From 90baa006dab0b62742bc153d9d0558b0ebcebb43 Mon Sep 17 00:00:00 2001 From: Megan Marsh Date: Tue, 5 Feb 2019 14:19:24 -0800 Subject: [PATCH] add docs on all builders. --- .../docs/builders/amazon-chroot.html.md | 37 ++++++++++++++++++ .../source/docs/builders/amazon-ebs.html.md | 8 +--- .../docs/builders/amazon-ebssurrogate.html.md | 36 ++++++++++++++++++ .../docs/builders/amazon-ebsvolume.html.md | 37 ++++++++++++++++++ .../docs/builders/amazon-instance.html.md | 38 +++++++++++++++++++ 5 files changed, 150 insertions(+), 6 deletions(-) diff --git a/website/source/docs/builders/amazon-chroot.html.md b/website/source/docs/builders/amazon-chroot.html.md index 24622e049..0bc4934ae 100644 --- a/website/source/docs/builders/amazon-chroot.html.md +++ b/website/source/docs/builders/amazon-chroot.html.md @@ -362,6 +362,43 @@ each category, the available configuration keys are alphabetized. [template engine](/docs/templates/engine.html), see [Build template data](#build-template-data) for more information. +- `vault_aws_engine` (object) - Get credentials from Hashicorp Vault's aws + secrets engine. You must already have created a role to use. For more + information about generating credentials via the Vault engine, see the + [Vault docs.] + (https://www.vaultproject.io/api/secret/aws/index.html#generate-credentials) + If you set this + flag, you must also set the below options: + - `name` (string) - Required. Specifies the name of the role to generate + credentials against. This is part of the request URL. + - `engine_name` (string) - The name of the aws secrets engine. In the Vault + docs, this is normally referred to as "aws", and Packer will default to + "aws" if `engine_name` is not set. + - `role_arn` (string)- The ARN of the role to assume if credential_type on + the Vault role is assumed_role. Must match one of the allowed role ARNs + in the Vault role. Optional if the Vault role only allows a single AWS + role ARN; required otherwise. + - `ttl` (string) - Specifies the TTL for the use of the STS token. This is + specified as a string with a duration suffix. Valid only when + credential_type is assumed_role or federation_token. When not specified, + the default_sts_ttl set for the role will be used. If that is also not + set, then the default value of 3600s will be used. AWS places limits on + the maximum TTL allowed. See the AWS documentation on the DurationSeconds + parameter for AssumeRole (for assumed_role credential types) and + GetFederationToken (for federation_token credential types) for more + details. + + Example: + ``` json + { + "vault_aws_engine": { + "name": "myrole", + "role_arn": "myarn", + "ttl": "3600s" + } + } + ``` + ## Basic Example Here is a basic example. It is completely valid except for the access keys: diff --git a/website/source/docs/builders/amazon-ebs.html.md b/website/source/docs/builders/amazon-ebs.html.md index f0e7d97ce..58bcd9b9f 100644 --- a/website/source/docs/builders/amazon-ebs.html.md +++ b/website/source/docs/builders/amazon-ebs.html.md @@ -533,15 +533,11 @@ builder. GetFederationToken (for federation_token credential types) for more details. - Please note that because credentials that are not supported by an STS - token are eventually consistent, Packer will pause for ten seconds after - retrieving the credentials before continuing with the build. - ``` json { "vault_aws_engine": { - "name": "myrole" - "role_arn": "myarn" + "name": "myrole", + "role_arn": "myarn", "ttl": "3600s" } } diff --git a/website/source/docs/builders/amazon-ebssurrogate.html.md b/website/source/docs/builders/amazon-ebssurrogate.html.md index becffc4f4..126b770a5 100644 --- a/website/source/docs/builders/amazon-ebssurrogate.html.md +++ b/website/source/docs/builders/amazon-ebssurrogate.html.md @@ -497,6 +497,42 @@ builder. - `user_data_file` (string) - Path to a file that will be used for the user data when launching the instance. + +- `vault_aws_engine` (object) - Get credentials from Hashicorp Vault's aws + secrets engine. You must already have created a role to use. For more + information about generating credentials via the Vault engine, see the + [Vault docs.] + (https://www.vaultproject.io/api/secret/aws/index.html#generate-credentials) + If you set this flag, you must also set the below options: + - `name` (string) - Required. Specifies the name of the role to generate + credentials against. This is part of the request URL. + - `engine_name` (string) - The name of the aws secrets engine. In the Vault + docs, this is normally referred to as "aws", and Packer will default to + "aws" if `engine_name` is not set. + - `role_arn` (string)- The ARN of the role to assume if credential_type on + the Vault role is assumed_role. Must match one of the allowed role ARNs + in the Vault role. Optional if the Vault role only allows a single AWS + role ARN; required otherwise. + - `ttl` (string) - Specifies the TTL for the use of the STS token. This is + specified as a string with a duration suffix. Valid only when + credential_type is assumed_role or federation_token. When not specified, + the default_sts_ttl set for the role will be used. If that is also not + set, then the default value of 3600s will be used. AWS places limits on + the maximum TTL allowed. See the AWS documentation on the DurationSeconds + parameter for AssumeRole (for assumed_role credential types) and + GetFederationToken (for federation_token credential types) for more + details. + + Example: + ``` json + { + "vault_aws_engine": { + "name": "myrole", + "role_arn": "myarn", + "ttl": "3600s" + } + } + ``` - `vpc_id` (string) - If launching into a VPC subnet, Packer needs the VPC ID in order to create a temporary security group within the VPC. Requires `subnet_id` to be set. If this field is left blank, Packer will try to get diff --git a/website/source/docs/builders/amazon-ebsvolume.html.md b/website/source/docs/builders/amazon-ebsvolume.html.md index 9cd438a8a..18b1ebadd 100644 --- a/website/source/docs/builders/amazon-ebsvolume.html.md +++ b/website/source/docs/builders/amazon-ebsvolume.html.md @@ -407,6 +407,43 @@ builder. - `user_data_file` (string) - Path to a file that will be used for the user data when launching the instance. +- `vault_aws_engine` (object) - Get credentials from Hashicorp Vault's aws + secrets engine. You must already have created a role to use. For more + information about generating credentials via the Vault engine, see the + [Vault docs.] + (https://www.vaultproject.io/api/secret/aws/index.html#generate-credentials) + If you set this + flag, you must also set the below options: + - `name` (string) - Required. Specifies the name of the role to generate + credentials against. This is part of the request URL. + - `engine_name` (string) - The name of the aws secrets engine. In the Vault + docs, this is normally referred to as "aws", and Packer will default to + "aws" if `engine_name` is not set. + - `role_arn` (string)- The ARN of the role to assume if credential_type on + the Vault role is assumed_role. Must match one of the allowed role ARNs + in the Vault role. Optional if the Vault role only allows a single AWS + role ARN; required otherwise. + - `ttl` (string) - Specifies the TTL for the use of the STS token. This is + specified as a string with a duration suffix. Valid only when + credential_type is assumed_role or federation_token. When not specified, + the default_sts_ttl set for the role will be used. If that is also not + set, then the default value of 3600s will be used. AWS places limits on + the maximum TTL allowed. See the AWS documentation on the DurationSeconds + parameter for AssumeRole (for assumed_role credential types) and + GetFederationToken (for federation_token credential types) for more + details. + + Example: + ``` json + { + "vault_aws_engine": { + "name": "myrole", + "role_arn": "myarn", + "ttl": "3600s" + } + } + ``` + - `vpc_id` (string) - If launching into a VPC subnet, Packer needs the VPC ID in order to create a temporary security group within the VPC. Requires `subnet_id` to be set. If this field is left blank, Packer will try to get diff --git a/website/source/docs/builders/amazon-instance.html.md b/website/source/docs/builders/amazon-instance.html.md index 4ce4a0255..0f74a6455 100644 --- a/website/source/docs/builders/amazon-instance.html.md +++ b/website/source/docs/builders/amazon-instance.html.md @@ -489,6 +489,44 @@ builder. - `user_data_file` (string) - Path to a file that will be used for the user data when launching the instance. + +- `vault_aws_engine` (object) - Get credentials from Hashicorp Vault's aws + secrets engine. You must already have created a role to use. For more + information about generating credentials via the Vault engine, see the + [Vault docs.] + (https://www.vaultproject.io/api/secret/aws/index.html#generate-credentials) + If you set this + flag, you must also set the below options: + - `name` (string) - Required. Specifies the name of the role to generate + credentials against. This is part of the request URL. + - `engine_name` (string) - The name of the aws secrets engine. In the Vault + docs, this is normally referred to as "aws", and Packer will default to + "aws" if `engine_name` is not set. + - `role_arn` (string)- The ARN of the role to assume if credential_type on + the Vault role is assumed_role. Must match one of the allowed role ARNs + in the Vault role. Optional if the Vault role only allows a single AWS + role ARN; required otherwise. + - `ttl` (string) - Specifies the TTL for the use of the STS token. This is + specified as a string with a duration suffix. Valid only when + credential_type is assumed_role or federation_token. When not specified, + the default_sts_ttl set for the role will be used. If that is also not + set, then the default value of 3600s will be used. AWS places limits on + the maximum TTL allowed. See the AWS documentation on the DurationSeconds + parameter for AssumeRole (for assumed_role credential types) and + GetFederationToken (for federation_token credential types) for more + details. + + Example: + ``` json + { + "vault_aws_engine": { + "name": "myrole", + "role_arn": "myarn", + "ttl": "3600s" + } + } + ``` + - `vpc_id` (string) - If launching into a VPC subnet, Packer needs the VPC ID in order to create a temporary security group within the VPC. Requires `subnet_id` to be set. If this field is left blank, Packer will try to get