opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

Don't use parameters to pass secrets to GCP or AWS (#2039)

Browse Source 
* Don't use parameters to pass secrets to GCP or AWS

Signed-off-by: Spike Curtis <spike@coder.com>

* Fix fmt

Signed-off-by: Spike Curtis <spike@coder.com>
This commit is contained in:
Spike Curtis
2022-06-03 14:29:22 -07:00
committed by GitHub
parent 43f622a52d
commit 847e2b18da
11 changed files with 180 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files
examples/templates/aws-linux/README.md
+7
View File
@@ -10,6 +10,13 @@ tags: [cloud, aws]
Pick this template in `coder templates init` and follow instructions.
## Authentication
This template assumes that coderd is run in an environment that is authenticated
with AWS. For example, run `aws configure import` to import credentials on the
system and user running coderd. For other ways to authenticate [consult the
Terraform docs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#authentication-and-configuration).
## Required permissions / policy
This example policy allows Coder to create EC2 instances and modify instances provisioned by Coder.
examples/templates/aws-linux/main.tf
+1 -23
View File
@@ -7,26 +7,6 @@ terraform {
}
}
variable "access_key" {
description = <<EOT
Create an AWS access key to provision resources with Coder:
- https://console.aws.amazon.com/iam/home#/users
See the template README for an example permissions policy,
if needed.
AWS Access Key ID
EOT
sensitive = true
}
variable "secret_key" {
description = <<EOT
AWS Secret Key
EOT
sensitive = true
}
# Last updated 2022-05-31
# aws ec2 describe-regions | jq -r '[.Regions[].RegionName] | sort'
variable "region" {
@@ -70,9 +50,7 @@ variable "disk_size" {
}
provider "aws" {
region = var.region
access_key = var.access_key
secret_key = var.secret_key
region = var.region
}
data "coder_workspace" "me" {
examples/templates/aws-windows/README.md
+66
View File
@@ -3,3 +3,69 @@ name: Develop in Windows on AWS
description: Get started with Windows development on AWS.
tags: [cloud, aws]
---
# aws-windows
## Getting started
Pick this template in `coder templates init` and follow instructions.
## Authentication
This template assumes that coderd is run in an environment that is authenticated
with AWS. For example, run `aws configure import` to import credentials on the
system and user running coderd. For other ways to authenticate [consult the
Terraform docs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#authentication-and-configuration).
## Required permissions / policy
This example policy allows Coder to create EC2 instances and modify instances provisioned by Coder.
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"ec2:GetDefaultCreditSpecification",
"ec2:DescribeIamInstanceProfileAssociations",
"ec2:DescribeTags",
"ec2:CreateTags",
"ec2:RunInstances",
"ec2:DescribeInstanceCreditSpecifications",
"ec2:DescribeImages",
"ec2:ModifyDefaultCreditSpecification",
"ec2:DescribeVolumes"
],
"Resource": "*"
},
{
"Sid": "CoderResouces",
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances",
"ec2:DescribeInstanceAttribute",
"ec2:UnmonitorInstances",
"ec2:TerminateInstances",
"ec2:StartInstances",
"ec2:StopInstances",
"ec2:DeleteTags",
"ec2:MonitorInstances",
"ec2:CreateTags",
"ec2:RunInstances",
"ec2:ModifyInstanceAttribute",
"ec2:ModifyInstanceCreditSpecification"
],
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/Coder_Provisioned": "true"
}
}
}
]
}
```
examples/templates/aws-windows/main.tf
+1 -20
View File
@@ -7,23 +7,6 @@ terraform {
}
}
variable "access_key" {
description = <<EOT
Create an AWS access key to provision resources with Coder:
- https://console.aws.amazon.com/iam/home#/users
AWS Access Key
EOT
sensitive = true
}
variable "secret_key" {
description = <<EOT
AWS Secret Key
EOT
sensitive = true
}
# Last updated 2022-05-31
# aws ec2 describe-regions | jq -r '[.Regions[].RegionName] | sort'
variable "region" {
@@ -54,9 +37,7 @@ variable "region" {
}
provider "aws" {
region = var.region
access_key = var.access_key
secret_key = var.secret_key
region = var.region
}
data "coder_workspace" "me" {
examples/templates/gcp-linux/README.md
+19
View File
@@ -3,3 +3,22 @@ name: Develop in Linux on Google Cloud
description: Get started with Linux development on Google Cloud.
tags: [cloud, google]
---
# gcp-linux
## Getting started
Pick this template in `coder templates init` and follow instructions.
## Authentication
This template assumes that coderd is run in an environment that is authenticated
with Google Cloud. For example, run `gcloud auth application-default login` to import
credentials on the system and user running coderd. For other ways to authenticate
[consult the Terraform docs](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/getting_started#adding-credentials).
## Required permissions / policy
The user or service account used by the Terraform provisioner should have the following roles
- Compute Admin
examples/templates/gcp-linux/main.tf
+4 -17
View File
@@ -11,20 +11,8 @@ terraform {
}
}
variable "service_account" {
description = <<EOF
Coder requires a Google Cloud Service Account to provision workspaces.
1. Create a service account:
https://console.cloud.google.com/projectselector/iam-admin/serviceaccounts/create
2. Add the roles:
- Compute Admin
- Service Account User
3. Click on the created key, and navigate to the "Keys" tab.
4. Click "Add key", then "Create new key".
5. Generate a JSON private key, and paste the contents below.
EOF
sensitive = true
variable "project_id" {
description = "Which Google Compute Project should your workspace live in?"
}
variable "zone" {
@@ -37,9 +25,8 @@ variable "zone" {
}
provider "google" {
zone = var.zone
credentials = var.service_account
project = jsondecode(var.service_account).project_id
zone = var.zone
project = var.project_id
}
data "google_compute_default_service_account" "default" {
examples/templates/gcp-vm-container/README.md
+19
View File
@@ -3,3 +3,22 @@ name: Develop in a container on a Google Cloud VM
description: Get started with Linux development on Google Cloud.
tags: [cloud, google, container]
---
# gcp-vm-container
## Getting started
Pick this template in `coder templates init` and follow instructions.
## Authentication
This template assumes that coderd is run in an environment that is authenticated
with Google Cloud. For example, run `gcloud auth application-default login` to import
credentials on the system and user running coderd. For other ways to authenticate
[consult the Terraform docs](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/getting_started#adding-credentials).
## Required permissions / policy
The user or service account used by the Terraform provisioner should have the following roles
- Compute Admin
examples/templates/gcp-vm-container/main.tf
+4 -17
View File
@@ -11,20 +11,8 @@ terraform {
}
}
variable "service_account" {
description = <<EOF
Coder requires a Google Cloud Service Account to provision workspaces.
1. Create a service account:
https://console.cloud.google.com/projectselector/iam-admin/serviceaccounts/create
2. Add the roles:
- Compute Admin
- Service Account User
3. Click on the created key, and navigate to the "Keys" tab.
4. Click "Add key", then "Create new key".
5. Generate a JSON private key, and paste the contents below.
EOF
sensitive = true
variable "project_id" {
description = "Which Google Compute Project should your workspace live in?"
}
variable "zone" {
@@ -37,9 +25,8 @@ variable "zone" {
}
provider "google" {
zone = var.zone
credentials = var.service_account
project = jsondecode(var.service_account).project_id
zone = var.zone
project = var.project_id
}
data "google_compute_default_service_account" "default" {
examples/templates/gcp-windows/README.md
+19
View File
@@ -3,3 +3,22 @@ name: Develop in Windows on Google Cloud
description: Get started with Windows development on Google Cloud.
tags: [cloud, google]
---
# gcp-windows
## Getting started
Pick this template in `coder templates init` and follow instructions.
## Authentication
This template assumes that coderd is run in an environment that is authenticated
with Google Cloud. For example, run `gcloud auth application-default login` to import
credentials on the system and user running coderd. For other ways to authenticate
[consult the Terraform docs](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/getting_started#adding-credentials).
## Required permissions / policy
The user or service account used by the Terraform provisioner should have the following roles
- Compute Admin
examples/templates/gcp-windows/main.tf
+4 -17
View File
@@ -11,20 +11,8 @@ terraform {
}
}
variable "service_account" {
description = <<EOF
Coder requires a Google Cloud Service Account to provision workspaces.
1. Create a service account:
https://console.cloud.google.com/projectselector/iam-admin/serviceaccounts/create
2. Add the roles:
- Compute Admin
- Service Account User
3. Click on the created key, and navigate to the "Keys" tab.
4. Click "Add key", then "Create new key".
5. Generate a JSON private key, and paste the contents below.
EOF
sensitive = true
variable "project_id" {
description = "Which Google Compute Project should your workspace live in?"
}
variable "zone" {
@@ -37,9 +25,8 @@ variable "zone" {
}
provider "google" {
zone = var.zone
credentials = var.service_account
project = jsondecode(var.service_account).project_id
zone = var.zone
project = var.project_id
}
data "coder_workspace" "me" {