diff --git a/.github/workflows/terraform-apply.yml b/.github/workflows/terraform-apply.yml index 38a4a4d..f154223 100644 --- a/.github/workflows/terraform-apply.yml +++ b/.github/workflows/terraform-apply.yml @@ -1,95 +1,36 @@ -name: Terraform Apply on Merge +name: Terraform apply (OIDC) -on: +on: push: branches: - - main - paths: - - 'terraform-incubator/**/*.tf' - -permissions: - contents: read - pull-requests: write + - main # or any other branch you want to trigger the deployment + paths: + - '**/*.tf' jobs: - changed-files: - name: Get changed terraform directories - runs-on: ubuntu-latest - outputs: - project-directory: ${{ steps.project-directory.outputs.directory }} - environment-directory: ${{ steps.environment-directory.outputs.directory }} - has-environment-changes: ${{ steps.check-changes.outputs.has-environment-changes }} - has-project-changes: ${{ steps.check-changes.outputs.has-project-changes }} - steps: - - name: Checkout - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - name: Get changed files - id: changed-files - uses: dorny/paths-filter@v2 - with: - filters: | - project-change: - - 'terraform-incubator/*/project/*.tf' - environment-change: - - 'terraform-incubator/*/!(project)/*.tf' - list-files: json - - - name: List all changed files - run: | - echo 'project-change: ${{ steps.changed-files.outputs.project-change_files }}' - echo 'environment-change: ${{ steps.changed-files.outputs.environment-change_files }}' - - - name: Extract project directory - id: project-directory - if: ${{ steps.changed-files.outputs['project-change'] == 'true' }} - run: | - directory=$(dirname "${{ fromJson(steps.changed-files.outputs.project-change_files)[0] }}") - echo "Extracted Directory: $directory" - echo "::set-output name=directory::$directory" - - - name: Extract environment directory - id: environment-directory - if: ${{ steps.changed-files.outputs['environment-change'] == 'true' }} - run: | - directory=$(dirname "${{ fromJson(steps.changed-files.outputs.environment-change_files)[0] }}") - echo "Extracted Directory: $directory" - echo "::set-output name=directory::$directory" - - - name: Check for conflicting changes - id: check-changes - run: | - echo "::set-output name=has-environment-changes::${{ steps.changed-files.outputs.environment-change_files != '[]' }}" - echo "::set-output name=has-project-changes::${{ steps.changed-files.outputs.project-change_files != '[]' }}" - - apply: - runs-on: ubuntu-latest + terraform-apply: name: Terraform Apply - needs: [changed-files] + runs-on: ubuntu-latest env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - AWS_ACCESS_KEY_ID: ${{ secrets.INCUBATOR_AWS_ACCESS_KEY_ID }} - AWS_SECRET_ACCESS_KEY: ${{ secrets.INCUBATOR_AWS_SECRET_ACCESS_KEY }} - steps: - - name: Checkout - uses: actions/checkout@v3 - - name: Fail on multiple directory changes - if: ${{ needs.changed-files.outputs.has-environment-changes == 'true' && needs.changed-files.outputs.has-project-changes == 'true' }} - run: | - echo "Multiple changed directories detected: Please make changes to environments and projects in separate pull requests." - exit 1 - - - name: Terraform apply - Environment - if: ${{ needs.changed-files.outputs.environment-directory != '' && (needs.changed-files.outputs.project-directory == '' || needs.changed-files.outputs.has-environment-changes == 'true') }} - uses: dflook/terraform-apply@v1 - with: - path: ${{ needs.changed-files.outputs.environment-directory }} - - - name: Terraform apply - Project - if: ${{ needs.changed-files.outputs.project-directory != '' && needs.changed-files.outputs.has-environment-changes != 'true' }} - uses: dflook/terraform-apply@v1 - with: - path: ${{ needs.changed-files.outputs.project-directory }} + permissions: + contents: read + pull-requests: write + + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: configure aws credentials + uses: aws-actions/configure-aws-credentials@v3 + with: + role-to-assume: arn:aws:iam::035866691871:role/gha-incubator + role-session-name: ghaincubatorsession + aws-region: us-west-2 + + - name: Terraform Apply + uses: dflook/terraform-apply@v1 + with: + path: terraform + backend_config_file: terraform/prod.backend.tfvars \ No newline at end of file diff --git a/.github/workflows/terraform-plan-with-oidc.yaml b/.github/workflows/terraform-plan-with-oidc.yaml deleted file mode 100644 index cce5f78..0000000 --- a/.github/workflows/terraform-plan-with-oidc.yaml +++ /dev/null @@ -1,44 +0,0 @@ -name: Terraform deploy with OIDC -on: - workflow_dispatch: - inputs: - target-host-environment: - type: choice - description: The AWS environment to deploy (dev/test/prod) - options: - - dev - - test - - prod - -permissions: - id-token: write - contents: read - -jobs: - - TerraformPlan: - - runs-on: ubuntu-latest - - steps: - - name: Clone repo - uses: actions/checkout@v4 - - - name: configure aws credentials - uses: aws-actions/configure-aws-credentials@v3 - with: - role-to-assume: arn:aws:iam::035866691871:role/gha-incubator - role-session-name: ghaincubatorsession - aws-region: us-west-2 - - - name: - uses: hashicorp/setup-terraform@v3 - - - name: Run terraform - run: | - pushd ./terraform-incubator/home-unite-us - terraform init - terraform plan - popd - - \ No newline at end of file diff --git a/.github/workflows/terraform-plan.yaml b/.github/workflows/terraform-plan.yaml new file mode 100644 index 0000000..9ec1624 --- /dev/null +++ b/.github/workflows/terraform-plan.yaml @@ -0,0 +1,40 @@ +name: Terraform plan (OIDC) +on: + pull_request: + branches: + - main # or any other branch you want to trigger the deployment + paths: + - '**/*.tf' + +permissions: + id-token: write + contents: read + +jobs: + terraform-plan: + name: Terraform Plan + runs-on: ubuntu-latest + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + permissions: + contents: read + pull-requests: write + + steps: + - name: Clone repo + uses: actions/checkout@v4 + + - name: configure aws credentials + uses: aws-actions/configure-aws-credentials@v3 + with: + role-to-assume: arn:aws:iam::035866691871:role/gha-incubator + role-session-name: ghaincubatorsession + aws-region: us-west-2 + + - name: Terraform Plan + uses: dflook/terraform-plan@v1 + with: + path: terraform + backend_config_file: terraform/prod.backend.tfvars + \ No newline at end of file diff --git a/.github/workflows/terraform-plan.yml b/.github/workflows/terraform-plan.yml deleted file mode 100644 index 7a75eeb..0000000 --- a/.github/workflows/terraform-plan.yml +++ /dev/null @@ -1,116 +0,0 @@ -name: PR Terraform Plan - -on: - pull_request: - paths: - - 'terraform-incubator/**' - - 'terraform-modules/**' - -permissions: - contents: read - pull-requests: write - -jobs: - changed-files: - name: Get changed terraform directories - runs-on: ubuntu-latest - outputs: - module-directory: ${{ steps.module-directory.outputs.directory }} - project-directory: ${{ steps.project-directory.outputs.directory }} - environment-directory: ${{ steps.environment-directory.outputs.directory }} - has-environment-changes: ${{ steps.check-changes.outputs.has-environment-changes }} - has-project-changes: ${{ steps.check-changes.outputs.has-project-changes }} - steps: - - name: Checkout - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - name: Get changed files - id: changed-files - uses: dorny/paths-filter@v2 - with: - filters: | - module-change: - - 'terraform-modules/**' - project-change: - - 'terraform-incubator/*/project/*.tf' - environment-change: - - 'terraform-incubator/*/!(project)/*.tf' - list-files: json - - - name: List all changed files - run: | - echo 'module-change: ${{ steps.changed-files.outputs.module-change_files }}' - echo 'project-change: ${{ steps.changed-files.outputs.project-change_files }}' - echo 'environment-change: ${{ steps.changed-files.outputs.environment-change_files }}' - - - name: Extract module directory - id: module-directory - if: ${{ steps.changed-files.outputs['module-change'] == 'true' }} - run: | - directory=$(dirname "${{ fromJson(steps.changed-files.outputs.module-change_files)[0] }}") - echo "Extracted Directory: $directory" - echo "::set-output name=directory::$directory" - - - name: Extract project directory - id: project-directory - if: ${{ steps.changed-files.outputs['project-change'] == 'true' }} - run: | - directory=$(dirname "${{ fromJson(steps.changed-files.outputs.project-change_files)[0] }}") - echo "Extracted Directory: $directory" - echo "::set-output name=directory::$directory" - - - name: Extract environment directory - id: environment-directory - if: ${{ steps.changed-files.outputs['environment-change'] == 'true' }} - run: | - directory=$(dirname "${{ fromJson(steps.changed-files.outputs.environment-change_files)[0] }}") - echo "Extracted Directory: $directory" - echo "::set-output name=directory::$directory" - - - name: Check for conflicting changes - id: check-changes - run: | - echo "::set-output name=has-environment-changes::${{ steps.changed-files.outputs.environment-change_files != '[]' }}" - echo "::set-output name=has-project-changes::${{ steps.changed-files.outputs.project-change_files != '[]' }}" - - plan: - runs-on: ubuntu-latest - name: Terraform Plan - needs: [changed-files] - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - AWS_ACCESS_KEY_ID: ${{ secrets.INCUBATOR_AWS_ACCESS_KEY_ID }} - AWS_SECRET_ACCESS_KEY: ${{ secrets.INCUBATOR_AWS_SECRET_ACCESS_KEY }} - steps: - - name: Checkout - uses: actions/checkout@v3 - - - name: Fail on multiple plans - if: ${{ needs.changed-files.outputs.has-environment-changes == 'true' && needs.changed-files.outputs.has-project-changes == 'true' }} - run: | - echo "Multiple plans detected: Please make changes to environments and projects in separate pull requests." - exit 1 - - - name: Terraform validate - Modules - if: ${{ needs.changed-files.outputs.module-directory != '' && needs.changed-files.outputs.environment-directory == '' && needs.changed-files.outputs.project-directory == '' }} - uses: dflook/terraform-validate@v1 - with: - path: ${{ needs.changed-files.outputs.module-directory }} - - - name: Module validation failed - if: ${{ failure() && steps.validate.outputs.failure-reason == 'validate-failed' }} - run: echo "Module validation failed" - - - name: Terraform plan - Environment - if: ${{ needs.changed-files.outputs.environment-directory != '' && (needs.changed-files.outputs.project-directory == '' || needs.changed-files.outputs.has-environment-changes == 'true') }} - uses: dflook/terraform-plan@v1 - with: - path: ${{ needs.changed-files.outputs.environment-directory }} - - - name: Terraform plan - Project - if: ${{ needs.changed-files.outputs.project-directory != '' && needs.changed-files.outputs.has-environment-changes != 'true' }} - uses: dflook/terraform-plan@v1 - with: - path: ${{ needs.changed-files.outputs.project-directory }} diff --git a/terraform/backend.tf b/terraform/backend.tf new file mode 100644 index 0000000..b1bfb95 --- /dev/null +++ b/terraform/backend.tf @@ -0,0 +1,4 @@ +terraform { + backend "s3" { + } +} \ No newline at end of file diff --git a/terraform/main.tf b/terraform/main.tf index e69de29..8e063a4 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -0,0 +1,16 @@ +data "aws_iam_policy_document" "instance_assume_role_policy" { + statement { + actions = ["sts:AssumeRole"] + + principals { + type = "Service" + identifiers = ["ec2.amazonaws.com"] + } + } +} + +resource "aws_iam_role" "instance" { + name = "incubator_test_role" + path = "/system/" + assume_role_policy = data.aws_iam_policy_document.instance_assume_role_policy.json +} \ No newline at end of file diff --git a/terraform/prod.backend.tfvars b/terraform/prod.backend.tfvars new file mode 100644 index 0000000..a74f3c1 --- /dev/null +++ b/terraform/prod.backend.tfvars @@ -0,0 +1,5 @@ +bucket = "hfla-incubator-terraform-state" +key = "incubator/terraform.tfstate" +region = "us-west-2" +dynamodb_table = "hfla_incubator_terraform_table" +encrypt = true \ No newline at end of file