Skip to main content

Credentials and Secrets

Overview​

The credentials variable controls how the module gets the Upwind client credentials and the registry credentials. The components use the client credentials to authenticate with Upwind. They use the registry credentials to pull images from the Upwind registry.

AttributeTypeDefaultDescription
client_idstringnullThe client ID. The module creates a secret from it. Set it together with client_secret.
client_secretstringnullThe client secret. Set it together with client_id.
secret_arnstringnullThe ARN of an existing secret that holds the client credentials. Do not combine it with client_id or client_secret.
registry_secret_arnstringnullThe ARN of an existing registry credentials secret. When unset, the module creates the secret and a Lambda function that refreshes it.
registry_auth_enabledbooltrueSet to false to attach no registry credentials to the image pulls.

You must set either secret_arn or both client_id and client_secret.

Client ID and client secret​

Pass the credentials and let the module create the secret:

module "upwind_ecs_runtime" {
  source = "https://get.upwind.io/terraform/modules/aws-ecs-runtime/aws-ecs-runtime-1.5.1.tar.gz"

  ecs_cluster_name = "my-ecs-cluster"
  vpc_id           = "vpc-0123456789abcdef0"
  subnets          = ["subnet-0123456789abcdef0", "subnet-0fedcba9876543210"]

  credentials = {
    client_id     = var.upwind_client_id
    client_secret = var.upwind_client_secret
  }
}

Existing secret​

To keep the credentials out of Terraform, reference a secret that you manage. Use secret_arn instead of client_id and client_secret:

credentials = {
  secret_arn = "arn:aws:secretsmanager:us-east-1:111122223333:secret:upwind-sensor-credentials-AbCdEf"
}

The secret value is a JSON object with the keys ClientID and ClientSecret.

Shared registry secret​

By default, each module deployment creates its own registry credentials secret and a Lambda function (UWRegCred-...) that refreshes it. The registry token is short-lived, and that Lambda function refreshes it every hour, so every shared secret needs exactly one owner.

To run many clusters with one registry secret, use one owner deployment. It leaves credentials.registry_secret_arn unset, so it creates the registry secret and its Lambda function. Every other cluster passes the owner's registry_credentials_secret_arn output as credentials.registry_secret_arn, and creates no secret and no Lambda function. Multi-cluster mode does this with the utility cluster as the owner.

credentials = {
  client_id           = var.upwind_client_id
  client_secret       = var.upwind_client_secret
  registry_secret_arn = module.upwind_cluster_manager.registry_credentials_secret_arn
}

Image mirrors​

If you pull the Upwind images from a mirror that needs no Upwind credentials, such as an ECR repository in the same AWS account, turn off registry authentication. The module then attaches no registry credentials to the image pulls, and registry_secret_arn must stay unset.

credentials = {
  client_id             = var.upwind_client_id
  client_secret         = var.upwind_client_secret
  registry_auth_enabled = false
}

sensor = {
  image = {
    registry = "111122223333.dkr.ecr.us-east-1.amazonaws.com"
  }
}

cluster_manager = {
  image = {
    registry = "111122223333.dkr.ecr.us-east-1.amazonaws.com"
  }
}

For the cluster manager image settings, see Cluster manager. For the other image settings, see Sensor and scanner and Tracer.