SRE-2715-make-ssm-param-and-kms-key-arns-optional-for-terraform-aws-ecs-service

[SaiPrasannaGopularam]

Changes

• Add dynamic statement blocks for accessing ssm parameters and kms key, otherwise making it mandatory to pass these values

[SaiPrasannaGopularam]

Plan:

Terraform will perform the following actions:

  # module.contentkeeper.data.aws_iam_policy_document.task_execution_role_policy will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "task_execution_role_policy" {
      + id   = (known after apply)
      + json = (known after apply)

      + statement {
          + actions   = [
              + "secretsmanager:GetSecretValue",
            ]
          + effect    = "Allow"
          + resources = [
              + "arn:aws:secretsmanager:us-east-1:332913666507:secret:contentkeeper-cms/stg/env-vars/jwt-secret-key-1hGb8z",
              + "arn:aws:secretsmanager:us-east-1:332913666507:secret:contentkeeper-cms/stg/env-vars/sp_private_key-ntasrG",
              + "arn:aws:secretsmanager:us-east-1:332913666507:secret:ue1stg-runkeeper-services-image-pull-secret-JRwEJv",
            ]
        }
      + statement {
          + actions   = [
              + "ssm:GetParameter",
              + "ssm:GetParameters",
            ]
          + effect    = "Allow"
          + resources = [
              + "arn:aws:ssm:us-east-1:332913666507:parameter/contentkeeper-cms/stg/env-vars/saml-metadata-xml",
            ]
        }
      + statement {
          + actions   = [
              + "kms:Decrypt",
            ]
          + effect    = "Allow"
          + resources = [
              + "arn:aws:kms:us-east-1:332913666507:key/1192588f-3161-44ef-a238-4f309a0128bb",
            ]
        }
      + statement {
          + actions   = [
              + "ecs:DescribeTasks",
              + "ecs:ExecuteCommand",
            ]
          + effect    = "Allow"
          + resources = [
              + (known after apply),
            ]
        }
    }

  # module.contentkeeper.aws_ecs_service.service will be updated in-place
  ~ resource "aws_ecs_service" "service" {
        id                                 = "arn:aws:ecs:us-east-1:332913666507:service/ue1stg-runkeeper-services/contentkeeper-stg-cms-service"
        name                               = "contentkeeper-stg-cms-service"
        tags                               = {
            "Application"      = "contentkeeper-stg"
            "Env"              = "stg"
            "TerraformManaged" = "true"
        }
      ~ task_definition                    = "arn:aws:ecs:us-east-1:332913666507:task-definition/contentkeeper-stg-cms:34" -> (known after apply)
        # (15 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # module.contentkeeper.aws_ecs_task_definition.task must be replaced
-/+ resource "aws_ecs_task_definition" "task" {
      ~ arn                      = "arn:aws:ecs:us-east-1:332913666507:task-definition/contentkeeper-stg-cms:34" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:us-east-1:332913666507:task-definition/contentkeeper-stg-cms" -> (known after apply)
      ~ container_definitions    = jsonencode(
          ~ [
              ~ {
                  ~ linuxParameters       = {
                      ~ capabilities       = {
                          - add  = []
                            # (1 unchanged attribute hidden)
                        }
                        # (1 unchanged attribute hidden)
                    }
                    name                  = "contentkeeper-stg-cms"
                  - systemControls        = []
                    # (12 unchanged attributes hidden)
                },
            ] # forces replacement
        )
      ~ id                       = "contentkeeper-stg-cms" -> (known after apply)
      ~ revision                 = 34 -> (known after apply)
        tags                     = {
            "Application"      = "contentkeeper-stg"
            "Env"              = "stg"
            "TerraformManaged" = "true"
        }
        # (9 unchanged attributes hidden)
    }

  # module.contentkeeper.aws_iam_role_policy.task_execution_role_policy will be updated in-place
  ~ resource "aws_iam_role_policy" "task_execution_role_policy" {
        id     = "contentkeeper-stg-cms-ecsTaskExecutionRole:contentkeeper-stg-cms-ecs-task-execution-role-policy"
        name   = "contentkeeper-stg-cms-ecs-task-execution-role-policy"
      ~ policy = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = "secretsmanager:GetSecretValue"
                      - Effect   = "Allow"
                      - Resource = [
                          - "arn:aws:secretsmanager:us-east-1:332913666507:secret:ue1stg-runkeeper-services-image-pull-secret-JRwEJv",
                          - "arn:aws:secretsmanager:us-east-1:332913666507:secret:contentkeeper-cms/stg/env-vars/sp_private_key-ntasrG",
                          - "arn:aws:secretsmanager:us-east-1:332913666507:secret:contentkeeper-cms/stg/env-vars/jwt-secret-key-1hGb8z",
                        ]
                    },
                  - {
                      - Action   = "kms:Decrypt"
                      - Effect   = "Allow"
                      - Resource = "arn:aws:kms:us-east-1:332913666507:key/1192588f-3161-44ef-a238-4f309a0128bb"
                    },
                  - {
                      - Action   = [
                          - "ecs:ExecuteCommand",
                          - "ecs:DescribeTasks",
                        ]
                      - Effect   = "Allow"
                      - Resource = "arn:aws:ecs:us-east-1:332913666507:task-definition/contentkeeper-stg-cms:34"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> (known after apply)
        # (1 unchanged attribute hidden)
    }

Plan: 1 to add, 2 to change, 1 to destroy.