Skip to content

Commit 873a98d

Browse files
cabutlermitcabutlermit
committed
Terraform Cleanup
Why these changes are being introduced: Update the Terraform lockfile and Terraform Cloud to run version 1.2.9. How this addresses that need: * Run `terraform init -upgrade` to update the .terraform.lock.hcl file to capture the AWS provider update * Clean up ssm_inputs file to remove unnecessary lines * Minor README formatting changes Side effects of this change: None.
1 parent 8b4acde commit 873a98d

File tree

8 files changed

+99
-99
lines changed

8 files changed

+99
-99
lines changed

‎.terraform.lock.hcl‎

Lines changed: 13 additions & 14 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎README.md‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -33,23 +33,26 @@ The [ppod_ecr.tf](./ppod_ecr.tf) is a good example of a single ECR repository fo
3333

3434
A quick note for application developers and the integration of workflows to automate the deployment of their containerized application to either Fargate or Lambda. When this code is deployed in Terraform Cloud, it generates outputs that contain the caller workflows code as well as the `Makefile` code for their application. Those outputs are accessible to the developers via Terraform Cloud -- they can go into TfC, find the correct Terraform Output, and then copy that text into their application repository.
3535

36-
## Making this work in your environment outside of MIT libraries:
37-
This repository is a part of an ecosystem of components designed to work in our AWS organization. This component is responsible for a standardized setup of ECR repositories and a build process that goes in github actions and makefiles. On its own, this repository could be useful to you if you want to emulate how we deploy and promote containers across our AWS accounts, or utilize github OIDC connections for depositing ECR containers to AWS. Before this will deploy in your environment, you will need an OpenID Connect Provider. We generate this in our "init" repo, but you could just as easily place it here and reference it directly.
36+
## Making this work in your environment outside of MIT libraries
37+
38+
This repository is a part of an ecosystem of components designed to work in our AWS organization. This component is responsible for a standardized setup of ECR repositories and a build process that goes in Github Actions and Makefiles. On its own, this repository could be useful to you if you want to emulate how we deploy and promote containers across our AWS accounts, or utilize GitHub OIDC connections for depositing ECR containers to AWS. Before this will deploy in your environment, you will need an OpenID Connect Provider. We generate this in our "init" repo, but you could just as easily place it here and reference it directly.
3839

3940
An example of that infrastructure is:
40-
```
41+
42+
```terraform
4143
resource "aws_iam_openid_connect_provider" "github" {
4244
url = "https://token.actions.githubusercontent.com"
4345
client_id_list = ["sts.amazonaws.com"]
4446
thumbprint_list = ["6938fd4d98bab03faadb97b34396831e3780aea1"]
4547
}
4648
```
49+
4750
then replace all the ssm parameter references for `oidc_arn` with `aws_iam_openid_connect_provider.github.arn`
4851

4952
## Additional Reference
5053

51-
* https://blog.tedivm.com/guides/2021/10/github-actions-push-to-aws-ecr-without-credentials-oidc/
52-
* https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#example-subject-claims
54+
* [github-actions-push-to-aws-ecr-without-credentials-oidc](https://blog.tedivm.com/guides/2021/10/github-actions-push-to-aws-ecr-without-credentials-oidc/)
55+
* [about-security-hardening-with-openid-connect](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#example-subject-claims)
5356

5457
## TF markdown is automatically inserted at the bottom of this file, nothing should be written beyond this point
5558

@@ -65,7 +68,7 @@ then replace all the ssm parameter references for `oidc_arn` with `aws_iam_openi
6568

6669
| Name | Version |
6770
|------|---------|
68-
| aws | 4.26.0 |
71+
| aws | 4.37.0 |
6972

7073
## Modules
7174

‎dss.tf‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,9 @@ module "ecr_dss" {
2222
# Outputs in dev
2323
output "dss_fargate_dev_build_workflow" {
2424
value = var.environment == "prod" || var.environment == "stage" ? null : templatefile("${path.module}/files/dev-build.tpl", {
25-
region = var.aws_region
26-
role = module.ecr_dss.gha_role
27-
ecr = module.ecr_dss.repository_name
25+
region = var.aws_region
26+
role = module.ecr_dss.gha_role
27+
ecr = module.ecr_dss.repository_name
2828
function = ""
2929
}
3030
)
@@ -43,9 +43,9 @@ output "dss_fargate_makefile" {
4343
# Outputs in stage
4444
output "dss_fargate_stage_build_workflow" {
4545
value = var.environment == "prod" || var.environment == "dev" ? null : templatefile("${path.module}/files/stage-build.tpl", {
46-
region = var.aws_region
47-
role = module.ecr_dss.gha_role
48-
ecr = module.ecr_dss.repository_name
46+
region = var.aws_region
47+
role = module.ecr_dss.gha_role
48+
ecr = module.ecr_dss.repository_name
4949
function = ""
5050
}
5151
)
@@ -60,7 +60,7 @@ output "dss_fargate_prod_promote_workflow" {
6060
role_prod = "${module.ecr_dss.repo_name}-gha-prod"
6161
ecr_stage = "${module.ecr_dss.repo_name}-stage"
6262
ecr_prod = "${module.ecr_dss.repo_name}-prod"
63-
function = ""
63+
function = ""
6464
}
6565
)
6666
description = "Full contents of the prod-promote.yml for the dss repo"

‎gis_ecrs.tf‎

Lines changed: 28 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -65,9 +65,9 @@ module "ecr_slingshot" {
6565
# Outputs in dev
6666
output "geoweb_fargate_dev_build_workflow" {
6767
value = var.environment == "prod" || var.environment == "stage" ? null : templatefile("${path.module}/files/dev-build.tpl", {
68-
region = var.aws_region
69-
role = module.ecr_geoweb.gha_role
70-
ecr = module.ecr_geoweb.repository_name
68+
region = var.aws_region
69+
role = module.ecr_geoweb.gha_role
70+
ecr = module.ecr_geoweb.repository_name
7171
function = ""
7272
}
7373
)
@@ -86,9 +86,9 @@ output "geoweb_fargate_makefile" {
8686
# Outputs in stage
8787
output "geoweb_fargate_stage_build_workflow" {
8888
value = var.environment == "prod" || var.environment == "dev" ? null : templatefile("${path.module}/files/stage-build.tpl", {
89-
region = var.aws_region
90-
role = module.ecr_geoweb.gha_role
91-
ecr = module.ecr_geoweb.repository_name
89+
region = var.aws_region
90+
role = module.ecr_geoweb.gha_role
91+
ecr = module.ecr_geoweb.repository_name
9292
function = ""
9393
}
9494
)
@@ -103,7 +103,7 @@ output "geoweb_fargate_prod_promote_workflow" {
103103
role_prod = "${module.ecr_geoweb.repo_name}-gha-prod"
104104
ecr_stage = "${module.ecr_geoweb.repo_name}-stage"
105105
ecr_prod = "${module.ecr_geoweb.repo_name}-prod"
106-
function = ""
106+
function = ""
107107
}
108108
)
109109
description = "Full contents of the prod-promote.yml for the geoweb-deposits repo"
@@ -113,9 +113,9 @@ output "geoweb_fargate_prod_promote_workflow" {
113113
# Outputs in dev
114114
output "geoserver_fargate_dev_build_workflow" {
115115
value = var.environment == "prod" || var.environment == "stage" ? null : templatefile("${path.module}/files/dev-build.tpl", {
116-
region = var.aws_region
117-
role = module.ecr_geoserver.gha_role
118-
ecr = module.ecr_geoserver.repository_name
116+
region = var.aws_region
117+
role = module.ecr_geoserver.gha_role
118+
ecr = module.ecr_geoserver.repository_name
119119
function = ""
120120
}
121121
)
@@ -134,9 +134,9 @@ output "geoserver_fargate_makefile" {
134134
# Outputs in stage
135135
output "geoserver_fargate_stage_build_workflow" {
136136
value = var.environment == "prod" || var.environment == "dev" ? null : templatefile("${path.module}/files/stage-build.tpl", {
137-
region = var.aws_region
138-
role = module.ecr_geoserver.gha_role
139-
ecr = module.ecr_geoserver.repository_name
137+
region = var.aws_region
138+
role = module.ecr_geoserver.gha_role
139+
ecr = module.ecr_geoserver.repository_name
140140
function = ""
141141
}
142142
)
@@ -151,7 +151,7 @@ output "geoserver_fargate_prod_promote_workflow" {
151151
role_prod = "${module.ecr_geoserver.repo_name}-gha-prod"
152152
ecr_stage = "${module.ecr_geoserver.repo_name}-stage"
153153
ecr_prod = "${module.ecr_geoserver.repo_name}-prod"
154-
function = ""
154+
function = ""
155155
}
156156
)
157157
description = "Full contents of the prod-promote.yml for the geoserver-deposits repo"
@@ -161,9 +161,9 @@ output "geoserver_fargate_prod_promote_workflow" {
161161
# Outputs in dev
162162
output "geosolr_fargate_dev_build_workflow" {
163163
value = var.environment == "prod" || var.environment == "stage" ? null : templatefile("${path.module}/files/dev-build.tpl", {
164-
region = var.aws_region
165-
role = module.ecr_geosolr.gha_role
166-
ecr = module.ecr_geosolr.repository_name
164+
region = var.aws_region
165+
role = module.ecr_geosolr.gha_role
166+
ecr = module.ecr_geosolr.repository_name
167167
function = ""
168168
}
169169
)
@@ -182,9 +182,9 @@ output "geosolr_fargate_makefile" {
182182
# Outputs in stage
183183
output "geosolr_fargate_stage_build_workflow" {
184184
value = var.environment == "prod" || var.environment == "dev" ? null : templatefile("${path.module}/files/stage-build.tpl", {
185-
region = var.aws_region
186-
role = module.ecr_geosolr.gha_role
187-
ecr = module.ecr_geosolr.repository_name
185+
region = var.aws_region
186+
role = module.ecr_geosolr.gha_role
187+
ecr = module.ecr_geosolr.repository_name
188188
function = ""
189189
}
190190
)
@@ -199,7 +199,7 @@ output "geosolr_fargate_prod_promote_workflow" {
199199
role_prod = "${module.ecr_geosolr.repo_name}-gha-prod"
200200
ecr_stage = "${module.ecr_geosolr.repo_name}-stage"
201201
ecr_prod = "${module.ecr_geosolr.repo_name}-prod"
202-
function = ""
202+
function = ""
203203
}
204204
)
205205
description = "Full contents of the prod-promote.yml for the geosolr-deposits repo"
@@ -209,9 +209,9 @@ output "geosolr_fargate_prod_promote_workflow" {
209209
# Outputs in dev
210210
output "slingshot_fargate_dev_build_workflow" {
211211
value = var.environment == "prod" || var.environment == "stage" ? null : templatefile("${path.module}/files/dev-build.tpl", {
212-
region = var.aws_region
213-
role = module.ecr_slingshot.gha_role
214-
ecr = module.ecr_slingshot.repository_name
212+
region = var.aws_region
213+
role = module.ecr_slingshot.gha_role
214+
ecr = module.ecr_slingshot.repository_name
215215
function = ""
216216
}
217217
)
@@ -230,9 +230,9 @@ output "slingshot_fargate_makefile" {
230230
# Outputs in stage
231231
output "slingshot_fargate_stage_build_workflow" {
232232
value = var.environment == "prod" || var.environment == "dev" ? null : templatefile("${path.module}/files/stage-build.tpl", {
233-
region = var.aws_region
234-
role = module.ecr_slingshot.gha_role
235-
ecr = module.ecr_slingshot.repository_name
233+
region = var.aws_region
234+
role = module.ecr_slingshot.gha_role
235+
ecr = module.ecr_slingshot.repository_name
236236
function = ""
237237
}
238238
)
@@ -247,7 +247,7 @@ output "slingshot_fargate_prod_promote_workflow" {
247247
role_prod = "${module.ecr_slingshot.repo_name}-gha-prod"
248248
ecr_stage = "${module.ecr_slingshot.repo_name}-stage"
249249
ecr_prod = "${module.ecr_slingshot.repo_name}-prod"
250-
function = ""
250+
function = ""
251251
}
252252
)
253253
description = "Full contents of the prod-promote.yml for the slingshot-deposits repo"

‎matomo_ecr.tf‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,9 @@ module "ecr_matomo" {
2222
# Outputs in dev
2323
output "matomo_fargate_dev_build_workflow" {
2424
value = var.environment == "prod" || var.environment == "stage" ? null : templatefile("${path.module}/files/dev-build.tpl", {
25-
region = var.aws_region
26-
role = module.ecr_matomo.gha_role
27-
ecr = module.ecr_matomo.repository_name
25+
region = var.aws_region
26+
role = module.ecr_matomo.gha_role
27+
ecr = module.ecr_matomo.repository_name
2828
function = ""
2929
}
3030
)
@@ -43,9 +43,9 @@ output "matomo_fargate_makefile" {
4343
# Outputs in stage
4444
output "matomo_fargate_stage_build_workflow" {
4545
value = var.environment == "prod" || var.environment == "dev" ? null : templatefile("${path.module}/files/stage-build.tpl", {
46-
region = var.aws_region
47-
role = module.ecr_matomo.gha_role
48-
ecr = module.ecr_matomo.repository_name
46+
region = var.aws_region
47+
role = module.ecr_matomo.gha_role
48+
ecr = module.ecr_matomo.repository_name
4949
function = ""
5050
}
5151
)
@@ -60,7 +60,7 @@ output "matomo_fargate_prod_promote_workflow" {
6060
role_prod = "${module.ecr_matomo.repo_name}-gha-prod"
6161
ecr_stage = "${module.ecr_matomo.repo_name}-stage"
6262
ecr_prod = "${module.ecr_matomo.repo_name}-prod"
63-
function = ""
63+
function = ""
6464
}
6565
)
6666
description = "Full contents of the prod-promote.yml for the matomo repo"

‎ssm_inputs.tf‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
11
################################################################################
22
# This is used to simplify the SSM Parameter inputs
33
locals {
4-
vpc_vars = "/tfvars/vpc"
5-
r53_vars = "/tfvars/r53"
64
init_vars = "/tfvars/init"
75
}
86

0 commit comments

Comments
 (0)