Skip to content

Commit 124f880

Browse files
xnotoxnoto
authored
feat: migrate from terraform-aws-infra (#1)
- Import all terraform configurations for AWS infrastructure - Use shared OpenTofu workflow from shared-workflows repo - Update Makefile to use tofu with -no-color and plan output - Update pre-commit-terraform to v1.104.0
1 parent 33978f5 commit 124f880

14 files changed

Lines changed: 398 additions & 0 deletions

‎.checkov.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
block-list-secret-scan: []
2+
compact: true
3+
directory:
4+
- .
5+
download-external-modules: false
6+
evaluate-variables: true
7+
framework:
8+
- all
9+
output:
10+
- cli
11+
quiet: true
12+
soft-fail: true
13+
summary-position: top

‎.github/workflows/opentofu.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: OpenTofu
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
push:
8+
branches:
9+
- main
10+
11+
permissions:
12+
contents: read
13+
pull-requests: write
14+
15+
jobs:
16+
opentofu:
17+
uses: makeitworkcloud/shared-workflows/.github/workflows/opentofu.yml@main
18+
secrets:
19+
SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}

‎.gitignore‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# vim swap files
2+
**/*.sw[po]
3+
4+
# don't commit terraform state or lock. the repo code is the only state we care about.
5+
# the provider state cache is auto-upgraded by default to ensure compatibility with upstream cloud provider APIs
6+
**/.terraform.lock.hcl
7+
**/.terraform
8+
9+
# IDE Folders
10+
**/.vscode
11+
12+
# Mac Finder cache
13+
**/.DS_Store
14+
15+
# Plan output
16+
plan-output.txt

‎.pre-commit-config.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
repos:
2+
- repo: https://github.com/pre-commit/pre-commit-hooks
3+
rev: v6.0.0
4+
hooks:
5+
- id: check-case-conflict
6+
- id: check-merge-conflict
7+
- id: check-symlinks
8+
- id: check-vcs-permalinks
9+
- id: destroyed-symlinks
10+
- id: detect-private-key
11+
- id: mixed-line-ending
12+
- id: trailing-whitespace
13+
- repo: https://github.com/antonbabenko/pre-commit-terraform
14+
rev: v1.104.0
15+
hooks:
16+
- id: terraform_validate
17+
args:
18+
- --hook-config=--retry-once-with-cleanup=true
19+
- --args=-no-color
20+
- --tf-init-args=-reconfigure
21+
- --tf-init-args=-upgrade
22+
- id: terraform_tflint
23+
args:
24+
- --args=--minimum-failure-severity=error
25+
- --args=--config=__GIT_WORKING_DIR__/.tflint.hcl
26+
- id: terraform_checkov
27+
args:
28+
- --args=--config-file __GIT_WORKING_DIR__/.checkov.yml
29+
- id: terraform_fmt
30+
args:
31+
- --args=-no-color
32+
- --args=-diff
33+
- --args=-recursive
34+
- id: terraform_docs
35+
args:
36+
- --args=--config=.terraform-docs.yml

‎.sops.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
---
2+
creation_rules:
3+
- age: age152ek83tm4fj5u70r3fecytn4kg7c5xca24erjchxexx4pfqg6das7q763l

‎.terraform-docs.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
formatter: "markdown"
2+
3+
output:
4+
file: "README.md"
5+
mode: replace
6+
7+
settings:
8+
color: false
9+
lockfile: false
10+
11+
sort:
12+
enabled: true
13+
by: name
14+
15+
# recursive can't be enabled until this bug is fixed:
16+
# https://github.com/terraform-docs/terraform-docs/issues/654
17+
recursive:
18+
enabled: false

‎.tflint.hcl‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
plugin "terraform" {
2+
enabled = true
3+
preset = "recommended"
4+
}
5+
6+
rule "terraform_required_providers" {
7+
enabled = false
8+
}
9+
10+
rule "terraform_required_version" {
11+
enabled = false
12+
}

‎Makefile‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
SHELL := /bin/bash
2+
TERRAFORM := $(shell which tofu)
3+
S3_REGION := $(shell sops decrypt secrets/secrets.yaml | grep ^s3_region | cut -d ' ' -f 2)
4+
S3_BUCKET := $(shell sops decrypt secrets/secrets.yaml | grep ^s3_bucket | cut -d ' ' -f 2)
5+
S3_KEY := $(shell sops decrypt secrets/secrets.yaml | grep ^s3_key | cut -d ' ' -f 2)
6+
S3_ACCESS_KEY := $(shell sops decrypt secrets/secrets.yaml | grep ^s3_access_key | cut -d ' ' -f 2)
7+
S3_SECRET_KEY := $(shell sops decrypt secrets/secrets.yaml | grep ^s3_secret_key | cut -d ' ' -f 2)
8+
9+
.PHONY: help init plan apply migrate test pre-commit-check-deps pre-commit-install-hooks argcd-login
10+
11+
help:
12+
@echo "General targets"
13+
@echo "----------------"
14+
@echo
15+
@echo "\thelp: show this help text"
16+
@echo "\tclean: removes all .terraform directories"
17+
@echo
18+
@echo "Terraform targets"
19+
@echo "-----------------"
20+
@echo
21+
@echo "\tinit: run 'terraform init'"
22+
@echo "\ttest: run pre-commmit checks"
23+
@echo "\tplan: run 'terraform plan'"
24+
@echo "\tapply: run 'terraform apply'"
25+
@echo "\tmigrate; run terraform init -migrate-state"
26+
@echo
27+
@echo "One-time repo init targets"
28+
@echo "--------------------------"
29+
@echo
30+
@echo "\tpre-commit-install-hooks: install pre-commit hooks"
31+
@echo "\tpre-commit-check-deps: check pre-commit dependencies"
32+
@echo
33+
34+
clean:
35+
@find . -name .terraform -type d | xargs -I {} rm -rf {}
36+
37+
init: clean .terraform/terraform.tfstate
38+
39+
.terraform/terraform.tfstate:
40+
@${TERRAFORM} init -reconfigure -upgrade -input=false -backend-config="key=${S3_KEY}" -backend-config="bucket=${S3_BUCKET}" -backend-config="region=${S3_REGION}" -backend-config="access_key=${S3_ACCESS_KEY}" -backend-config="secret_key=${S3_SECRET_KEY}"
41+
42+
plan: init .terraform/plan
43+
44+
.terraform/plan:
45+
@${TERRAFORM} plan -compact-warnings -no-color -out tfplan.bin
46+
@${TERRAFORM} show -no-color tfplan.bin | tee plan-output.txt
47+
@rm -f tfplan.bin
48+
49+
apply: init .terraform/apply
50+
51+
.terraform/apply:
52+
@${TERRAFORM} apply -auto-approve -compact-warnings
53+
54+
migrate:
55+
@echo "First use -make init- using the old S3 backend, then run -make migrate- to use the new one."
56+
@${TERRAFORM} init -migrate-state -backend-config="key=${S3_KEY}" -backend-config="bucket=${S3_BUCKET}" -backend-config="region=${S3_REGION}" -backend-config="access_key=${S3_ACCESS_KEY}" -backend-config="secret_key=${S3_SECRET_KEY}"
57+
58+
test: .git/hooks/pre-commit
59+
@pre-commit run -a
60+
61+
DEPS_PRE_COMMIT=$(shell which pre-commit || echo "pre-commit not found")
62+
DEPS_TERRAFORM_DOCS=$(shell which terraform-docs || echo "terraform-docs not found")
63+
DEPS_TFLINT=$(shell which tflint || echo "tflint not found,")
64+
DEPS_CHECKOV=$(shell which checkov || echo "checkov not found,")
65+
DEPS_JQ=$(shell which jq || echo "jq not found,")
66+
pre-commit-check-deps:
67+
@echo "Checking for pre-commit and its dependencies:"
68+
@echo " pre-commit: ${DEPS_PRE_COMMIT}"
69+
@echo " terraform-docs: ${DEPS_TERRAFORM_DOCS}"
70+
@echo " tflint: ${DEPS_TFLINT}"
71+
@echo " checkov: ${DEPS_CHECKOV}"
72+
@echo " jq: ${DEPS_JQ}"
73+
@echo ""
74+
75+
pre-commit-install-hooks: .git/hooks/pre-commit
76+
77+
.git/hooks/pre-commit: pre-commit-check-deps
78+
@pre-commit install --install-hooks
79+

‎aws-iam.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
resource "aws_iam_user" "admin" {
2+
for_each = local.admin_users
3+
name = each.value
4+
force_destroy = false
5+
tags = {
6+
ManagedBy = "Terraform"
7+
}
8+
}
9+
10+
resource "aws_iam_user_policy_attachment" "admin_attach" {
11+
for_each = local.admin_users
12+
user = aws_iam_user.admin[each.key].name
13+
policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
14+
}
15+
16+
resource "aws_iam_access_key" "admin_key" {
17+
for_each = local.admin_users
18+
user = aws_iam_user.admin[each.key].name
19+
}

‎aws-s3.tf‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
resource "aws_s3_bucket" "private" {
2+
for_each = local.s3_private_buckets
3+
bucket = each.value
4+
5+
tags = {
6+
ManagedBy = "Terraform"
7+
}
8+
9+
lifecycle {
10+
prevent_destroy = true
11+
}
12+
}
13+
14+
resource "aws_s3_bucket" "public" {
15+
for_each = local.s3_public_buckets
16+
bucket = each.value
17+
18+
tags = {
19+
ManagedBy = "Terraform"
20+
}
21+
22+
lifecycle {
23+
prevent_destroy = true
24+
}
25+
}
26+
27+
resource "aws_s3_bucket_public_access_block" "public" {
28+
for_each = aws_s3_bucket.public
29+
bucket = each.value.id
30+
block_public_acls = false
31+
block_public_policy = false
32+
ignore_public_acls = false
33+
restrict_public_buckets = false
34+
}
35+
36+
resource "aws_s3_bucket_policy" "public" {
37+
for_each = aws_s3_bucket.public
38+
39+
bucket = each.value.id
40+
41+
policy = jsonencode({
42+
Version = "2012-10-17"
43+
Statement = [
44+
{
45+
Effect = "Allow"
46+
Principal = "*"
47+
Action = [
48+
"s3:GetObject"
49+
]
50+
Resource = "${each.value.arn}/*"
51+
}
52+
]
53+
})
54+
}
55+
56+
resource "aws_s3_bucket" "web" {
57+
for_each = local.s3_web_buckets
58+
bucket = each.value
59+
60+
tags = {
61+
ManagedBy = "Terraform"
62+
}
63+
64+
lifecycle {
65+
prevent_destroy = true
66+
}
67+
}
68+
69+
# Make "web" buckets publicly accessible
70+
resource "aws_s3_bucket_public_access_block" "web" {
71+
for_each = aws_s3_bucket.web
72+
bucket = each.value.id
73+
block_public_acls = false
74+
block_public_policy = false
75+
ignore_public_acls = false
76+
restrict_public_buckets = false
77+
}
78+
79+
resource "aws_s3_bucket_policy" "web" {
80+
for_each = aws_s3_bucket.web
81+
82+
bucket = each.value.id
83+
84+
policy = jsonencode({
85+
Version = "2012-10-17"
86+
Statement = [
87+
{
88+
Effect = "Allow"
89+
Principal = "*"
90+
Action = [
91+
"s3:GetObject"
92+
]
93+
Resource = "${each.value.arn}/*"
94+
}
95+
]
96+
})
97+
}
98+
99+
resource "aws_s3_bucket_website_configuration" "web" {
100+
for_each = aws_s3_bucket.web
101+
102+
bucket = each.value.id
103+
104+
index_document {
105+
suffix = "index.html"
106+
}
107+
}

0 commit comments

Comments
 (0)