Skip to content

Commit a4d1746

Browse files
cabutlermitcabutlermit
committed
ECRs for Alma Integrations
Why these changes are being introduced: Three Alma integrations (patron load, credit card slips, and SAP invoices) are going to be containerized workflows in the new AWS Organization. This sets up the ECRs for those containers. How this addresses that need: * Create the ECR, OIDC role, and various permissions for the three Alma-related app repos (alma-patronload, alma-creditcardslips, alma-sapinvoices) * Update README Side effects of this change: None. * https://mitlibraries.atlassian.net/browse/IN-647 * https://mitlibraries.atlassian.net/browse/IN-651 * https://mitlibraries.atlassian.net/browse/IN-656 terraform-docs: automated action
1 parent aaedc67 commit a4d1746

File tree

2 files changed

+202
-0
lines changed

2 files changed

+202
-0
lines changed

‎README.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,14 +76,17 @@ then replace all the ssm parameter references for `oidc_arn` with `aws_iam_openi
7676
|------|--------|---------|
7777
| ecr\_alma\_webhook\_lambdas | ./modules/ecr | n/a |
7878
| ecr\_carbon | ./modules/ecr | n/a |
79+
| ecr\_creditcardslips | ./modules/ecr | n/a |
7980
| ecr\_dss | ./modules/ecr | n/a |
8081
| ecr\_geoserver | ./modules/ecr | n/a |
8182
| ecr\_geosolr | ./modules/ecr | n/a |
8283
| ecr\_geoweb | ./modules/ecr | n/a |
8384
| ecr\_mario | ./modules/ecr | n/a |
8485
| ecr\_matomo | ./modules/ecr | n/a |
8586
| ecr\_oaiharvester | ./modules/ecr | n/a |
87+
| ecr\_patronload | ./modules/ecr | n/a |
8688
| ecr\_ppod | ./modules/ecr | n/a |
89+
| ecr\_sapinvoices | ./modules/ecr | n/a |
8790
| ecr\_slingshot | ./modules/ecr | n/a |
8891
| ecr\_timdex\_lambdas | ./modules/ecr | n/a |
8992
| ecr\_timdex\_tim | ./modules/ecr | n/a |
@@ -124,6 +127,10 @@ then replace all the ssm parameter references for `oidc_arn` with `aws_iam_openi
124127
| carbon\_makefile | Full contents of the Makefile for the carbon repo (allows devs to push to Dev account only) |
125128
| carbon\_prod\_promote\_workflow | Full contents of the prod-promote.yml for the carbon repo |
126129
| carbon\_stage\_build\_workflow | Full contents of the stage-build.yml for the carbon repo |
130+
| creditcardslips\_dev\_build\_workflow | Full contents of the dev-build.yml for the alma-creditcardslips repo |
131+
| creditcardslips\_makefile | Full contents of the Makefile for the alma-creditcardslips repo (allows devs to push to Dev account only) |
132+
| creditcardslips\_prod\_promote\_workflow | Full contents of the prod-promote.yml for the alma-creditcardslips repo |
133+
| creditcardslips\_stage\_build\_workflow | Full contents of the stage-build.yml for the alma-creditcardslips repo |
127134
| dss\_fargate\_dev\_build\_workflow | Full contents of the dev-build.yml for the dss repo |
128135
| dss\_fargate\_makefile | Full contents of the Makefile for the dss repo (allows devs to push to Dev account only) |
129136
| dss\_fargate\_prod\_promote\_workflow | Full contents of the prod-promote.yml for the dss repo |
@@ -152,10 +159,18 @@ then replace all the ssm parameter references for `oidc_arn` with `aws_iam_openi
152159
| oaiharvester\_makefile | Full contents of the Makefile for the oaiharvester repo (allows devs to push to Dev account only) |
153160
| oaiharvester\_prod\_promote\_workflow | Full contents of the prod-promote.yml for the oaiharvester repo |
154161
| oaiharvester\_stage\_build\_workflow | Full contents of the stage-build.yml for the oaiharvester repo |
162+
| patronload\_dev\_build\_workflow | Full contents of the dev-build.yml for the alma-patronload repo |
163+
| patronload\_makefile | Full contents of the Makefile for the alma-patronload repo (allows devs to push to Dev account only) |
164+
| patronload\_prod\_promote\_workflow | Full contents of the prod-promote.yml for the alma-patronload repo |
165+
| patronload\_stage\_build\_workflow | Full contents of the stage-build.yml for the alma-patronload repo |
155166
| ppod\_dev\_build\_workflow | Full contents of the dev-build.yml for the ppod repo |
156167
| ppod\_makefile | Full contents of the Makefile for the ppod repo (allows devs to push to Dev account only) |
157168
| ppod\_prod\_promote\_workflow | Full contents of the prod-promote.yml for the ppod repo |
158169
| ppod\_stage\_build\_workflow | Full contents of the stage-build.yml for the ppod repo |
170+
| sapinvoices\_dev\_build\_workflow | Full contents of the dev-build.yml for the alma-sapinvoices repo |
171+
| sapinvoices\_makefile | Full contents of the Makefile for the alma-sapinvoices repo (allows devs to push to Dev account only) |
172+
| sapinvoices\_prod\_promote\_workflow | Full contents of the prod-promote.yml for the alma-sapinvoices repo |
173+
| sapinvoices\_stage\_build\_workflow | Full contents of the stage-build.yml for the alma-sapinvoices repo |
159174
| slingshot\_fargate\_dev\_build\_workflow | Full contents of the dev-build.yml for the slingshot-deposits repo |
160175
| slingshot\_fargate\_makefile | Full contents of the Makefile for the slingshot-deposits repo (allows devs to push to Dev account only) |
161176
| slingshot\_fargate\_prod\_promote\_workflow | Full contents of the prod-promote.yml for the slingshot-deposits repo |

‎almaintegrations-ecrs.tf‎

Lines changed: 187 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,187 @@
1+
###
2+
### ECRs for the various Alma integrations
3+
###
4+
5+
################################################################################
6+
## patronload
7+
module "ecr_patronload" {
8+
source = "./modules/ecr"
9+
repo_name = "alma-patronload"
10+
login_policy_arn = aws_iam_policy.login.arn
11+
oidc_arn = data.aws_ssm_parameter.oidc_arn.value
12+
environment = var.environment
13+
tfoutput_ssm_path = var.tfoutput_ssm_path
14+
tags = {
15+
app-repo = "alma-patronload"
16+
}
17+
}
18+
19+
# Outputs in dev
20+
output "patronload_dev_build_workflow" {
21+
value = var.environment == "prod" || var.environment == "stage" ? null : templatefile("${path.module}/files/dev-build.tpl", {
22+
region = var.aws_region
23+
role = module.ecr_patronload.gha_role
24+
ecr = module.ecr_patronload.repository_name
25+
function = ""
26+
}
27+
)
28+
description = "Full contents of the dev-build.yml for the alma-patronload repo"
29+
}
30+
output "patronload_makefile" {
31+
value = var.environment == "prod" || var.environment == "stage" ? null : templatefile("${path.module}/files/makefile.tpl", {
32+
ecr_name = module.ecr_patronload.repository_name
33+
ecr_url = module.ecr_patronload.repository_url
34+
function = ""
35+
}
36+
)
37+
description = "Full contents of the Makefile for the alma-patronload repo (allows devs to push to Dev account only)"
38+
}
39+
40+
# Outputs in stage
41+
output "patronload_stage_build_workflow" {
42+
value = var.environment == "prod" || var.environment == "dev" ? null : templatefile("${path.module}/files/stage-build.tpl", {
43+
region = var.aws_region
44+
role = module.ecr_patronload.gha_role
45+
ecr = module.ecr_patronload.repository_name
46+
function = ""
47+
}
48+
)
49+
description = "Full contents of the stage-build.yml for the alma-patronload repo"
50+
}
51+
52+
# Outputs after promotion to prod
53+
output "patronload_prod_promote_workflow" {
54+
value = var.environment == "stage" || var.environment == "dev" ? null : templatefile("${path.module}/files/prod-promote.tpl", {
55+
region = var.aws_region
56+
role_stage = "${module.ecr_patronload.repo_name}-gha-stage"
57+
role_prod = "${module.ecr_patronload.repo_name}-gha-prod"
58+
ecr_stage = "${module.ecr_patronload.repo_name}-stage"
59+
ecr_prod = "${module.ecr_patronload.repo_name}-prod"
60+
function = ""
61+
}
62+
)
63+
description = "Full contents of the prod-promote.yml for the alma-patronload repo"
64+
}
65+
66+
################################################################################
67+
## creditcardslips
68+
module "ecr_creditcardslips" {
69+
source = "./modules/ecr"
70+
repo_name = "alma-creditcardslips"
71+
login_policy_arn = aws_iam_policy.login.arn
72+
oidc_arn = data.aws_ssm_parameter.oidc_arn.value
73+
environment = var.environment
74+
tfoutput_ssm_path = var.tfoutput_ssm_path
75+
tags = {
76+
app-repo = "alma-creditcardslips"
77+
}
78+
}
79+
80+
# Outputs in dev
81+
output "creditcardslips_dev_build_workflow" {
82+
value = var.environment == "prod" || var.environment == "stage" ? null : templatefile("${path.module}/files/dev-build.tpl", {
83+
region = var.aws_region
84+
role = module.ecr_creditcardslips.gha_role
85+
ecr = module.ecr_creditcardslips.repository_name
86+
function = ""
87+
}
88+
)
89+
description = "Full contents of the dev-build.yml for the alma-creditcardslips repo"
90+
}
91+
output "creditcardslips_makefile" {
92+
value = var.environment == "prod" || var.environment == "stage" ? null : templatefile("${path.module}/files/makefile.tpl", {
93+
ecr_name = module.ecr_creditcardslips.repository_name
94+
ecr_url = module.ecr_creditcardslips.repository_url
95+
function = ""
96+
}
97+
)
98+
description = "Full contents of the Makefile for the alma-creditcardslips repo (allows devs to push to Dev account only)"
99+
}
100+
101+
# Outputs in stage
102+
output "creditcardslips_stage_build_workflow" {
103+
value = var.environment == "prod" || var.environment == "dev" ? null : templatefile("${path.module}/files/stage-build.tpl", {
104+
region = var.aws_region
105+
role = module.ecr_creditcardslips.gha_role
106+
ecr = module.ecr_creditcardslips.repository_name
107+
function = ""
108+
}
109+
)
110+
description = "Full contents of the stage-build.yml for the alma-creditcardslips repo"
111+
}
112+
113+
# Outputs after promotion to prod
114+
output "creditcardslips_prod_promote_workflow" {
115+
value = var.environment == "stage" || var.environment == "dev" ? null : templatefile("${path.module}/files/prod-promote.tpl", {
116+
region = var.aws_region
117+
role_stage = "${module.ecr_creditcardslips.repo_name}-gha-stage"
118+
role_prod = "${module.ecr_creditcardslips.repo_name}-gha-prod"
119+
ecr_stage = "${module.ecr_creditcardslips.repo_name}-stage"
120+
ecr_prod = "${module.ecr_creditcardslips.repo_name}-prod"
121+
function = ""
122+
}
123+
)
124+
description = "Full contents of the prod-promote.yml for the alma-creditcardslips repo"
125+
}
126+
127+
128+
################################################################################
129+
## sapinvoices
130+
module "ecr_sapinvoices" {
131+
source = "./modules/ecr"
132+
repo_name = "alma-sapinvoices"
133+
login_policy_arn = aws_iam_policy.login.arn
134+
oidc_arn = data.aws_ssm_parameter.oidc_arn.value
135+
environment = var.environment
136+
tfoutput_ssm_path = var.tfoutput_ssm_path
137+
tags = {
138+
app-repo = "alma-sapinvoices"
139+
}
140+
}
141+
142+
# Outputs in dev
143+
output "sapinvoices_dev_build_workflow" {
144+
value = var.environment == "prod" || var.environment == "stage" ? null : templatefile("${path.module}/files/dev-build.tpl", {
145+
region = var.aws_region
146+
role = module.ecr_sapinvoices.gha_role
147+
ecr = module.ecr_sapinvoices.repository_name
148+
function = ""
149+
}
150+
)
151+
description = "Full contents of the dev-build.yml for the alma-sapinvoices repo"
152+
}
153+
output "sapinvoices_makefile" {
154+
value = var.environment == "prod" || var.environment == "stage" ? null : templatefile("${path.module}/files/makefile.tpl", {
155+
ecr_name = module.ecr_sapinvoices.repository_name
156+
ecr_url = module.ecr_sapinvoices.repository_url
157+
function = ""
158+
}
159+
)
160+
description = "Full contents of the Makefile for the alma-sapinvoices repo (allows devs to push to Dev account only)"
161+
}
162+
163+
# Outputs in stage
164+
output "sapinvoices_stage_build_workflow" {
165+
value = var.environment == "prod" || var.environment == "dev" ? null : templatefile("${path.module}/files/stage-build.tpl", {
166+
region = var.aws_region
167+
role = module.ecr_sapinvoices.gha_role
168+
ecr = module.ecr_sapinvoices.repository_name
169+
function = ""
170+
}
171+
)
172+
description = "Full contents of the stage-build.yml for the alma-sapinvoices repo"
173+
}
174+
175+
# Outputs after promotion to prod
176+
output "sapinvoices_prod_promote_workflow" {
177+
value = var.environment == "stage" || var.environment == "dev" ? null : templatefile("${path.module}/files/prod-promote.tpl", {
178+
region = var.aws_region
179+
role_stage = "${module.ecr_sapinvoices.repo_name}-gha-stage"
180+
role_prod = "${module.ecr_sapinvoices.repo_name}-gha-prod"
181+
ecr_stage = "${module.ecr_sapinvoices.repo_name}-stage"
182+
ecr_prod = "${module.ecr_sapinvoices.repo_name}-prod"
183+
function = ""
184+
}
185+
)
186+
description = "Full contents of the prod-promote.yml for the alma-sapinvoices repo"
187+
}

0 commit comments

Comments
 (0)