terraform: access AWS using SSO (#283)
* terraform: access AWS using SSO Replace the long-lived AWS key-pair with AWS SSO / Identity Center. --------- Co-authored-by: Eelco Dolstra <edolstra@gmail.com> Co-authored-by: Cole Helbling <cole.helbling@determinate.systems>
Jonas Chevalier committed
Oct 16, 2023 at 17:10 UTC
3f417c335343a117f595d20118429fdc22f70276
7 files changed
+38
-20
terraform/.envrc
+3
@@ -1,3 +1,6 @@
1
use flake
2
3
+export AWS_CONFIG_FILE=$PWD/aws-config
4
+export AWS_PROFILE=nixos-prod
5
+
6
source_env_if_exists .envrc.local
terraform/.envrc.local.template
+4
-2
@@ -1,4 +1,6 @@
1
-export AWS_ACCESS_KEY_ID=...
2
-export AWS_SECRET_ACCESS_KEY=...
1
+#!/bin/sh
2
+
3
+# Get this one from https://manage.fastly.com/account/personal/tokens and set a global scope.
4
export FASTLY_API_KEY=...
5
+# TODO, ask zimbatm for now
6
export NETLIFY_TOKEN=...
terraform/README.md
+18
-14
@@ -1,24 +1,28 @@
1
# For the bits that are not nixops-able
2
3
-For now this manages only resources in the main AWS account.
3
+This terraform root module manages:
4
+* the resource in the AWS main account (S3 buckets)
5
+* Fastly
6
+* Netlify DNS
7
8
## Setup
9
7
-Set the following environment variables:
10
+In order to use this, make sure to install direnv and Nix with flakes enabled.
11
9
-AWS access key pair:
12
+Then copy the `.envrc.local.template` to `.envrc.local`, and fill in the
13
+related keys.
14
11
-```sh
12
-export AWS_ACCESS_KEY_ID=...
13
-export AWS_SECRET_ACCESS_KEY=...
14
-```
15
+> FIXME: Unset the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY env vars if
16
+> they are already set. Those have been replaced by AWS SSO.
17
16
-Fastly token from https://manage.fastly.com/account/personal/tokens with
17
-global scope.
18
+Then run `direnv allow` to load the environment with the runtime dependencies.
19
19
-```sh
20
-export FASTLY_API_KEY=...
21
-```
20
+Run `aws configure sso` to acquire a temporary token.
21
+
22
+When asked, pick the following account:
23
+* `LBNixOS_Dev_PDX (080433136561)`
24
+Select role `AWSAdministratorAccess`.
25
+Leave all the rest with the default options.
26
27
## Usage
28
@@ -26,13 +30,13 @@ The first time the following command has to be run to initialize the state
30
file and plugins:
31
32
```sh
29
-nix-shell --run "terraform init"
33
+terraform init
34
```
35
36
Then run the following command to diff the changes and then apply if approved:
37
38
```sh
35
-nix-shell --run "terraform apply"
39
+terraform apply
40
```
41
42
## Terraform workflow
terraform/aws-config
new
+5
@@ -0,0 +1,5 @@
1
+[profile nixos-prod]
2
+sso_start_url = https://nixos.awsapps.com/start
3
+sso_region = eu-north-1
4
+sso_account_id = 080433136561
5
+sso_role_name = AWSAdministratorAccess
terraform/flake.nix
+2
-1
@@ -6,7 +6,8 @@
6
devShell.x86_64-linux =
7
with import nixpkgs { system = "x86_64-linux"; };
8
mkShell {
9
- buildInputs = [
9
+ packages = [
10
+ awscli2
11
(terraform.withPlugins (p: with p; [
12
aws
13
fastly
terraform/providers.tf
+5
-3
@@ -1,10 +1,12 @@
1
provider "aws" {
2
- region = "eu-west-1"
2
+ region = "eu-west-1"
3
+ profile = "nixos-prod"
4
}
5
6
provider "aws" {
6
- alias = "us"
7
- region = "us-east-1"
7
+ alias = "us"
8
+ region = "us-east-1"
9
+ profile = "nixos-prod"
10
}
11
12
provider "fastly" {}
terraform/terraform.tf
+1
@@ -4,6 +4,7 @@ terraform {
4
encrypt = true
5
key = "targets/terraform"
6
region = "eu-west-1"
7
+ profile = "nixos-prod"
8
}
9
10
required_providers {