ExternalVendorCode/sondehub-infra
1
0
Fork 0
mirror of https://github.com/projecthorus/sondehub-infra.git synced 2024-12-23 06:52:28 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Pull secrets from secrets manager rather than S3

Browse Source
This commit is contained in:
xss 2023-10-22 15:48:18 +11:00
parent 81830c2d74
commit f138ddc748
2 changed files with 39 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
secrets.tf
View File

@ -7,6 +7,7 @@ resource "aws_secretsmanager_secret_version" "mqtt" {
secret_string = jsonencode(
{
HOST = join(",", local.websocket_host_addresses)
HOST_MOS_FORMAT = join(" ", [for x in local.websocket_host_addresses : "${x}:1883"])
PASSWORD = random_password.mqtt.result
USERNAME = "write"
}

39
websockets.tf
View File

@ -183,9 +183,9 @@ resource "aws_ecs_task_definition" "ws_reader_ec2" {
},
{
command = [
"cp",
"/config/mosquitto-reader.conf",
"/config/mosquitto.conf",
"sh",
"-c",
"apk add gettext; envsubst < /config/mosquitto-reader-template.conf > /config/mosquitto.conf",
]
cpu = 0
dependsOn = [
@ -214,6 +214,16 @@ resource "aws_ecs_task_definition" "ws_reader_ec2" {
name = "config-move"
portMappings = []
volumesFrom = []
secrets = [
{
name = "PASSWORD"
valueFrom = "${aws_secretsmanager_secret.mqtt.arn}:PASSWORD::"
},
{
name = "HOST_MOS_FORMAT"
valueFrom = "${aws_secretsmanager_secret.mqtt.arn}:HOST_MOS_FORMAT::"
}
]
},
]
)
@ -232,6 +242,7 @@ resource "aws_ecs_task_definition" "ws_reader_ec2" {
volume {
name = "config"
}
}
resource "aws_ecs_task_definition" "ws" {
@ -277,7 +288,7 @@ resource "aws_ecs_task_definition" "ws" {
]
environment = []
essential = true
image = "eclipse-mosquitto:2-openssl"
image = "eclipse-mosquitto:2.0.15"
# logConfiguration = {
# logDriver = "awslogs"
# options = {
@ -571,6 +582,26 @@ resource "aws_iam_role_policy" "efs" {
EOF
}
resource "aws_iam_role_policy" "secrets" {
name = "secrests"
role = aws_iam_role.ecs_execution.id
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"secretsmanager:GetSecretValue"
],
"Effect": "Allow",
"Resource": ["${aws_secretsmanager_secret.mqtt.arn}", "${aws_secretsmanager_secret.radiosondy.arn}"]
}
]
}
EOF
}
resource "aws_iam_role_policy" "ssm" {
name = "SSM"
role = aws_iam_role.ecs_execution.id