1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118

# SSM documents ==============================================================

resource "aws_ssm_document" "this" {
  for_each = var.documents

  name            = each.value.name
  document_type   = each.value.document_type
  document_format = each.value.document_format
  content         = each.value.content
  target_type     = each.value.target_type
  version_name    = each.value.version_name

  permissions = each.value.permissions != null ? {
    type        = "Share"
    account_ids = join(",", each.value.permissions.account_ids)
  } : null

  tags = local.tags
}

# Maintenance windows ========================================================

resource "aws_ssm_maintenance_window" "this" {
  for_each = var.maintenance_windows

  name                       = each.value.name
  description                = each.value.description
  schedule                   = each.value.schedule
  duration                   = each.value.duration
  cutoff                     = each.value.cutoff
  allow_unassociated_targets = each.value.allow_unassociated_targets
  schedule_timezone          = each.value.schedule_timezone

  tags = local.tags
}

# Maintenance window targets -------------------------------------------------

resource "aws_ssm_maintenance_window_target" "this" {
  for_each = var.maintenance_window_targets

  window_id         = aws_ssm_maintenance_window.this[each.value.window_key].id
  resource_type     = each.value.resource_type
  owner_information = each.value.owner_information

  targets {
    key    = each.value.target_key
    values = each.value.target_values
  }
}

# Maintenance window tasks ---------------------------------------------------

resource "aws_ssm_maintenance_window_task" "this" {
  for_each = var.maintenance_window_tasks

  window_id        = aws_ssm_maintenance_window.this[each.value.window_key].id
  task_type        = each.value.task_type
  task_arn         = each.value.task_arn
  service_role_arn = each.value.service_role_arn
  priority         = each.value.priority
  max_concurrency  = each.value.max_concurrency
  max_errors       = each.value.max_errors

  targets {
    key    = "WindowTargetIds"
    values = [aws_ssm_maintenance_window_target.this[each.value.target_key].id]
  }

  dynamic "task_invocation_parameters" {
    for_each = each.value.run_command_parameters != null ? [each.value.run_command_parameters] : []
    content {
      run_command_parameters {
        document_version = task_invocation_parameters.value.document_version
        output_s3_bucket = task_invocation_parameters.value.output_s3_bucket

        dynamic "parameter" {
          for_each = task_invocation_parameters.value.parameters
          content {
            name   = parameter.key
            values = parameter.value
          }
        }
      }
    }
  }
}

# Patch baselines ============================================================

resource "aws_ssm_patch_baseline" "this" {
  for_each = var.patch_baselines

  name             = each.value.name
  description      = each.value.description
  operating_system = each.value.operating_system

  approved_patches = each.value.approved_patches
  rejected_patches = each.value.rejected_patches

  dynamic "approval_rule" {
    for_each = each.value.approval_rules
    content {
      approve_after_days = approval_rule.value.approve_after_days
      compliance_level   = approval_rule.value.compliance_level

      dynamic "patch_filter" {
        for_each = approval_rule.value.patch_filter_groups
        content {
          key    = keys(patch_filter.value)[0]
          values = values(patch_filter.value)[0]
        }
      }
    }
  }

  tags = local.tags
}