Forge Home

Modules

Puppet

Resources

PuppetEcosystemPuppet CommunityUpdates

hiera_aws_sm

Lookup secret values from AWS SecretsManager
Project URLRSS FeedReport issues

18,525 downloads

18,525 latest version

5.0 quality score

We run a couple of automated
scans to help you access a
module's quality. Each module is
given a score based on how well
the author has formatted their
code and documentation and
modules are also checked for
malware using VirusTotal.

Please note, the information below
is for guidance only and neither of
these methods should be considered
an endorsement by Puppet.

Support the Puppet Community by contributing to this module

You are welcome to contribute to this module by suggesting new features, currency updates, or fixes. Every contribution is valuable to help ensure that the module remains compatible with the latest Puppet versions and continues to meet community needs. Complete the following steps:

  1. Review the module’s contribution guidelines and any licenses. Ensure that your planned contribution aligns with the author’s standards and any legal requirements.
  2. Fork the repository on GitHub, make changes on a branch of your fork, and submit a pull request. The pull request must clearly document your proposed change.

For questions about updating the module, contact the module’s author.

Version information

  • 1.0.1 (latest)
released Nov 12th 2018
This version is compatible with:
  • Puppet Enterprise 2018.1.x, 2017.3.x, 2017.2.x, 2017.1.x, 2016.5.x, 2016.4.x
  • Puppet >= 4.7.0 < 6.0.0
  • , , , , ,

Start using this module

  • r10k or Code Manager
  • Bolt
  • Manual installation
  • Direct download

Add this module to your Puppetfile:

mod 'accenture-hiera_aws_sm', '1.0.1'
Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add accenture-hiera_aws_sm
Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install accenture-hiera_aws_sm --version 1.0.1

Direct download is not typically how you would use a Puppet module to manage your infrastructure, but you may want to download the module in order to inspect the code.

Download

Documentation

accenture/hiera_aws_sm — version 1.0.1 Nov 12th 2018

hiera_aws_sm

Table of Contents

  1. Description
  2. Setup - The basics of getting started with hiera_aws_secrets_manager
  3. Usage - Configuration options and additional functionality
  4. Reference - An under-the-hood peek at what the module is doing and how
  5. Limitations - OS compatibility, etc.
  6. Development - Guide for contributing to the module

Description

Backend for Hiera 5 which allows lookups against Amazon Secrets Manager.

Based on the design of hiera-vault

Setup

Requires the aws-sdk gem to be installed and available to your Puppetmaster.

package {'aws-sdk':
  ensure   => installed
  provider => puppetserver_gem
}

Usage

The following is a reference of a Hiera hierarchy using hiera_aws_sm.

---

hierarchy:
  - name: "Hiera-AWS-SM lookup"
    lookup_key: hiera_aws_sm
    options:
      continue_if_not_found: false
      aws_access_key: <aws_access_key>
      aws_secret_key: <aws_secret_key>
      region: us-east-1
      delimiter: /
      prefixes: 
        - "%{::environment}/%{::trusted.certname}"
        - "%{::environment}/common/"
        - secret/puppet/%{::trusted.certname}/
        - secret/puppet/common/
      confine_to_keys:
        - '^aws_.*'

### Mandatory Option Keys

name: Human readable level name

lookup_key: Must be set to hiera_aws_sm

Optional Option Keys

continue_if_not_found: Allow Puppet to lookup other data sources if the key is not found in SecretsManager

aws_access_key: IAM access key to be used to connect to AWS. Should only be used for Puppet masters running outside of AWS. Puppet masters running within AWS should have their access to SecretsManager granted via IAM roles.

aws_secret_key: IAM secret access key to be used to connect to AWS.

region: AWS region to query against

delimiter: Character used to join prefixes and keys if specified. Defaults to /. Not required if prefixes is not set.

prefixes: Optional array of prefixes to prepend to each lookup. For each prefix, the function will perform a lookup of [prefix, key].join(delimiter) against SecretsManager. This allows you to specify multiple paths in SecretsManager for the function to explore, as described above.

confine_to_keys: List of regex expressions on which to search SecretsManager. If specified, hiera_aws_sm will only query SecretsManager for keys matching at least one specified regex. If none match, Puppet is allowed to lookup against other data sources.

Limitations

This module is only compatible with Hiera 5 (Puppet 4.9+)

Testing

pdk test unit

Development

Author: David Hayes [d.hayes@accenture.com]

License

See LICENSE

Release Notes

TBD

  • Wrap secret values in Puppet's sensitive data types in examples.
  • Expand README on usage and installation