Adding workers_launch_template ebs encryption

terraform-aws-modules · Mar 2, 2019 · 6743b42 · 6743b42
1 parent 87114b0
commit 6743b42
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -12,6 +12,7 @@ project adheres to [Semantic Versioning](http://semver.org/).
 ### Added
 
 - Write your awesome addition here (by @you)
+- Adding ebs encryption for workers launched using workers_launch_template (by @russki)
 
 ### Changed
 

diff --git a/local.tf b/local.tf
@@ -62,6 +62,8 @@ locals {
     root_volume_size                         = "100"                                         # root volume size of workers instances.
     root_volume_type                         = "gp2"                                         # root volume type of workers instances, can be 'standard', 'gp2', or 'io1'
     root_iops                                = "0"                                           # The amount of provisioned IOPS. This must be set with a volume_type of "io1".
+    root_encrypted                           = false                                         # root volume encryption for workers.
+    kms_key_id                               = ""                                            # AWS KMS customer master key to use when creating encrypted volume. ASG must have access to CMK.
     key_name                                 = ""                                            # The key name that should be used for the instances in the autoscaling group
     pre_userdata                             = ""                                            # userdata to pre-append to the default userdata.
     additional_userdata                      = ""                                            # userdata to append to the default userdata.

diff --git a/workers_launch_template.tf b/workers_launch_template.tf
@@ -96,6 +96,8 @@ resource "aws_launch_template" "workers_launch_template" {
       volume_size           = "${lookup(var.worker_groups_launch_template[count.index], "root_volume_size", local.workers_group_launch_template_defaults["root_volume_size"])}"
       volume_type           = "${lookup(var.worker_groups_launch_template[count.index], "root_volume_type", local.workers_group_launch_template_defaults["root_volume_type"])}"
       iops                  = "${lookup(var.worker_groups_launch_template[count.index], "root_iops", local.workers_group_launch_template_defaults["root_iops"])}"
+      encrypted             = "${lookup(var.worker_groups_launch_template[count.index], "root_encrypted", local.workers_group_launch_template_defaults["root_encrypted"])}"
+      kms_key_id            = "${lookup(var.worker_groups_launch_template[count.index], "kms_key_id", local.workers_group_launch_template_defaults["kms_key_id"])}"
       delete_on_termination = true
     }
   }