Implement terraform state locking in S3 backends

[dms1981]

User Story

As a Modernisation Platform Engineer
I need to implement backend locking of the terraform statefile
So that only one agent can modify the statefile at any given time

User Type(s)

Value

Without state file locking, it's possible for two jobs to access the statefile at the same time, leading to the creation of terraform statefile versions which are not in agreement with each other. In the case of a new account creation, this can lead to a state where terraform jobs cannot successfully run due to missing information.

Also, given our approach to work where many hands can be busy at one time, state file locking is an ideal solution to prevent any problems with clashing workflows.

Questions / Assumptions / Hypothesis

Proposal

We should implement a DynamoDB table and the necessary configuration elements specified by Hashicorp in the S3 backend type documentation

##Environments

• apex
• ccms-ebs
• cooker
• core-logging
• core-security
• core-vpc
• data-and-insights-wepi
• delius-iaps
• digital-prison-reporting
• equip
• example
• maatdb
• main.tf
• mlra
• nomis
• oasys
• performance-hub
• ppud
• refer-monitor
• sprinkler
• testing
• threat-and-vulnerability-mgmt
• xhibit-portal

Definition of done

• State file locking has been implemented across our backend.tf files
• another team member has reviewed

Reference

How to write good user stories
Backend type: S3

[SteveLinden]

Initial PR put in place for review

[SteveLinden]

I think this is now in place for the core-vpc code and needs to be tested. The above has been edited to list all the environments that have a backend.tf which probably need to be amended.

[SteveLinden]

core-vpc and core-security completed (individual PRs) (e.g. #2552)
Others will be done in one PR

[SteveLinden]

Changes made for the above but I am now going through them to see which do not work. bichard7 is the first culprit, and I will remove them from the list above and try to take them out of the PR

[SteveLinden]

Non-working items to remove from PR

bichard7 - Error refreshing state: InvalidObjectState: The operation is not valid for the object's storage class
analytical-platform-data - Error refreshing state: InvalidObjectState: The operation is not valid for the object's storage class
analytical-platform-management - Error refreshing state: InvalidObjectState: The operation is not valid for the object's storage
Bootstrap/delegate-access - not included
Bootstrap/secure-baselines - not included
Core-network-services - S3 issues
Core-sandbox - S3 issues
core-shared-services - S3 issues
Mi-platform - S3 issues
Remote-supervision - storage class issues

Sprinkler has been left in place but it indicates it will destroy 9 items

[SteveLinden]

plan on core-sandbox indicates it will destroy 10 items so this is being left out.
Added core-network-services, core-shared-services and mi-platform

[SteveLinden]

Has been applied