <a name="provider_tls"></a> [tls](#provider\_tls) | >= 1.0 |
33+
| <a name="provider_tls"></a> [tls](#provider\_tls) | >= 3.4 |
3334

3435
## Modules
3536

3637
| Name | Source | Version |
3738
|------|--------|---------|
3839
| <a name="module_key_pair"></a> [key\_pair](#module\_key\_pair) | ../../ | n/a |
40+
| <a name="module_key_pair_disabled"></a> [key\_pair\_disabled](#module\_key\_pair\_disabled) | ../../ | n/a |
3941
| <a name="module_key_pair_external"></a> [key\_pair\_external](#module\_key\_pair\_external) | ../../ | n/a |
4042

4143
## Resources
4244

4345
| Name | Type |
4446
|------|------|
45-
| [random_pet.this](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/pet) | resource |
4647
| [tls_private_key.this](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/private_key) | resource |
4748

4849
## Inputs
@@ -53,7 +54,26 @@ No inputs.
5354

5455
| Name | Description |
5556
|------|-------------|
56-
| <a name="output_key_pair_fingerprint"></a> [key\_pair\_fingerprint](#output\_key\_pair\_fingerprint) | The MD5 public key fingerprint as specified in section 4 of RFC 4716. |
57-
| <a name="output_key_pair_key_name"></a> [key\_pair\_key\_name](#output\_key\_pair\_key\_name) | The key pair name. |
58-
| <a name="output_key_pair_key_pair_id"></a> [key\_pair\_key\_pair\_id](#output\_key\_pair\_key\_pair\_id) | The key pair ID. |
57+
| <a name="output_external_key_pair_arn"></a> [external\_key\_pair\_arn](#output\_external\_key\_pair\_arn) | The key pair ARN |
58+
| <a name="output_external_key_pair_fingerprint"></a> [external\_key\_pair\_fingerprint](#output\_external\_key\_pair\_fingerprint) | The MD5 public key fingerprint as specified in section 4 of RFC 4716 |
59+
| <a name="output_external_key_pair_id"></a> [external\_key\_pair\_id](#output\_external\_key\_pair\_id) | The key pair ID |
60+
| <a name="output_external_key_pair_name"></a> [external\_key\_pair\_name](#output\_external\_key\_pair\_name) | The key pair name |
61+
| <a name="output_external_private_key_id"></a> [external\_private\_key\_id](#output\_external\_private\_key\_id) | Unique identifier for this resource: hexadecimal representation of the SHA1 checksum of the resource |
62+
| <a name="output_external_private_key_openssh"></a> [external\_private\_key\_openssh](#output\_external\_private\_key\_openssh) | Private key data in OpenSSH PEM (RFC 4716) format |
63+
| <a name="output_external_private_key_pem"></a> [external\_private\_key\_pem](#output\_external\_private\_key\_pem) | Private key data in PEM (RFC 1421) format |
64+
| <a name="output_external_public_key_fingerprint_md5"></a> [external\_public\_key\_fingerprint\_md5](#output\_external\_public\_key\_fingerprint\_md5) | The fingerprint of the public key data in OpenSSH MD5 hash format, e.g. `aa:bb:cc:....` Only available if the selected private key format is compatible, similarly to `public_key_openssh` and the ECDSA P224 limitations |
65+
| <a name="output_external_public_key_fingerprint_sha256"></a> [external\_public\_key\_fingerprint\_sha256](#output\_external\_public\_key\_fingerprint\_sha256) | The fingerprint of the public key data in OpenSSH SHA256 hash format, e.g. `SHA256:....` Only available if the selected private key format is compatible, similarly to `public_key_openssh` and the ECDSA P224 limitations |
66+
| <a name="output_external_public_key_openssh"></a> [external\_public\_key\_openssh](#output\_external\_public\_key\_openssh) | The public key data in "Authorized Keys" format. This is populated only if the configured private key is supported: this includes all `RSA` and `ED25519` keys |
67+
| <a name="output_external_public_key_pem"></a> [external\_public\_key\_pem](#output\_external\_public\_key\_pem) | Public key data in PEM (RFC 1421) format |
68+
| <a name="output_key_pair_arn"></a> [key\_pair\_arn](#output\_key\_pair\_arn) | The key pair ARN |
69+
| <a name="output_key_pair_fingerprint"></a> [key\_pair\_fingerprint](#output\_key\_pair\_fingerprint) | The MD5 public key fingerprint as specified in section 4 of RFC 4716 |
70+
| <a name="output_key_pair_id"></a> [key\_pair\_id](#output\_key\_pair\_id) | The key pair ID |
71+
| <a name="output_key_pair_name"></a> [key\_pair\_name](#output\_key\_pair\_name) | The key pair name |
72+
| <a name="output_private_key_id"></a> [private\_key\_id](#output\_private\_key\_id) | Unique identifier for this resource: hexadecimal representation of the SHA1 checksum of the resource |
73+
| <a name="output_private_key_openssh"></a> [private\_key\_openssh](#output\_private\_key\_openssh) | Private key data in OpenSSH PEM (RFC 4716) format |
74+
| <a name="output_private_key_pem"></a> [private\_key\_pem](#output\_private\_key\_pem) | Private key data in PEM (RFC 1421) format |
75+
| <a name="output_public_key_fingerprint_md5"></a> [public\_key\_fingerprint\_md5](#output\_public\_key\_fingerprint\_md5) | The fingerprint of the public key data in OpenSSH MD5 hash format, e.g. `aa:bb:cc:....` Only available if the selected private key format is compatible, similarly to `public_key_openssh` and the ECDSA P224 limitations |
76+
| <a name="output_public_key_fingerprint_sha256"></a> [public\_key\_fingerprint\_sha256](#output\_public\_key\_fingerprint\_sha256) | The fingerprint of the public key data in OpenSSH SHA256 hash format, e.g. `SHA256:....` Only available if the selected private key format is compatible, similarly to `public_key_openssh` and the ECDSA P224 limitations |
77+
| <a name="output_public_key_openssh"></a> [public\_key\_openssh](#output\_public\_key\_openssh) | The public key data in "Authorized Keys" format. This is populated only if the configured private key is supported: this includes all `RSA` and `ED25519` keys |
78+
| <a name="output_public_key_pem"></a> [public\_key\_pem](#output\_public\_key\_pem) | Public key data in PEM (RFC 1421) format |
5979
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/complete/main.tf

Lines changed: 35 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,50 @@
1-
resource "random_pet" "this" {
2-
length = 2
1+
provider "aws" {
2+
region = local.region
33
}
44

5-
resource "tls_private_key" "this" {
6-
algorithm = "RSA"
5+
locals {
6+
name = "ex-${replace(basename(path.cwd), "_", "-")}"
7+
region = "eu-west-1"
8+
9+
tags = {
10+
Example = local.name
11+
GithubRepo = "terraform-aws-key-pair"
12+
GithubOrg = "terraform-aws-modules"
13+
}
714
}
815

16+
################################################################################
17+
# Key Pair Module
18+
################################################################################
19+
920
module "key_pair" {
1021
source = "../../"
1122

12-
key_name = random_pet.this.id
13-
public_key = tls_private_key.this.public_key_openssh
23+
key_name = local.name
24+
create_private_key = true
1425

15-
tags = {
16-
Terraform = "<3"
17-
}
26+
tags = local.tags
1827
}
1928

2029
module "key_pair_external" {
2130
source = "../../"
2231

23-
key_name = "${random_pet.this.id}-external"
24-
public_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD3F6tyPEFEzV0LX3X8BsXdMsQz1x2cEikKDEY0aIj41qgxMCP/iteneqXSIFZBp5vizPvaoIR3Um9xK7PGoW8giupGn+EPuxIA4cDM4vzOqOkiMPhz5XK0whEjkVzTo4+S0puvDZuwIsdiW9mxhJc7tgBNL0cYlWSYVkz4G/fslNfRPW5mYAM49f4fhtxPb5ok4Q2Lg9dPKVHO/Bgeu5woMc7RY0p1ej6D4CKFE6lymSDJpW0YHX/wqE9+cfEauh7xZcG0q9t2ta6F6fmX0agvpFyZo8aFbXeUBr7osSCJNgvavWbM/06niWrOvYX2xwWdhXmXSrbX8ZbabVohBK41 [email protected]"
32+
key_name = "${local.name}-external"
33+
public_key = trimspace(tls_private_key.this.public_key_openssh)
2534

26-
tags = {
27-
External = "yes"
28-
}
35+
tags = local.tags
36+
}
37+
38+
module "key_pair_disabled" {
39+
source = "../../"
40+
41+
create = false
42+
}
43+
44+
################################################################################
45+
# Supporting Resources
46+
################################################################################
47+
48+
resource "tls_private_key" "this" {
49+
algorithm = "RSA"
2950
}

0 commit comments

Comments
 (0)