Jira (PUP-4080) support S3 URL as the file type 'source'

[Peter Foley (JIRA)]

Title: Message Title

Peter Foley commented on PUP-4080   Re: support S3 URL as the file type 'source' The reason I decided to look at how feasible it was to add S3 support to the puppet file type was to help with managing sensitive information and how to get it onto the puppet master. Essentially I want to have a secure s3 bucket that only my puppet masters can pull files from, this bucket would contain private keys to decode hiera data, private keys to connect to private repos on github, bitbucket and/or a private git server and other sensitive data the puppet master needs. I would than manage access to the bucket via AWS IAM roles. To bootstrap a new LAN I would use the puppetlabs-aws module to create a number of ec2 instances (one of which would be a puppet master) for the puppet master ec2 instance I would give it the IAM role to grant it access to the puppetmaster s3 bucket. Once the ec2 instance is created I would run a bootstrap.pp file that contained: bootstrap.pp # .... other bootstrap stuff ....   package { 'aws-sdk-core': provider => gem, before => File['/root/.ssh/bitbucket-deploy-key.openssh', '/root/.ssh/github-deploy-key.openssh', '/root/.ssh/hiera-decryption-key.openssh'] }   file { '/root/.ssh/bitbucket-deploy-key.openssh': source => 's3://puppetmaster-IAM-locked-down-bucket/bitbucket-deploy-key.openssh', mode => 0600, region => 'ap-southeast-2', }   file { '/root/.ssh/github-deploy-key.openssh': source => 's3://puppetmaster-IAM-locked-down-bucket/github-deploy-key.openssh', mode => 0600, region => 'ap-southeast-2', }   file { '/root/.ssh/hiera-decryption-key.openssh': source => 's3://puppetmaster-IAM-locked-down-bucket/hiera-decryption-key.openssh', mode => 0600, region => 'ap-southeast-2', }   $str = "HOST bitbucket.org StrictHostKeyChecking no IdentityFile /root/.ssh/bitbucket-deploy-key.openssh HOST github.com StrictHostKeyChecking no IdentityFile /root/.ssh/github-deploy-key.openssh "   file { '/root.ssh/config': source => 's3://puppetmaster-IAM-locked-down-bucket/root-ssh-config', mode => 0600, region => 'ap-southeast-2', }   # Rest of the code to pull down the encrypted hieradata repo and other configuration information to bootstrap the puppet environment If I ever need to change the sensitive keys I can just replace them in the s3 bucket and puppet will do the rest for me on the next puppet run. As the information will be pulled from within the same AWS region (hopefully in the same data centre) it is unlikely that it can be MITM'ed or tampered with in transit (yes I know I have to originally put the private keys into the s3 bucket ...). This obviously would work for puppet clients as well for applications where you need to seed the application with various files that you don't need to store on the puppet master. Add Comment   This message was sent by Atlassian JIRA (v6.3.10#6340-sha1:7ea293a) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.