diff --git a/examples/existing-cluster-with-base-and-infra/README.md b/examples/existing-cluster-with-base-and-infra/README.md index a2a22630..98b2344c 100644 --- a/examples/existing-cluster-with-base-and-infra/README.md +++ b/examples/existing-cluster-with-base-and-infra/README.md @@ -36,6 +36,7 @@ View the full documentation for this example [here](https://aws-observability.gi | Name | Source | Version | |------|--------|---------| | [eks\_monitoring](#module\_eks\_monitoring) | ../../modules/eks-monitoring | n/a | +| [grafana\_key\_rotation](#module\_grafana\_key\_rotation) | ../../modules/grafana-key-rotation | n/a | ## Resources @@ -52,7 +53,12 @@ View the full documentation for this example [here](https://aws-observability.gi | [aws\_region](#input\_aws\_region) | AWS Region | `string` | n/a | yes | | [eks\_cluster\_id](#input\_eks\_cluster\_id) | Name of the EKS cluster | `string` | `"eks-cluster-with-vpc"` | no | | [enable\_dashboards](#input\_enable\_dashboards) | Enables or disables curated dashboards. Dashboards are managed by the Grafana Operator | `bool` | `true` | no | +| [enable\_grafana\_key\_rotation](#input\_enable\_grafana\_key\_rotation) | Enables or disables Grafana API key rotation | `bool` | `true` | no | +| [eventbridge\_scheduler\_schedule\_expression](#input\_eventbridge\_scheduler\_schedule\_expression) | Schedule Expression for EventBridge Scheduler in Grafana API Key Rotation | `string` | `"rate(60 minutes)"` | no | | [grafana\_api\_key](#input\_grafana\_api\_key) | API key for authorizing the Grafana provider to make changes to Amazon Managed Grafana | `string` | n/a | yes | +| [grafana\_api\_key\_interval](#input\_grafana\_api\_key\_interval) | Number of seconds for secondsToLive value while creating API Key | `number` | `5400` | no | +| [grafana\_api\_key\_refresh\_interval](#input\_grafana\_api\_key\_refresh\_interval) | Refresh Internal to be used by External Secrets for Grafana API Key rotation | `string` | `"5m"` | no | +| [lambda\_runtime\_grafana\_key\_rotation](#input\_lambda\_runtime\_grafana\_key\_rotation) | Python Runtime Identifier for the Lambda Function | `string` | `"python3.12"` | no | | [managed\_grafana\_workspace\_id](#input\_managed\_grafana\_workspace\_id) | Amazon Managed Grafana Workspace ID | `string` | n/a | yes | | [managed\_prometheus\_workspace\_id](#input\_managed\_prometheus\_workspace\_id) | Amazon Managed Service for Prometheus Workspace ID | `string` | `""` | no | @@ -62,6 +68,10 @@ View the full documentation for this example [here](https://aws-observability.gi |------|-------------| | [eks\_cluster\_id](#output\_eks\_cluster\_id) | EKS Cluster Id | | [eks\_cluster\_version](#output\_eks\_cluster\_version) | EKS Cluster version | +| [grafana\_key\_rotation\_eventbridge\_scheduler\_arn](#output\_grafana\_key\_rotation\_eventbridge\_scheduler\_arn) | ARN of the EventBridge Scheduler invoking Lambda Function for Key rotation | +| [grafana\_key\_rotation\_eventbridge\_scheduler\_role\_arn](#output\_grafana\_key\_rotation\_eventbridge\_scheduler\_role\_arn) | ARN of the IAM Role of EventBridge Scheduler invoking Lambda Function for Key rotation | +| [grafana\_key\_rotation\_lambda\_function\_arn](#output\_grafana\_key\_rotation\_lambda\_function\_arn) | ARN of the Lambda function performing Key rotation | +| [grafana\_key\_rotation\_lambda\_function\_role\_arn](#output\_grafana\_key\_rotation\_lambda\_function\_role\_arn) | ARN of the Lambda function execution role | | [managed\_prometheus\_workspace\_endpoint](#output\_managed\_prometheus\_workspace\_endpoint) | Amazon Managed Prometheus workspace endpoint | | [managed\_prometheus\_workspace\_id](#output\_managed\_prometheus\_workspace\_id) | Amazon Managed Prometheus workspace ID | | [managed\_prometheus\_workspace\_region](#output\_managed\_prometheus\_workspace\_region) | AWS Region | diff --git a/examples/existing-cluster-with-base-and-infra/main.tf b/examples/existing-cluster-with-base-and-infra/main.tf index 7345b95e..27ac54b7 100644 --- a/examples/existing-cluster-with-base-and-infra/main.tf +++ b/examples/existing-cluster-with-base-and-infra/main.tf @@ -53,12 +53,12 @@ module "eks_monitoring" { enable_apiserver_monitoring = true # deploys external-secrets in to the cluster - enable_external_secrets = true - grafana_api_key = var.grafana_api_key - target_secret_name = "grafana-admin-credentials" - target_secret_namespace = "grafana-operator" - grafana_url = "https://${data.aws_grafana_workspace.this.endpoint}" - grafana_api_key_refresh_interval = var.grafana_api_key_refresh_interval + enable_external_secrets = true + grafana_api_key = var.grafana_api_key + target_secret_name = "grafana-admin-credentials" + target_secret_namespace = "grafana-operator" + grafana_url = "https://${data.aws_grafana_workspace.this.endpoint}" + grafana_api_key_refresh_interval = var.grafana_api_key_refresh_interval # control the publishing of dashboards by specifying the boolean value for the variable 'enable_dashboards', default is 'true' enable_dashboards = var.enable_dashboards @@ -81,20 +81,17 @@ module "eks_monitoring" { tags = local.tags } -# Enabling Key Rotation for API Keys of Grafana Workspace +# Enabling Grafana API Key Rotation module "grafana_key_rotation" { source = "../../modules/grafana-key-rotation" - # source = "github.com/aws-observability/terraform-aws-observability-accelerator//modules/eks-key-rotation" - count = var.enable_grafana_key_rotation ? 1 : 0 managed_grafana_workspace_id = var.managed_grafana_workspace_id grafana_api_key_interval = var.grafana_api_key_interval eventbridge_scheduler_schedule_expression = var.eventbridge_scheduler_schedule_expression lambda_runtime_grafana_key_rotation = var.lambda_runtime_grafana_key_rotation - - ssmparameter_name = module.eks_monitoring.ssmparameter_name_eks_monitoring - ssmparameter_arn = module.eks_monitoring.ssmparameter_arn_eks_monitoring - kms_key_arn_ssm = module.eks_monitoring.kms_key_arn_eks_monitoring -} \ No newline at end of file + ssmparameter_name = module.eks_monitoring.ssmparameter_name + ssmparameter_arn = module.eks_monitoring.ssmparameter_arn + kms_key_arn_ssm = module.eks_monitoring.kms_key_arn +} diff --git a/examples/existing-cluster-with-base-and-infra/outputs.tf b/examples/existing-cluster-with-base-and-infra/outputs.tf index 12bc0d07..a69b8021 100644 --- a/examples/existing-cluster-with-base-and-infra/outputs.tf +++ b/examples/existing-cluster-with-base-and-infra/outputs.tf @@ -23,30 +23,29 @@ output "eks_cluster_id" { value = module.eks_monitoring.eks_cluster_id } -output "eks_key_rotation_lambda_function_arn" { +output "grafana_key_rotation_lambda_function_arn" { description = "ARN of the Lambda function performing Key rotation" # value = module.grafana_key_rotation.lambda_function_arn - value = var.enable_grafana_key_rotation ? module.grafana_key_rotation[0].lambda_function_arn : null + value = var.enable_grafana_key_rotation ? module.grafana_key_rotation[0].lambda_function_arn : null } -output "eks_key_rotation_lambda_function_role_arn" { +output "grafana_key_rotation_lambda_function_role_arn" { description = "ARN of the Lambda function execution role" # value = module.grafana_key_rotation.lambda_function_role_arn - value = var.enable_grafana_key_rotation ? module.grafana_key_rotation[0].lambda_function_role_arn : null + value = var.enable_grafana_key_rotation ? module.grafana_key_rotation[0].lambda_function_role_arn : null } -output "eks_key_rotation_eventbridge_scheduler_arn" { +output "grafana_key_rotation_eventbridge_scheduler_arn" { description = "ARN of the EventBridge Scheduler invoking Lambda Function for Key rotation" # value = module.grafana_key_rotation.eventbridge_scheduler_arn - value = var.enable_grafana_key_rotation ? module.grafana_key_rotation[0].eventbridge_scheduler_arn : null + value = var.enable_grafana_key_rotation ? module.grafana_key_rotation[0].eventbridge_scheduler_arn : null } -output "eks_key_rotation_eventbridge_scheduler_role_arn" { +output "grafana_key_rotation_eventbridge_scheduler_role_arn" { description = "ARN of the IAM Role of EventBridge Scheduler invoking Lambda Function for Key rotation" # value = module.grafana_key_rotation.eventbridge_scheduler_role_arn - value = var.enable_grafana_key_rotation ? module.grafana_key_rotation[0].eventbridge_scheduler_role_arn : null + value = var.enable_grafana_key_rotation ? module.grafana_key_rotation[0].eventbridge_scheduler_role_arn : null } - diff --git a/examples/existing-cluster-with-base-and-infra/variables.tf b/examples/existing-cluster-with-base-and-infra/variables.tf index 6df0e2e5..a976c8d7 100644 --- a/examples/existing-cluster-with-base-and-infra/variables.tf +++ b/examples/existing-cluster-with-base-and-infra/variables.tf @@ -31,3 +31,33 @@ variable "enable_dashboards" { type = bool default = true } + +variable "enable_grafana_key_rotation" { + description = "Enables or disables Grafana API key rotation" + type = bool + default = true +} + +variable "grafana_api_key_interval" { + description = "Number of seconds for secondsToLive value while creating API Key" + type = number + default = 5400 +} + +variable "eventbridge_scheduler_schedule_expression" { + description = "Schedule Expression for EventBridge Scheduler in Grafana API Key Rotation" + type = string + default = "rate(60 minutes)" +} + +variable "grafana_api_key_refresh_interval" { + description = "Refresh Internal to be used by External Secrets for Grafana API Key rotation" + type = string + default = "5m" +} + +variable "lambda_runtime_grafana_key_rotation" { + description = "Python Runtime Identifier for the Lambda Function" + type = string + default = "python3.12" +} diff --git a/modules/eks-monitoring/README.md b/modules/eks-monitoring/README.md index 1c984667..c5a9d91d 100644 --- a/modules/eks-monitoring/README.md +++ b/modules/eks-monitoring/README.md @@ -106,6 +106,7 @@ See examples using this Terraform modules in the **Amazon EKS** section of [this | [flux\_kustomization\_path](#input\_flux\_kustomization\_path) | Flux Kustomization Path | `string` | `"./artifacts/grafana-operator-manifests/eks/infrastructure"` | no | | [go\_config](#input\_go\_config) | Grafana Operator configuration | 
object({
    create_namespace   = optional(bool, true)
    helm_chart         = optional(string, "oci://ghcr.io/grafana-operator/helm-charts/grafana-operator")
    helm_name          = optional(string, "grafana-operator")
    k8s_namespace      = optional(string, "grafana-operator")
    helm_release_name  = optional(string, "grafana-operator")
    helm_chart_version = optional(string, "v5.5.2")
  })
| `{}` | no | | [grafana\_api\_key](#input\_grafana\_api\_key) | Grafana API key for the Amazon Managed Grafana workspace. Required if `enable_external_secrets = true` | `string` | `""` | no | +| [grafana\_api\_key\_refresh\_interval](#input\_grafana\_api\_key\_refresh\_interval) | Refresh Internal to be used by External Secrets for Grafana API Key rotation | `string` | `"5m"` | no | | [grafana\_cluster\_dashboard\_url](#input\_grafana\_cluster\_dashboard\_url) | Dashboard URL for Cluster Grafana Dashboard JSON | `string` | `"https://raw.githubusercontent.com/aws-observability/aws-observability-accelerator/v0.2.0/artifacts/grafana-dashboards/eks/infrastructure/cluster.json"` | no | | [grafana\_kubelet\_dashboard\_url](#input\_grafana\_kubelet\_dashboard\_url) | Dashboard URL for Kubelet Grafana Dashboard JSON | `string` | `"https://raw.githubusercontent.com/aws-observability/aws-observability-accelerator/v0.2.0/artifacts/grafana-dashboards/eks/infrastructure/kubelet.json"` | no | | [grafana\_kubeproxy\_dashboard\_url](#input\_grafana\_kubeproxy\_dashboard\_url) | Dashboard URL for kube-proxy Grafana Dashboard JSON | `string` | `"https://raw.githubusercontent.com/aws-observability/aws-observability-accelerator/v0.2.0/artifacts/grafana-dashboards/eks/kube-proxy/kube-proxy.json"` | no | @@ -144,7 +145,10 @@ See examples using this Terraform modules in the **Amazon EKS** section of [this | [adot\_irsa\_arn](#output\_adot\_irsa\_arn) | IRSA Arn for ADOT | | [eks\_cluster\_id](#output\_eks\_cluster\_id) | EKS Cluster Id | | [eks\_cluster\_version](#output\_eks\_cluster\_version) | EKS Cluster version | +| [kms\_key\_arn](#output\_kms\_key\_arn) | Name of the SSM Parameter | | [managed\_prometheus\_workspace\_endpoint](#output\_managed\_prometheus\_workspace\_endpoint) | Amazon Managed Prometheus workspace endpoint | | [managed\_prometheus\_workspace\_id](#output\_managed\_prometheus\_workspace\_id) | Amazon Managed Prometheus workspace ID | | [managed\_prometheus\_workspace\_region](#output\_managed\_prometheus\_workspace\_region) | Amazon Managed Prometheus workspace region | +| [ssmparameter\_arn](#output\_ssmparameter\_arn) | Name of the SSM Parameter | +| [ssmparameter\_name](#output\_ssmparameter\_name) | Name of the SSM Parameter | diff --git a/modules/eks-monitoring/add-ons/external-secrets/README.md b/modules/eks-monitoring/add-ons/external-secrets/README.md index 2d8f32d3..2070745a 100644 --- a/modules/eks-monitoring/add-ons/external-secrets/README.md +++ b/modules/eks-monitoring/add-ons/external-secrets/README.md @@ -47,11 +47,16 @@ This deploys an EKS Cluster with the External Secrets Operator. The cluster is p | [addon\_context](#input\_addon\_context) | Input configuration for the addon | 
object({
    aws_caller_identity_account_id = string
    aws_caller_identity_arn        = string
    aws_eks_cluster_endpoint       = string
    aws_partition_id               = string
    aws_region_name                = string
    eks_cluster_id                 = string
    eks_oidc_issuer_url            = string
    eks_oidc_provider_arn          = string
    irsa_iam_role_path             = string
    irsa_iam_permissions_boundary  = string
    tags                           = map(string)
  })
| n/a | yes | | [enable\_external\_secrets](#input\_enable\_external\_secrets) | Enable external-secrets | `bool` | `true` | no | | [grafana\_api\_key](#input\_grafana\_api\_key) | Grafana API key for the Amazon Managed Grafana workspace | `string` | n/a | yes | +| [grafana\_api\_key\_refresh\_interval](#input\_grafana\_api\_key\_refresh\_interval) | Refresh Internal to be used by External Secrets for Grafana API Key rotation | `string` | n/a | yes | | [helm\_config](#input\_helm\_config) | Helm provider config for external secrets | `any` | `{}` | no | | [target\_secret\_name](#input\_target\_secret\_name) | Name to store the secret for Grafana API Key | `string` | n/a | yes | | [target\_secret\_namespace](#input\_target\_secret\_namespace) | Namespace to store the secret for Grafana API Key | `string` | n/a | yes | ## Outputs -No outputs. +| Name | Description | +|------|-------------| +| [kms\_key\_arn\_ssm](#output\_kms\_key\_arn\_ssm) | Name of the SSM Parameter | +| [ssmparameter\_arn](#output\_ssmparameter\_arn) | Name of the SSM Parameter | +| [ssmparameter\_name](#output\_ssmparameter\_name) | Name of the SSM Parameter | diff --git a/modules/eks-monitoring/add-ons/external-secrets/main.tf b/modules/eks-monitoring/add-ons/external-secrets/main.tf index c398f664..a737717d 100644 --- a/modules/eks-monitoring/add-ons/external-secrets/main.tf +++ b/modules/eks-monitoring/add-ons/external-secrets/main.tf @@ -97,7 +97,7 @@ metadata: name: ${local.name}-sm namespace: ${var.target_secret_namespace} spec: - refreshInterval: ${var.grafana_api_key_refresh_interval} + refreshInterval: ${var.grafana_api_key_refresh_interval} secretStoreRef: name: ${local.cluster_secretstore_name} kind: ClusterSecretStore diff --git a/modules/eks-monitoring/add-ons/external-secrets/outputs.tf b/modules/eks-monitoring/add-ons/external-secrets/outputs.tf index f8a263f8..d8979a55 100644 --- a/modules/eks-monitoring/add-ons/external-secrets/outputs.tf +++ b/modules/eks-monitoring/add-ons/external-secrets/outputs.tf @@ -12,5 +12,3 @@ output "kms_key_arn_ssm" { description = "Name of the SSM Parameter" value = aws_kms_key.secrets.arn } - - diff --git a/modules/eks-monitoring/add-ons/external-secrets/variables.tf b/modules/eks-monitoring/add-ons/external-secrets/variables.tf index 6246054a..ea28035d 100644 --- a/modules/eks-monitoring/add-ons/external-secrets/variables.tf +++ b/modules/eks-monitoring/add-ons/external-secrets/variables.tf @@ -45,4 +45,4 @@ variable "target_secret_name" { variable "grafana_api_key_refresh_interval" { description = "Refresh Internal to be used by External Secrets for Grafana API Key rotation" type = string -} \ No newline at end of file +} diff --git a/modules/eks-monitoring/main.tf b/modules/eks-monitoring/main.tf index ab5f1157..a065e9e0 100644 --- a/modules/eks-monitoring/main.tf +++ b/modules/eks-monitoring/main.tf @@ -265,12 +265,12 @@ module "external_secrets" { source = "./add-ons/external-secrets" count = var.enable_external_secrets ? 1 : 0 - enable_external_secrets = var.enable_external_secrets - grafana_api_key = var.grafana_api_key - addon_context = local.context - target_secret_namespace = var.target_secret_namespace - target_secret_name = var.target_secret_name - grafana_api_key_refresh_interval = var.grafana_api_key_refresh_interval + enable_external_secrets = var.enable_external_secrets + grafana_api_key = var.grafana_api_key + addon_context = local.context + target_secret_namespace = var.target_secret_namespace + target_secret_name = var.target_secret_name + grafana_api_key_refresh_interval = var.grafana_api_key_refresh_interval depends_on = [resource.helm_release.grafana_operator] } diff --git a/modules/eks-monitoring/outputs.tf b/modules/eks-monitoring/outputs.tf index bcf2c933..2a2873ea 100644 --- a/modules/eks-monitoring/outputs.tf +++ b/modules/eks-monitoring/outputs.tf @@ -13,6 +13,21 @@ output "adot_irsa_arn" { value = module.helm_addon.irsa_arn } +output "ssmparameter_name" { + description = "Name of the SSM Parameter" + value = module.external_secrets[0].ssmparameter_name +} + +output "ssmparameter_arn" { + description = "Name of the SSM Parameter" + value = module.external_secrets[0].ssmparameter_arn +} + +output "kms_key_arn" { + description = "Name of the SSM Parameter" + value = module.external_secrets[0].kms_key_arn_ssm +} + output "managed_prometheus_workspace_endpoint" { description = "Amazon Managed Prometheus workspace endpoint" value = local.managed_prometheus_workspace_endpoint @@ -27,18 +42,3 @@ output "managed_prometheus_workspace_region" { description = "Amazon Managed Prometheus workspace region" value = local.managed_prometheus_workspace_region } - -output "ssmparameter_name_eks_monitoring" { - description = "Name of the SSM Parameter" - value = module.external_secrets[0].ssmparameter_name -} - -output "ssmparameter_arn_eks_monitoring" { - description = "Name of the SSM Parameter" - value = module.external_secrets[0].ssmparameter_arn -} - -output "kms_key_arn_eks_monitoring" { - description = "Name of the SSM Parameter" - value = module.external_secrets[0].kms_key_arn_ssm -} diff --git a/modules/eks-monitoring/variables.tf b/modules/eks-monitoring/variables.tf index 81fd829c..c8a0cad2 100644 --- a/modules/eks-monitoring/variables.tf +++ b/modules/eks-monitoring/variables.tf @@ -569,4 +569,5 @@ variable "kubeproxy_monitoring_config" { variable "grafana_api_key_refresh_interval" { description = "Refresh Internal to be used by External Secrets for Grafana API Key rotation" type = string -} \ No newline at end of file + default = "5m" +} diff --git a/modules/grafana-key-rotation/main.tf b/modules/grafana-key-rotation/main.tf index 596cd4ea..20983d15 100644 --- a/modules/grafana-key-rotation/main.tf +++ b/modules/grafana-key-rotation/main.tf @@ -1,15 +1,8 @@ -# Removed provider as you can't have a provider defined here when you want to use count for this module in the root module because, a provider makes this a legacy module.. -# provider "aws" { -# region = "us-east-1" # Change to your desired region -# } - -# provider "archive" { -# } data "archive_file" "lambda_function_archive" { type = "zip" - source_file = "${path.module}/src/lambda_function.py" + source_file = "${path.module}/src/lambda_function.py" output_path = "${path.module}/src/lambda_function.zip" } @@ -18,31 +11,29 @@ data "aws_region" "current" {} data "aws_caller_identity" "current" {} -# Unique random string to avoid Resource Already Exists errors. +# Unique random string to avoid Resource Already Exists errors. resource "random_string" "random_string_resource" { - length = 4 + length = 4 special = false - lower = true - upper = false + lower = true + upper = false } -# Lambda function resource +# Lambda function resource resource "aws_lambda_function" "observability_accelerator_lambda" { function_name = "${var.lambda_function_name}-${var.managed_grafana_workspace_id}-${random_string.random_string_resource.id}" handler = "lambda_function.lambda_handler" - # runtime = "python3.8" - runtime = "${var.lambda_runtime_grafana_key_rotation}" + runtime = var.lambda_runtime_grafana_key_rotation memory_size = 128 - timeout = 180 - # filename = "../../modules/eks-key-rotation/lambda_function.zip" + timeout = 180 filename = data.archive_file.lambda_function_archive.output_path - role = aws_iam_role.lambda_role.arn + role = aws_iam_role.lambda_role.arn } -# Lambda Execution IAM Role +# Lambda Execution IAM Role resource "aws_iam_role" "lambda_role" { - name = "${var.lambda_execution_role_name}-${var.managed_grafana_workspace_id}-${random_string.random_string_resource.id}" + name = "${var.lambda_execution_role_name}-${var.managed_grafana_workspace_id}-${random_string.random_string_resource.id}" assume_role_policy = <