feat: allow ebs launch template encryption (cloudposse#36)

* feat: allow ebs launch template encryption * Updated README.md * Executed 'terraform fmt' * Update variables.tf Co-authored-by: Andriy Knysh <aknysh@users.noreply.github.com> * Update variables.tf Co-authored-by: Andriy Knysh <aknysh@users.noreply.github.com> * Updated README.md * Update launch-template.tf Co-authored-by: Andriy Knysh <aknysh@users.noreply.github.com> Co-authored-by: actions-bot <58130806+actions-bot@users.noreply.github.com> Co-authored-by: Andriy Knysh <aknysh@users.noreply.github.com>
DreamLab · Oct 14, 2020 · 836ca1d · 836ca1d
1 parent 6d012b4
commit 836ca1d
Show file tree

Hide file tree

Showing 4 changed files with 9 additions and 0 deletions.
diff --git a/README.md b/README.md
@@ -222,6 +222,7 @@ Available targets:
 | kubernetes\_taints | Key-value mapping of Kubernetes taints. | `map(string)` | `{}` | no |
 | kubernetes\_version | Kubernetes version. Defaults to EKS Cluster Kubernetes version. Terraform will only perform drift detection if a configuration value is provided | `string` | `null` | no |
 | label\_order | The naming order of the id output and Name tag.<br>Defaults to ["namespace", "environment", "stage", "name", "attributes"].<br>You can omit any of the 5 elements, but at least one must be present. | `list(string)` | `null` | no |
+| launch\_template\_disk\_encryption\_enabled | Enable disk encryption for the created launch template (if we aren't provided with an existing launch template) | `bool` | `false` | no |
 | launch\_template\_name | The name (not ID) of a custom launch template to use for the EKS node group. If provided, it must specify the AMI image id. | `string` | `null` | no |
 | launch\_template\_version | The version of the specified launch template to use. Defaults to latest version. | `string` | `null` | no |
 | max\_size | Maximum number of worker nodes | `number` | n/a | yes |

diff --git a/docs/terraform.md b/docs/terraform.md
@@ -48,6 +48,7 @@
 | kubernetes\_taints | Key-value mapping of Kubernetes taints. | `map(string)` | `{}` | no |
 | kubernetes\_version | Kubernetes version. Defaults to EKS Cluster Kubernetes version. Terraform will only perform drift detection if a configuration value is provided | `string` | `null` | no |
 | label\_order | The naming order of the id output and Name tag.<br>Defaults to ["namespace", "environment", "stage", "name", "attributes"].<br>You can omit any of the 5 elements, but at least one must be present. | `list(string)` | `null` | no |
+| launch\_template\_disk\_encryption\_enabled | Enable disk encryption for the created launch template (if we aren't provided with an existing launch template) | `bool` | `false` | no |
 | launch\_template\_name | The name (not ID) of a custom launch template to use for the EKS node group. If provided, it must specify the AMI image id. | `string` | `null` | no |
 | launch\_template\_version | The version of the specified launch template to use. Defaults to latest version. | `string` | `null` | no |
 | max\_size | Maximum number of worker nodes | `number` | n/a | yes |

diff --git a/launch-template.tf b/launch-template.tf
@@ -62,6 +62,7 @@ resource "aws_launch_template" "default" {
 
     ebs {
       volume_size = var.disk_size
+      encrypted   = var.launch_template_disk_encryption_enabled
     }
   }
 

diff --git a/variables.tf b/variables.tf
@@ -185,6 +185,12 @@ variable "module_depends_on" {
   description = "Can be any value desired. Module will wait for this value to be computed before creating node group."
 }
 
+variable "launch_template_disk_encryption_enabled" {
+  type        = bool
+  description = "Enable disk encryption for the created launch template (if we aren't provided with an existing launch template)"
+  default     = false
+}
+
 variable "launch_template_name" {
   type = string
   // Note: the aws_launch_template data source only accepts name, not ID, to specify the launch template, so we cannot support ID as input.