Add credentials module (#9)

Author: eseliger

.buildkite/terraform-validate.sh

@@ -8,6 +8,7 @@ MODULES=(
   ./modules/networking
   ./modules/docker-mirror
   ./modules/executors
+  ./modules/credentials
   .
   ./examples/single-executor
   ./examples/multiple-executors

modules/credentials/main.tf

@@ -0,0 +1,46 @@
+locals {
+  prefix = var.resource_prefix != "" ? "${var.resource_prefix}-sg-" : "sg-"
+}
+
+resource "aws_iam_user" "metric_writer" {
+  name = "${substr(local.prefix, 0, 14)}-metric-writer"
+}
+
+resource "aws_iam_user_policy" "metric_writer" {
+  name = "${substr(var.resource_prefix, 0, 16)}MetricWriter"
+  user = aws_iam_user.metric_writer.id
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "cloudwatch:PutMetricData"
+      ],
+      "Resource": "*"
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_access_key" "metric_writer" {
+  user = aws_iam_user.metric_writer.name
+}
+
+resource "aws_iam_user" "instance_scraper" {
+  name = "${substr(local.prefix, 0, 11)}-instance-scraper"
+}
+
+resource "aws_iam_policy_attachment" "instance_scraper" {
+  name       = "${substr(var.resource_prefix, 0, 11)}InstanceScraper"
+  users      = [aws_iam_user.instance_scraper.name]
+  groups     = ["readonly"]
+  policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess"
+}
+
+resource "aws_iam_access_key" "instance_scraper" {
+  user = aws_iam_user.instance_scraper.name
+}

modules/credentials/outputs.tf

@@ -0,0 +1,15 @@
+output "metric_writer_access_key_id" {
+  value = aws_iam_access_key.metric_writer.id
+}
+
+output "metric_writer_secret_key" {
+  value = aws_iam_access_key.metric_writer.secret
+}
+
+output "instance_scraper_access_key_id" {
+  value = aws_iam_access_key.instance_scraper.id
+}
+
+output "instance_scraper_access_secret_key" {
+  value = aws_iam_access_key.instance_scraper.secret
+}

modules/credentials/providers.tf

@@ -0,0 +1,6 @@
+terraform {
+  required_version = "0.13.7"
+  required_providers {
+    aws = "~> 3.0"
+  }
+}

modules/credentials/variables.tf

@@ -0,0 +1,9 @@
+variable "availability_zone" {
+  type        = string
+  description = "The availability zone to create the instance in."
+}
+
+variable "resource_prefix" {
+  type        = string
+  description = "An optional prefix to add to all resources created."
+}