Skip to main content

Service Onboarding Secrets Module

This module enables individual components to onboard access permissions to secrets in the central shared bootstrap Secrets project. It supports:

  1. Granular access to existing secrets for Git repositories: Grant component repository WIF identities access to existing secrets (e.g. GitHub app tokens, worker app PEMs).
  2. Granular access to existing secrets for Service Accounts: Grant specific service accounts access to specific secrets.

Usage Examples​

Grant Secret Access to Git Repositories and Service Accounts​

module "service_onboarding_secrets" {
  source = "../../../../../modules/service-onboarding-secrets"

  config = {
    default     = var.config_default
    environment = var.config_environment
    component   = var.config_component
  }

  grant_git_secret_accessor_permissions = {
    "app" = {
      git_full_repo_name = module.component_scaffold.git_repository_environments["app"].repository
      secrets = [
        "github_factory_app_id",
        "github_factory_app_install_id",
        "github_factory_app_pem",
      ]
    }
  }

  grant_service_account_secret_accessor_permissions = {
    "sa-${var.config_environment.environment_code}-${var.config_component.component_name}-app" = {
      service_account_name = module.component_scaffold.service_accounts["sa-${var.config_environment.environment_code}-${var.config_component.component_name}-app"]
      secrets = [
        "github_factory_app_id",
        "github_factory_app_install_id",
        "github_factory_app_pem",
      ]
    }
  }
}

Static Service Account Emails​

You can also pass external/static service account emails directly:

module "service_onboarding_secrets" {
  source = "../../../../../modules/service-onboarding-secrets"

  config = {
    default     = var.config_default
    environment = var.config_environment
    component   = var.config_component
  }

  grant_service_account_secret_accessor_permissions = {
    "sa-doc-runner" = {
      service_account_name = "sa-doc-runner@prj-c-dgc-doc-hub-12345.iam.gserviceaccount.com"
      secrets              = ["github_factory_app_pem"]
    }
  }
}