diff --git a/service-account/README.md b/service-account/README.md index d26d450..5e0b070 100644 --- a/service-account/README.md +++ b/service-account/README.md @@ -1,26 +1,59 @@ -# Terraform module to create STACKIT Service Account +# Terraform Module: STACKIT Service Account -## Example for main.tf +This module is designed to create a STACKIT service account, optionally generate a key, and optionally attach it to a server. It is useful for managing service accounts and their associated keys in a secure and repeatable manner. -# Service Account Terraform Module +The purpose of this module is to simplify the creation and management of service accounts in STACKIT, while providing flexibility to generate keys and attach them to servers. It also allows for secure storage of keys using a secrets manager. -This module creates a STACKIT service account, optionally creates a key, and optionally attaches it to a server. +## Example Usage -## Usage +```terraform +module "service-account" { + source = "./service-account" # Or a Git URL "git::https://commerce-platform.git.onstackit.cloud/commerce-platform-public//terraform-modules/service-account" + stackit_project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" + service_account_name = "my-service-account" + service_account_create_key = true +} -```hcl -module "service_account" { - source = "git::https://commerce-platform.git.onstackit.cloud/commerce-platform-public//terraform-modules/service-account" - name = "my-service-account" - project_id = "your-project-id" +# Save json created to secrets manager +variable "secret_manager_username" { + description = "username of the secrets manger to store credentials" + type = string + sensitive = true +} - create_key = true - ttl_days = 90 - rotate_when_changed = { - rotated_at = timestamp() +variable "secret_manager_password" { + description = "password of the secrets manger to store credentials" + type = string + sensitive = true +} + +module "service_account_key" { + source = "./create-secret" # Or a Git URL "git::https://commerce-platform.git.onstackit.cloud/commerce-platform-public//terraform-modules/create-secret" + secret_manager_instance_id = local.secret_manager_instance_id + secret_manager_username = var.secret_manager_username + secret_manager_password = var.secret_manager_password + secrets_path = "service-accounts/${module.service-account.service_account_name}" + secret_data = { + key_json = module.service-account.service_account_key_json } - - attach_to_server = true - server_id = "your-server-id" } ``` + +## Inputs + +| Key | Description | Type | Required | Default | +| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | ------------- | -------- | ------- | +| `service_account_name` | Name of the service account | `string` | yes | +| `service_account_create_key` | Whether to create a service account key | `bool` | no | `false` | +| `service_account_public_key` | Optional: Specifies the public_key (RSA2048 key-pair). If not provided, a certificate from STACKIT will be used to generate a private_key. | `string` | no | `null` | +| `service_account_rotate_when_changed` | Map to force key rotation when changed | `map(string)` | no | `{}` | +| `service_account_ttl_days` | Key validity duration in days. Defaults to 90 | `number` | no | `90` | +| `attach_to_server` | Whether to attach the service account to a server | `bool` | no | `false` | +| `server_id` | Server ID for attachment | `string` | no | `""` | + +## Notes + +- When creating a key, it is recommended to save it securely using a secrets manager. In the example usage we illustrated how to do that using the `create-secret` module. +- The module does not handle key rotation automatically. You can use the service_account_rotate_when_changed input to force key rotation when certain attributes change. +- The module does not handle server attachment automatically. You can use the attach_to_server and server_id inputs to attach the service account to a server. +- The module does not handle deletion of service accounts or keys. It is recommended to manage these resources using appropriate Terraform lifecycle configurations or external tools.