Write GitHub Actions for running Terraform stages

[chelseybeck]

Dependencies

• Set up MVP Terraform configuration to add new users w/ read only access to AWS ops#115
• Create service account for Terraforming IAM resources ops#106

Overview

In order to manage IAM resources as code using Terraform, we will need the ability to run a plan on PR creation and an apply when the PR is merged into main.

@dflook created some pretty great GitHub Actions that work well with this workflow. We could follow this established pattern

Action Items

• Create a GitHub Action (GHA) terraform-plan.yaml for the Terraform plan workflow

  • action is triggered on PR creation | example using dflook's GitHub action
    • only when files end in .tf
      • we will have readme and other files in these directories, and we don't want changes there to trigger this workflow
  • results of the plan are written back to the PR as a comment

• Create a GHA terraform-apply.yaml for the Terraform apply workflow

  • action is triggered on PR merge to main
    • only when files end in .tf

Resources/Instructions

DevOps Security code repository | PM a CoP lead in Slack if you don't already have access.

dflook GitHub Actions

@Tyson-miller wrote a GitHub Action for running Terraform plan on incubator projects...though our needs are simpler

[chelseybeck]

Update: this is almost complete. Next time we meet, we can limit both actions to only kick off when terraform files are changed or when files are changed inside of the terraform directory. We prob don't need both.

[chelseybeck]

Closed w/ these prs

• adding tf etension to apply #32
• adding tf extension as requirement for plan #31