You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| <aname="input_name"></a> [name](#input\_name)| (Required) Friendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: `/_+=.@-`. |`string`| n/a | yes |
45
-
| <aname="input_block_public_policy"></a> [block\_public\_policy](#input\_block\_public\_policy)| (Optional) Whether to reject calls to PUT a resource policy if the policy allows public access. |`bool`|`false`| no |
45
+
| <aname="input_block_public_policy"></a> [block\_public\_policy](#input\_block\_public\_policy)| (Optional) Whether to reject calls to PUT a resource policy if the policy allows public access. Defaults to `true`. |`bool`|`true`| no |
46
46
| <aname="input_deletion_window_in_days"></a> [deletion\_window\_in\_days](#input\_deletion\_window\_in\_days)| (Optional) Duration in days after which the secret is deleted after destruction of the resource. Valid value is between `7` and `30` days. Defaults to `30`. |`number`|`30`| no |
47
47
| <aname="input_description"></a> [description](#input\_description)| (Optional) The description of the secret. |`string`|`"Managed by Terraform."`| no |
48
48
| <aname="input_kms_key"></a> [kms\_key](#input\_kms\_key)| (Optional) The ARN or Id of the AWS KMS key to be used to encrypt the secret values in this secret. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key named `aws/secretsmanager`. If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time. |`string`|`null`| no |
49
49
| <aname="input_module_tags_enabled"></a> [module\_tags\_enabled](#input\_module\_tags\_enabled)| (Optional) Whether to create AWS Resource Tags for the module informations. |`bool`|`true`| no |
50
-
| <aname="input_overwrite_in_replicas"></a> [overwrite\_in\_replicas](#input\_overwrite\_in\_replicas)| (Optional) Whether to overwrite a secret with the same name in the destination region during replication. |`bool`|`false`| no |
50
+
| <aname="input_overwrite_in_replicas"></a> [overwrite\_in\_replicas](#input\_overwrite\_in\_replicas)| (Optional) Whether to overwrite a secret with the same name in the destination region during replication. Defaults to `false`. |`bool`|`false`| no |
51
51
| <aname="input_policy"></a> [policy](#input\_policy)| (Optional) A valid JSON document representing a resource policy. |`string`|`null`| no |
52
-
| <aname="input_replicas"></a> [replicas](#input\_replicas)| (Optional) A list of replica configurations of the Secrets Manager secret. Each value of `replicas` block as defined below.<br> (Required) `region` - The region for replicating the secret.<br> (Optional) `kms_key` - The ARN, Key ID, or Alias of the AWS KMS key within the region secret is replicated to. If one is not specified, then Secrets Manager defaults to using the AWS account's default KMS key named `aws/secretsmanager` in the region. If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time. |`list(map(string))`|`[]`| no |
52
+
| <aname="input_replicas"></a> [replicas](#input\_replicas)| (Optional) A list of replica configurations of the Secrets Manager secret. Each value of `replicas` block as defined below.<br> (Required) `region` - The region for replicating the secret.<br> (Optional) `kms_key` - The ARN, Key ID, or Alias of the AWS KMS key within the region secret is replicated to. If one is not specified, then Secrets Manager defaults to using the AWS account's default KMS key named `aws/secretsmanager` in the region. If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time. |<pre>list(object({<br> region = string<br> kms_key = optional(string)<br> }))</pre>|`[]`| no |
53
53
| <aname="input_resource_group_description"></a> [resource\_group\_description](#input\_resource\_group\_description)| (Optional) The description of Resource Group. |`string`|`"Managed by Terraform."`| no |
54
54
| <aname="input_resource_group_enabled"></a> [resource\_group\_enabled](#input\_resource\_group\_enabled)| (Optional) Whether to create Resource Group to find and group AWS resources which are created by this module. |`bool`|`true`| no |
55
55
| <aname="input_resource_group_name"></a> [resource\_group\_name](#input\_resource\_group\_name)| (Optional) The name of Resource Group. A Resource Group name can have a maximum of 127 characters, including letters, numbers, hyphens, dots, and underscores. The name cannot start with `AWS` or `aws`. |`string`|`""`| no |
56
-
| <aname="input_rotation_duration_in_days"></a> [rotation\_duration\_in\_days](#input\_rotation\_duration\_in\_days)| (Optional) The number of days between automatic scheduled rotations of the secret. Required if `rotation_lambda_function` is configured. |`number`|`null`| no |
57
-
| <aname="input_rotation_lambda_function"></a> [rotation\_lambda\_function](#input\_rotation\_lambda\_function)| (Optional) The ARN of the Lambda function that can rotate the secret. |`string`|`null`| no |
56
+
| <a name="input_rotation"></a> [rotation](#input\_rotation) | (Optional) A rotation configurations of the Secrets Manager secret. `rotation` block as defined below.<br> (Optional) `enabled` - Whether to enable automatic rotation of the secret. Defaults to `false`.<br> (Optionial) `rotate_immediately` - Whether to rotate the secret immediately or wait until the next scheduled rotation window. The rotation schedule is defined in rotation\_rules. For secrets that use a Lambda rotation function to rotate, if you don't immediately rotate the secret, Secrets Manager tests the rotation configuration by running the testSecret step. Defaults to `true`.<br> (Optional) `lambda_function` - The ARN of the Lambda function that can rotate the secret.<br> (Optional) `schedule_frequency` - The number of days between automatic scheduled rotations of the secret. Either `schedule_frequency` or `schedule_expression` must be specified.<br> (Optional) `schedule_expression` - A cron expression such as `cron(a b c d e f)` or a rate expression such as `rate(10 days)`. Either `schedule_frequency` or `schedule_expression` must be specified.<br> (Optional) `duration` - The length of the rotation window in hours. | <pre>object({<br> enabled = optional(bool, false)<br> rotate_immediately = optional(bool, true)<br> lambda_function = optional(string)<br> schedule_frequency = optional(number)<br> schedule_expression = optional(string)<br> duration = optional(number)<br> })</pre> | `{}` | no |
58
57
| <aname="input_tags"></a> [tags](#input\_tags)| (Optional) A map of tags to add to all resources. |`map(string)`|`{}`| no |
59
58
| <aname="input_type"></a> [type](#input\_type)| (Optional) The intended type of the secret. Valid values are `TEXT`, `KEY_VALUE` or `BINARY`. |`string`|`"KEY_VALUE"`| no |
60
59
| <aname="input_value"></a> [value](#input\_value)| (Optional) The secret value that you want to encrypt and store in the current version of the secret. Specify plaintext data with `string` type if `type` is `TEXT`. Specify key-value data with `map` type if `type` is `KEY_VALUE`. Specify binary data with `string` type if `type` is `BINARY`. The `aws_secretsmanager_secret_version` resource is deleted from Terraform if you set the value to `null`. However, `AWSCURRENT` staging label is still active on the version event after the resource is deleted from Terraform. |`any`|`null`| no |
Copy file name to clipboardExpand all lines: modules/secrets-manager-secret/variables.tf
+40-15Lines changed: 40 additions & 15 deletions
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,7 @@
1
1
variable"name" {
2
2
description="(Required) Friendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: `/_+=.@-`."
3
3
type=string
4
+
nullable=false
4
5
}
5
6
6
7
variable"description" {
@@ -26,6 +27,7 @@ variable "value" {
26
27
description="(Optional) The secret value that you want to encrypt and store in the current version of the secret. Specify plaintext data with `string` type if `type` is `TEXT`. Specify key-value data with `map` type if `type` is `KEY_VALUE`. Specify binary data with `string` type if `type` is `BINARY`. The `aws_secretsmanager_secret_version` resource is deleted from Terraform if you set the value to `null`. However, `AWSCURRENT` staging label is still active on the version event after the resource is deleted from Terraform."
27
28
type=any
28
29
default=null
30
+
nullable=true
29
31
}
30
32
31
33
variable"versions" {
@@ -64,18 +66,20 @@ variable "kms_key" {
64
66
description="(Optional) The ARN or Id of the AWS KMS key to be used to encrypt the secret values in this secret. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key named `aws/secretsmanager`. If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time."
65
67
type=string
66
68
default=null
69
+
nullable=true
67
70
}
68
71
69
72
variable"policy" {
70
73
description="(Optional) A valid JSON document representing a resource policy."
71
74
type=string
72
75
default=null
76
+
nullable=true
73
77
}
74
78
75
79
variable"block_public_policy" {
76
-
description="(Optional) Whether to reject calls to PUT a resource policy if the policy allows public access."
80
+
description="(Optional) Whether to reject calls to PUT a resource policy if the policy allows public access. Defaults to `true`."
77
81
type=bool
78
-
default=false
82
+
default=true
79
83
nullable=false
80
84
}
81
85
@@ -100,28 +104,49 @@ variable "replicas" {
100
104
(Required) `region` - The region for replicating the secret.
101
105
(Optional) `kms_key` - The ARN, Key ID, or Alias of the AWS KMS key within the region secret is replicated to. If one is not specified, then Secrets Manager defaults to using the AWS account's default KMS key named `aws/secretsmanager` in the region. If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.
102
106
EOF
103
-
type=list(map(string))
104
-
default=[]
105
-
nullable=false
107
+
type=list(object({
108
+
region =string
109
+
kms_key =optional(string)
110
+
}))
111
+
default=[]
112
+
nullable=false
106
113
}
107
114
108
115
variable"overwrite_in_replicas" {
109
-
description="(Optional) Whether to overwrite a secret with the same name in the destination region during replication."
116
+
description="(Optional) Whether to overwrite a secret with the same name in the destination region during replication. Defaults to `false`."
110
117
type=bool
111
118
default=false
112
119
nullable=false
113
120
}
114
121
115
-
variable"rotation_lambda_function" {
116
-
description="(Optional) The ARN of the Lambda function that can rotate the secret."
117
-
type=string
118
-
default=null
119
-
}
122
+
variable"rotation" {
123
+
description=<<EOF
124
+
(Optional) A rotation configurations of the Secrets Manager secret. `rotation` block as defined below.
125
+
(Optional) `enabled` - Whether to enable automatic rotation of the secret. Defaults to `false`.
126
+
(Optionial) `rotate_immediately` - Whether to rotate the secret immediately or wait until the next scheduled rotation window. The rotation schedule is defined in rotation_rules. For secrets that use a Lambda rotation function to rotate, if you don't immediately rotate the secret, Secrets Manager tests the rotation configuration by running the testSecret step. Defaults to `true`.
127
+
(Optional) `lambda_function` - The ARN of the Lambda function that can rotate the secret.
128
+
(Optional) `schedule_frequency` - The number of days between automatic scheduled rotations of the secret. Either `schedule_frequency` or `schedule_expression` must be specified.
129
+
(Optional) `schedule_expression` - A cron expression such as `cron(a b c d e f)` or a rate expression such as `rate(10 days)`. Either `schedule_frequency` or `schedule_expression` must be specified.
130
+
(Optional) `duration` - The length of the rotation window in hours.
131
+
EOF
132
+
type=object({
133
+
enabled =optional(bool, false)
134
+
rotate_immediately =optional(bool, true)
135
+
lambda_function =optional(string)
136
+
schedule_frequency =optional(number)
137
+
schedule_expression =optional(string)
138
+
duration =optional(number)
139
+
})
140
+
default={}
141
+
nullable=false
120
142
121
-
variable"rotation_duration_in_days" {
122
-
description="(Optional) The number of days between automatic scheduled rotations of the secret. Required if `rotation_lambda_function` is configured."
0 commit comments