diff --git a/README.md b/README.md index 0d11011..ba1ba34 100644 --- a/README.md +++ b/README.md @@ -75,6 +75,32 @@ module "parameters_and_parse_files" { } ``` +#### Unlocked variables example(wont be changed by terraform): +You can lock each parameter or all the parameters +```hcl +module "parameters" { + source = "zahornyak/multiple-ssm-parameters/aws" + + parameters = { + db_name = { + name = "foo" + value = "bar" + type = "String" + description = "name of the db" + } + db_password = { + value = "password" + type = "String" + description = "secure password" + unlocked = true + } + } + + # unlocked = true +} +``` + + ## Requirements @@ -101,6 +127,7 @@ No modules. |------|------| | [aws_ssm_parameter.parsed](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource | | [aws_ssm_parameter.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource | +| [aws_ssm_parameter.unlocked](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource | | [local_file.config_file](https://registry.terraform.io/providers/hashicorp/local/latest/docs/data-sources/file) | data source | ## Inputs @@ -111,6 +138,7 @@ No modules. | [parameter\_prefix](#input\_parameter\_prefix) | prefix for parameter names. For example you wanna split dev/prod parameters so you wanna add /service\_name/development/ prefix before parameter name | `string` | `null` | no | | [parameters](#input\_parameters) | map of parameters for parameter store | `any` | `{}` | no | | [tags](#input\_tags) | Specifies a tags | `any` | `{}` | no | +| [unlocked](#input\_unlocked) | if true - sets the ignore lifecycle policy and disable terraform managing the version of the resource | `bool` | `false` | no | ## Outputs diff --git a/examples/simple/main.tf b/examples/simple/main.tf index 179093a..9a42d8a 100644 --- a/examples/simple/main.tf +++ b/examples/simple/main.tf @@ -14,6 +14,9 @@ module "parameters" { value = "password" type = "String" description = "secure password" + unlocked = true } } + + # unlocked = true } \ No newline at end of file diff --git a/main.tf b/main.tf index 8a8d534..b580596 100644 --- a/main.tf +++ b/main.tf @@ -1,5 +1,5 @@ resource "aws_ssm_parameter" "this" { - for_each = var.parameters + for_each = { for k, v in var.parameters : k => v if !var.unlocked && try(v.unlocked, false) == false } name = var.parameter_prefix != null ? "${var.parameter_prefix}${lookup(each.value, "name", null) == null ? each.key : lookup(each.value, "name")}" : lookup(each.value, "name", null) == null ? each.key : lookup(each.value, "name") type = lookup(each.value, "type", "SecureString") @@ -15,6 +15,27 @@ resource "aws_ssm_parameter" "this" { tags = merge(var.tags, lookup(each.value, "tags", null)) } +resource "aws_ssm_parameter" "unlocked" { + for_each = { for k, v in var.parameters : k => v if var.unlocked || try(v.unlocked, false) == true } + + name = var.parameter_prefix != null ? "${var.parameter_prefix}${lookup(each.value, "name", null) == null ? each.key : lookup(each.value, "name")}" : lookup(each.value, "name", null) == null ? each.key : lookup(each.value, "name") + type = lookup(each.value, "type", "SecureString") + value = lookup(each.value, "value", null) + description = lookup(each.value, "description", null) + allowed_pattern = lookup(each.value, "allowed_pattern", null) + data_type = lookup(each.value, "data_type", null) + insecure_value = lookup(each.value, "insecure_value", null) + key_id = lookup(each.value, "key_id", null) + overwrite = lookup(each.value, "overwrite", null) + tier = lookup(each.value, "tier", null) + + tags = merge(var.tags, lookup(each.value, "tags", null)) + + lifecycle { + ignore_changes = [value] + } +} + data "local_file" "config_file" { count = var.file_path != null ? 1 : 0 diff --git a/variables.tf b/variables.tf index c1b4634..3ca1bd1 100644 --- a/variables.tf +++ b/variables.tf @@ -21,3 +21,9 @@ variable "parameter_prefix" { default = null type = string } + +variable "unlocked" { + description = "if true - sets the ignore lifecycle policy and disable terraform managing the version of the resource" + type = bool + default = false +}