Merge pull request #9055 from ministryofjustice/feature/8345-add-extr…

…a-environments-to-use-native-locking Set `github` and `pagerduty` to use native state locking
ministryofjustice · Jan 23, 2025 · 19a95a2 · 19a95a2
2 parents 4281cc9 + c46cff1
commit 19a95a2
Show file tree

Hide file tree

Showing 10 changed files with 11 additions and 18 deletions.
diff --git a/terraform/environments/bootstrap/delegate-access/backend.tf b/terraform/environments/bootstrap/delegate-access/backend.tf
@@ -1,7 +1,6 @@
 terraform {
   # `backend` blocks do not support variables, so the following are hard-coded here:
   # - S3 bucket name, which is created in terraform/modernisation-platform-account/s3.tf
-  #checkov:skip=CKV_TF_3:Ensure state files are locked - temporarily suppressed pending issue #8789
   backend "s3" {
     acl                  = "bucket-owner-full-control"
     bucket               = "modernisation-platform-terraform-state"

diff --git a/terraform/environments/bootstrap/member-bootstrap/backend.tf b/terraform/environments/bootstrap/member-bootstrap/backend.tf
@@ -1,7 +1,6 @@
 terraform {
   # `backend` blocks do not support variables, so the following are hard-coded here:
   # - S3 bucket name, which is created in terraform/modernisation-platform-account/s3.tf
-  #checkov:skip=CKV_TF_3:Ensure state files are locked - temporarily suppressed pending issue #8789
   backend "s3" {
     acl                  = "bucket-owner-full-control"
     bucket               = "modernisation-platform-terraform-state"

diff --git a/terraform/environments/bootstrap/secure-baselines/backend.tf b/terraform/environments/bootstrap/secure-baselines/backend.tf
@@ -1,7 +1,6 @@
 terraform {
   # `backend` blocks do not support variables, so the following are hard-coded here:
   # - S3 bucket name, which is created in terraform/modernisation-platform-account/s3.tf
-  #checkov:skip=CKV_TF_3:Ensure state files are locked - temporarily suppressed pending issue #8789
   backend "s3" {
     acl                  = "bucket-owner-full-control"
     bucket               = "modernisation-platform-terraform-state"

diff --git a/terraform/environments/bootstrap/single-sign-on/backend.tf b/terraform/environments/bootstrap/single-sign-on/backend.tf
@@ -1,7 +1,6 @@
 terraform {
   # `backend` blocks do not support variables, so the following are hard-coded here:
   # - S3 bucket name, which is created in terraform/modernisation-platform-account/s3.tf
-  #checkov:skip=CKV_TF_3:Ensure state files are locked - temporarily suppressed pending issue #8789
   backend "s3" {
     acl                  = "bucket-owner-full-control"
     bucket               = "modernisation-platform-terraform-state"

diff --git a/terraform/environments/core-sandbox/backend.tf b/terraform/environments/core-sandbox/backend.tf
@@ -2,7 +2,6 @@
 terraform {
   # `backend` blocks do not support variables, so the following are hard-coded here:
   # - S3 bucket name, which is created in modernisation-platform-account/s3.tf
-  #checkov:skip=CKV_TF_3:Ensure state files are locked - temporarily suppressed pending issue #8789
   backend "s3" {
     acl                  = "bucket-owner-full-control"
     bucket               = "modernisation-platform-terraform-state"

diff --git a/terraform/environments/main.tf b/terraform/environments/main.tf
@@ -1,7 +1,6 @@
 terraform {
   # `backend` blocks do not support variables, so the following are hard-coded here:
   # - S3 bucket name, which is created in s3.tf
-  #checkov:skip=CKV_TF_3:Ensure state files are locked - temporarily suppressed pending issue #8789
   backend "s3" {
     acl          = "bucket-owner-full-control"
     bucket       = "modernisation-platform-terraform-state"

diff --git a/terraform/github/backend.tf b/terraform/github/backend.tf
@@ -1,11 +1,11 @@
 terraform {
   # `backend` blocks do not support variables, so the following are hard-coded here:
   # - S3 bucket name, which is created in modernisation-platform-account/s3.tf
-  #checkov:skip=CKV_TF_3:Ensure state files are locked - temporarily suppressed pending issue #8789
   backend "s3" {
-    bucket  = "modernisation-platform-terraform-state"
-    encrypt = true
-    key     = "github/terraform.tfstate"
-    region  = "eu-west-2"
+    bucket       = "modernisation-platform-terraform-state"
+    encrypt      = true
+    key          = "github/terraform.tfstate"
+    region       = "eu-west-2"
+    use_lockfile = true
   }
 }
diff --git a/terraform/pagerduty/backend.tf b/terraform/pagerduty/backend.tf
@@ -1,11 +1,11 @@
 terraform {
   # `backend` blocks do not support variables, so the following are hard-coded here:
   # - S3 bucket name, which is created in modernisation-platform-account/s3.tf
-  #checkov:skip=CKV_TF_3:Ensure state files are locked - temporarily suppressed pending issue #8789
   backend "s3" {
-    bucket  = "modernisation-platform-terraform-state"
-    encrypt = true
-    key     = "pagerduty/terraform.tfstate"
-    region  = "eu-west-2"
+    bucket       = "modernisation-platform-terraform-state"
+    encrypt      = true
+    key          = "pagerduty/terraform.tfstate"
+    region       = "eu-west-2"
+    use_lockfile = true
   }
 }
diff --git a/terraform/single-sign-on/backend.tf b/terraform/single-sign-on/backend.tf
@@ -1,7 +1,6 @@
 terraform {
   # `backend` blocks do not support variables, so the following are hard-coded here:
   # - S3 bucket name, which is created in terraform/modernisation-platform-account/s3.tf
-
   backend "s3" {
     acl            = "bucket-owner-full-control"
     bucket         = "modernisation-platform-terraform-state"

diff --git a/terraform/templates/modernisation-platform/backend.tf b/terraform/templates/modernisation-platform/backend.tf
@@ -10,5 +10,5 @@ terraform {
     region               = "eu-west-2"
     use_lockfile         = true
     workspace_key_prefix = "environments/accounts/$application_name" # This will store the object as environments/accounts/$application_name/${workspace}/terraform.tfstate
-    }
+  }
 }