tf_plan.yml

name: Terraform plan
on:
  workflow_dispatch:
  pull_request:
    paths:
      - "aws/**"
      - "terragrunt/**"
      - ".github/workflows/**"  
env:
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
  AWS_REGION: ca-central-1
  GITHUB_SHA: ${{ github.sha }}
  LOGGING_ACCOUNT: ${{ secrets.LOGGING_ACCOUNT }}
  SECURITY_ACCOUNT: ${{ secrets.SECURITY_ACCOUNT }}
  TERRAFORM_VERSION: 0.14.2
  TERRAGRUNT_VERSION: v0.29.2
  TF_VAR_kibana_admin_role: ${{ secrets.KIBANA_ADMIN_ROLE }}
  TF_VAR_landing_zone_prefix: ${{ secrets.LANDING_ZONE_PREFIX}}
  TF_VAR_maxmind_key: ${{ secrets.MAXMIND_KEY}}

jobs:
  terraform-plan:
    strategy:
      fail-fast: false
      matrix:
        include:
          - module: cloud-trail
          - module: guard-duty
          - module: security-hub
          - module: siem/elasticsearch
          - module: siem/elasticsearch_loader
          - module: siem/ip-geolocation
          - module: siem/s3-replication

    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v2

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v1.2.1
        with:
          terraform_version: ${{ env.TERRAFORM_VERSION }}
          terraform_wrapper: false

      - name: Setup Terragrunt
        run: |
          mkdir bin
          wget -O bin/terragrunt https://github.com/gruntwork-io/terragrunt/releases/download/$TERRAGRUNT_VERSION/terragrunt_linux_amd64
          chmod +x bin/*
          echo "$GITHUB_WORKSPACE/bin" >> $GITHUB_PATH

      - name: Terraform plan
        uses: cds-snc/terraform-plan@v1
        with:
          comment-delete: true
          comment-title: Plan for ${{ matrix.module }}
          directory: ./terragrunt/${{ matrix.module }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          terragrunt: true