feat: Attach ssm permissions to ecs fargate job module #407
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
tapanr
changed the title
aws-ecs-job-fargate/variables.tf
Outdated
| variable "ssm_arn" { | ||
| type = string | ||
| default = null | ||
| description = "Parameter Store ARN" |
There was a problem hiding this comment.
Suggested change
| description = "Parameter Store ARN" | |
| description = "SSM Parameter Store ARN. If present, allows ECS task to make ssm:GetParameters call." |
aws-ecs-job-fargate/iam.tf
Outdated
| "ssm:GetParameters", | ||
| ] | ||
|
|
||
| resources = [var.ssm_arn] |
There was a problem hiding this comment.
Suggested change
| resources = [var.ssm_arn] | |
| resources = var.ssm_parameter_store_arns |
I'd make this a list so that we're granting access to specific keys in Parameter Store. Even though you can somewhat achieve the same behavior by providing an ARN prefix, I think this is much more flexible.
tapanr
force-pushed
the
add-ssm-permissions-to-ecs-fargate-job
branch
from
d7f2dc8 to
21c66f9
Compare
alldoami
approved these changes
Jul 7, 2022
There was a problem hiding this comment.
Thanks for reviewing @michaelmcchen! @tapanr lmk if you need a release after this
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Adding an option to attach ssm permission to ecs fargate job module. This option can be used when the task running in ECS Fargate needs to use parameter store to retrieve secret credentials.
Background on why we needed this: We plan to deploy a docker image on ECS Fargate which needs to set some authentication credentials as its environment variables. Since these are confidential credentials, we have stored them in parameter store and hence ECS task needs access to that store to retrieve them.