Skip to content

Commit 9e1672b

Browse files
author
rohit-ng
committed
refactor: use parameter store for storing rds and github parameters
1 parent 74811c4 commit 9e1672b

File tree

6 files changed

+164
-43
lines changed

6 files changed

+164
-43
lines changed

‎.header.md

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# Prerequisites for Setting Up AWS SSM Parameters
2+
3+
To configure and manage your AWS resources and GitHub Actions using Secure String parameters in AWS Systems Manager Parameter Store, follow the steps below to add the required parameters:
4+
5+
## AWS CLI Installation
6+
7+
Ensure you have the AWS CLI installed on your machine. You can install the AWS CLI using the following commands based on your operating system:
8+
9+
### Windows
10+
```sh
11+
msiexec.exe /i https://awscli.amazonaws.com/AWSCLIV2.msi
12+
```
13+
14+
### macOS
15+
```sh
16+
brew install awscli
17+
```
18+
19+
### Linux
20+
```sh
21+
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
22+
unzip awscliv2.zip
23+
sudo ./aws/install
24+
```
25+
26+
## AWS CLI Configuration
27+
28+
Configure the AWS CLI with your AWS credentials and region. Run the following command and follow the prompts to enter your AWS Access Key, Secret Access Key, and default region:
29+
30+
```sh
31+
aws configure
32+
```
33+
34+
## Adding Parameters to AWS Systems Manager Parameter Store
35+
36+
Use the following commands to add the required parameters to AWS Systems Manager Parameter Store. These parameters are necessary for configuring your PostgreSQL database and GitHub Actions.
37+
38+
### RDS Parameters
39+
40+
```sh
41+
aws ssm put-parameter --name "/rds/POSTGRES_USERNAME" --value "value" --type "SecureString"
42+
aws ssm put-parameter --name "/rds/POSTGRES_PASSWORD" --value "value" --type "SecureString"
43+
aws ssm put-parameter --name "/rds/POSTGRES_DB_NAME" --value "value" --type "SecureString"
44+
```
45+
46+
### GitHub Parameters
47+
48+
```sh
49+
aws ssm put-parameter --name "/github-action/CONFIG_TOKEN" --value "value" --type "SecureString"
50+
aws ssm put-parameter --name "/github-action/CONFIG_URL" --value "value" --type "SecureString"
51+
```
52+
53+
## Verifying Parameter Storage
54+
55+
After adding the parameters, you can verify their storage in AWS Systems Manager Parameter Store using the following command:
56+
57+
```sh
58+
aws ssm get-parameters --names "/rds/POSTGRES_USERNAME" "/rds/POSTGRES_PASSWORD" "/rds/POSTGRES_DB_NAME" "/github-action/CONFIG_TOKEN" "/github-action/CONFIG_URL" --with-decryption
59+
```
60+
61+
This command will display the values of the stored parameters, ensuring they have been added correctly.

‎README.md

Lines changed: 64 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,65 @@
1+
# Prerequisites for Setting Up AWS SSM Parameters
2+
3+
To configure and manage your AWS resources and GitHub Actions using Secure String parameters in AWS Systems Manager Parameter Store, follow the steps below to add the required parameters:
4+
5+
## AWS CLI Installation
6+
7+
Ensure you have the AWS CLI installed on your machine. You can install the AWS CLI using the following commands based on your operating system:
8+
9+
### Windows
10+
```sh
11+
msiexec.exe /i https://awscli.amazonaws.com/AWSCLIV2.msi
12+
```
13+
14+
### macOS
15+
```sh
16+
brew install awscli
17+
```
18+
19+
### Linux
20+
```sh
21+
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
22+
unzip awscliv2.zip
23+
sudo ./aws/install
24+
```
25+
26+
## AWS CLI Configuration
27+
28+
Configure the AWS CLI with your AWS credentials and region. Run the following command and follow the prompts to enter your AWS Access Key, Secret Access Key, and default region:
29+
30+
```sh
31+
aws configure
32+
```
33+
34+
## Adding Parameters to AWS Systems Manager Parameter Store
35+
36+
Use the following commands to add the required parameters to AWS Systems Manager Parameter Store. These parameters are necessary for configuring your PostgreSQL database and GitHub Actions.
37+
38+
### RDS Parameters
39+
40+
```sh
41+
aws ssm put-parameter --name "/rds/POSTGRES_USERNAME" --value "value" --type "SecureString"
42+
aws ssm put-parameter --name "/rds/POSTGRES_PASSWORD" --value "value" --type "SecureString"
43+
aws ssm put-parameter --name "/rds/POSTGRES_DB_NAME" --value "value" --type "SecureString"
44+
```
45+
46+
### GitHub Parameters
47+
48+
```sh
49+
aws ssm put-parameter --name "/github-action/CONFIG_TOKEN" --value "value" --type "SecureString"
50+
aws ssm put-parameter --name "/github-action/CONFIG_URL" --value "value" --type "SecureString"
51+
```
52+
53+
## Verifying Parameter Storage
54+
55+
After adding the parameters, you can verify their storage in AWS Systems Manager Parameter Store using the following command:
56+
57+
```sh
58+
aws ssm get-parameters --names "/rds/POSTGRES_USERNAME" "/rds/POSTGRES_PASSWORD" "/rds/POSTGRES_DB_NAME" "/github-action/CONFIG_TOKEN" "/github-action/CONFIG_URL" --with-decryption
59+
```
60+
61+
This command will display the values of the stored parameters, ensuring they have been added correctly.
62+
163
## Requirements
264

365
| Name | Version |
@@ -33,6 +95,8 @@
3395
| Name | Type |
3496
|------|------|
3597
| [aws_ssm_parameter.ecs_node_ami](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source |
98+
| [aws_ssm_parameter.github](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source |
99+
| [aws_ssm_parameter.rds](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source |
36100
| [aws_vpc.vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc) | data source |
37101

38102
## Inputs
@@ -48,17 +112,12 @@
48112
| <a name="input_create_db_subnet_group"></a> [create\_db\_subnet\_group](#input\_create\_db\_subnet\_group) | Whether to create a DB subnet group | `bool` | `true` | no |
49113
| <a name="input_db_allocated_storage"></a> [db\_allocated\_storage](#input\_db\_allocated\_storage) | The amount of allocated storage in GBs | `number` | `20` | no |
50114
| <a name="input_db_max_allocated_storage"></a> [db\_max\_allocated\_storage](#input\_db\_max\_allocated\_storage) | The maximum amount of allocated storage in GBs | `number` | `100` | no |
51-
| <a name="input_db_name"></a> [db\_name](#input\_db\_name) | Database name | `string` | `"kong"` | no |
52-
| <a name="input_db_password"></a> [db\_password](#input\_db\_password) | Username for database | `string` | `"defaultpassword"` | no |
53-
| <a name="input_db_username"></a> [db\_username](#input\_db\_username) | Username for database | `string` | `"kong"` | no |
54115
| <a name="input_deletion_protection"></a> [deletion\_protection](#input\_deletion\_protection) | Whether to enable deletion protection | `bool` | `false` | no |
55116
| <a name="input_desired_capacity"></a> [desired\_capacity](#input\_desired\_capacity) | Desired capacity of auto scaling group | `number` | `2` | no |
56117
| <a name="input_desired_count_for_kong_service"></a> [desired\_count\_for\_kong\_service](#input\_desired\_count\_for\_kong\_service) | Desired count for kong service | `number` | `1` | no |
57118
| <a name="input_ecs_node_security_group_id"></a> [ecs\_node\_security\_group\_id](#input\_ecs\_node\_security\_group\_id) | ECS node security group id | `string` | `null` | no |
58119
| <a name="input_ecs_task_security_group_id"></a> [ecs\_task\_security\_group\_id](#input\_ecs\_task\_security\_group\_id) | ECS task security group id | `string` | `null` | no |
59120
| <a name="input_force_new_deployment"></a> [force\_new\_deployment](#input\_force\_new\_deployment) | Whether to force new deployment | `bool` | `true` | no |
60-
| <a name="input_github_config_token"></a> [github\_config\_token](#input\_github\_config\_token) | Github config token for self-hosted runner | `string` | n/a | yes |
61-
| <a name="input_github_config_url"></a> [github\_config\_url](#input\_github\_config\_url) | Github config url for self-hosted runner | `string` | n/a | yes |
62121
| <a name="input_instance_type_for_kong"></a> [instance\_type\_for\_kong](#input\_instance\_type\_for\_kong) | Instance type for kong | `string` | `"t2.micro"` | no |
63122
| <a name="input_key_name_for_kong"></a> [key\_name\_for\_kong](#input\_key\_name\_for\_kong) | Key name for to SSH into kong instance | `string` | `null` | no |
64123
| <a name="input_kong_admin_sub_domain_names"></a> [kong\_admin\_sub\_domain\_names](#input\_kong\_admin\_sub\_domain\_names) | List of kong admin sub domain names | `list(any)` | n/a | yes |

‎data.tf

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,15 @@ data "aws_ssm_parameter" "ecs_node_ami" {
55
data "aws_vpc" "vpc" {
66
id = var.vpc_id
77
}
8+
9+
data "aws_ssm_parameter" "rds" {
10+
for_each = toset(local.rds_parameters)
11+
name = "/rds/${each.value}"
12+
with_decryption = true
13+
}
14+
15+
data "aws_ssm_parameter" "github" {
16+
for_each = toset(local.github_parameters)
17+
name = "/github-action/${each.value}"
18+
with_decryption = true
19+
}

‎locals.tf

Lines changed: 22 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -54,14 +54,31 @@ locals {
5454
admin_domains = [for subdomain in var.kong_admin_sub_domain_names : "${subdomain}.${var.base_domain}"]
5555
}
5656

57+
rds_parameters = [
58+
"POSTGRES_USERNAME",
59+
"POSTGRES_PASSWORD",
60+
"POSTGRES_DB_NAME"
61+
]
62+
63+
github_parameters = [
64+
"CONFIG_TOKEN",
65+
"CONFIG_URL"
66+
]
67+
68+
postgres_username = data.aws_ssm_parameter.rds["POSTGRES_USERNAME"].value
69+
postgres_password = data.aws_ssm_parameter.rds["POSTGRES_PASSWORD"].value
70+
postgres_db_name = data.aws_ssm_parameter.rds["POSTGRES_DB_NAME"].value
71+
github_config_token = data.aws_ssm_parameter.github["CONFIG_TOKEN"].value
72+
github_config_url = data.aws_ssm_parameter.github["CONFIG_URL"].value
73+
5774
kong_parameters = {
58-
"KONG_ADMIN_LISTEN" = "0.0.0.0:8001, 0.0.0.0:8444 ssl"
59-
"KONG_PROXY_LISTEN" = "0.0.0.0:8000, 0.0.0.0:8443 ssl, 0.0.0.0:9080 http2, 0.0.0.0:9081 http2 ssl"
75+
"KONG_ADMIN_LISTEN" = "0.0.0.0:8001"
76+
"KONG_PROXY_LISTEN" = "0.0.0.0:8000"
6077
"KONG_DATABASE" = local.rds_engine
6178
"KONG_PG_HOST" = module.kong_rds.db_instance_address
62-
"KONG_PG_USER" = var.db_username
63-
"KONG_PG_PASSWORD" = var.db_password
64-
"KONG_PG_DATABASE" = var.db_name
79+
"KONG_PG_USER" = local.postgres_username
80+
"KONG_PG_PASSWORD" = local.postgres_password
81+
"KONG_PG_DATABASE" = local.postgres_db_name
6582
"KONG_PROXY_ACCESS_LOG" = "/dev/stdout"
6683
"KONG_ADMIN_ACCESS_LOG" = "/dev/stdout"
6784
"KONG_PROXY_ERROR_LOG" = "/dev/stderr"

‎main.tf

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -41,10 +41,10 @@ module "kong_rds" {
4141
multi_az = var.multi_az
4242

4343
manage_master_user_password = var.manage_master_user_password
44-
db_name = var.db_name
45-
username = var.db_username
44+
db_name = local.postgres_db_name
45+
username = local.postgres_username
4646
port = local.postgres.port
47-
password = var.db_password
47+
password = local.postgres_password
4848

4949
backup_retention_period = var.backup_retention_period
5050
backup_window = var.backup_window
@@ -368,6 +368,6 @@ module "github_runner" {
368368
source = "./modules/github-runner"
369369
vpc_id = var.vpc_id
370370
private_subnet_id = var.private_subnet_ids[0]
371-
github_config_token = var.github_config_token
372-
github_config_url = var.github_config_url
371+
github_config_token = local.github_config_token
372+
github_config_url = local.github_config_url
373373
}

‎variables.tf

Lines changed: 0 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -72,24 +72,6 @@ variable "performance_insights_retention_period" {
7272
default = 7
7373
}
7474

75-
variable "db_name" {
76-
description = "Database name"
77-
type = string
78-
default = "kong"
79-
}
80-
81-
variable "db_username" {
82-
description = "Username for database"
83-
type = string
84-
default = "kong"
85-
}
86-
87-
variable "db_password" {
88-
description = "Username for database"
89-
type = string
90-
default = "defaultpassword"
91-
}
92-
9375
variable "rds_db_tags" {
9476
description = "List of tags"
9577
type = map(string)
@@ -254,13 +236,3 @@ variable "instance_type_for_kong" {
254236
type = string
255237
default = "t2.micro"
256238
}
257-
258-
variable "github_config_token" {
259-
description = "Github config token for self-hosted runner"
260-
type = string
261-
}
262-
263-
variable "github_config_url" {
264-
description = "Github config url for self-hosted runner"
265-
type = string
266-
}

0 commit comments

Comments
 (0)