Skip to content

Commit 94fad9a

Browse files
bzarboni1github-actions[bot]
bzarboni1
and
github-actions[bot]
authored
refactor: terraform fmt (#54)
* refactor: terraform fmt * terraform-docs: automated action --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
1 parent 0345b95 commit 94fad9a

14 files changed

Lines changed: 193 additions & 172 deletions

File tree

‎modules/github-aws-oidc/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ No modules.
2727
| [aws_kms_key.encryption_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
2828
| [aws_resourcegroups_group.github_foundations_rg](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/resourcegroups_group) | resource |
2929
| [aws_s3_bucket.state_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
30+
| [aws_s3_bucket_public_access_block.state_bucket_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |
3031
| [aws_s3_bucket_server_side_encryption_configuration.state_bucket_encryption](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource |
3132
| [aws_s3_bucket_versioning.state_bucket_versioning](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource |
3233

‎modules/github-aws-oidc/oidc.tf‎

Lines changed: 80 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -1,97 +1,102 @@
11
resource "aws_iam_openid_connect_provider" "oidc_provider_entry" {
22
url = "https://token.actions.githubusercontent.com"
33

4-
client_id_list = [ "sts.amazonaws.com" ]
4+
client_id_list = ["sts.amazonaws.com"]
55

66
thumbprint_list = var.github_thumbprints
77

88
tags = local.rg_tags
99
}
1010

1111
resource "aws_iam_role" "organizations_role" {
12-
name = var.organizations_role_name
12+
name = var.organizations_role_name
1313

14-
assume_role_policy = jsonencode({
14+
assume_role_policy = jsonencode({
1515
"Version" = "2012-10-17",
1616
"Statement" = [
17-
{
18-
"Effect" = "Allow",
19-
"Action" = "sts:AssumeRoleWithWebIdentity",
20-
"Principal" = {
21-
"Federated" = aws_iam_openid_connect_provider.oidc_provider_entry.arn
22-
},
23-
"Condition" = {
24-
"StringEquals" = {
25-
"token.actions.githubusercontent.com:aud" = [
26-
"sts.amazonaws.com"
27-
]
28-
},
29-
"StringLike" = {
30-
"token.actions.githubusercontent.com:sub": [
31-
"repo:${var.github_foundations_organization_name}/${var.organizations_repo_name}:*"
32-
]
33-
}
34-
}
17+
{
18+
"Effect" = "Allow",
19+
"Action" = "sts:AssumeRoleWithWebIdentity",
20+
"Principal" = {
21+
"Federated" = aws_iam_openid_connect_provider.oidc_provider_entry.arn
22+
},
23+
"Condition" = {
24+
"StringEquals" = {
25+
"token.actions.githubusercontent.com:aud" = [
26+
"sts.amazonaws.com"
27+
]
28+
},
29+
"StringLike" = {
30+
"token.actions.githubusercontent.com:sub" : [
31+
"repo:${var.github_foundations_organization_name}/${var.organizations_repo_name}:*"
32+
]
33+
}
3534
}
35+
}
3636
]
37-
})
37+
})
3838

39-
tags = local.rg_tags
39+
tags = local.rg_tags
4040
}
4141

42+
# Ignote avd-aws-0057 - we need the user to be able to set
43+
# whatever secret names they want to use (restricted by tagging them).
44+
#trivy:ignore:avd-aws-0057
4245
resource "aws_iam_role_policy" "organizations_role_policy" {
43-
name = "organizations-tf-state-management-policy"
44-
role = aws_iam_role.organizations_role.id
46+
name = "organizations-tf-state-management-policy"
47+
role = aws_iam_role.organizations_role.id
4548

46-
policy = jsonencode({
47-
Version = "2012-10-17"
48-
Statement = [
49-
{
50-
Sid = "StateBucketFullAccess"
51-
Action = [
52-
"s3:*"
53-
]
54-
Effect = "Allow"
55-
Resource = [
56-
aws_s3_bucket.state_bucket.arn,
57-
"${aws_s3_bucket.sate_bucket.arn}/*"
58-
]
59-
},
60-
{
61-
Sid = "StateBucketDeleteDeny"
62-
Action = [
63-
"s3:DeleteBucket"
64-
]
65-
Effect = "Deny"
66-
Resource = [aws_s3_bucket.state_bucket.arn]
67-
},
68-
{
69-
Sid = "AllowSecretRead"
70-
Action = [
71-
"secretsmanager:GetSecretValue",
72-
"secretsmanager:DescribeSecret",
73-
"secretsmanager:GetResourcePolicy"
49+
policy = jsonencode({
50+
Version = "2012-10-17"
51+
Statement = [
52+
{
53+
Sid = "StateBucketFullAccess"
54+
Action = [
55+
"s3:PutObject",
56+
"s3:GetObject",
57+
"s3:ListBucket"
58+
]
59+
Effect = "Allow"
60+
Resource = [
61+
aws_s3_bucket.state_bucket.arn,
62+
"${aws_s3_bucket.state_bucket.arn}/*"
63+
]
64+
},
65+
{
66+
Sid = "StateBucketDeleteDeny"
67+
Action = [
68+
"s3:DeleteBucket"
69+
]
70+
Effect = "Deny"
71+
Resource = [aws_s3_bucket.state_bucket.arn]
72+
},
73+
{
74+
Sid = "AllowSecretRead"
75+
Action = [
76+
"secretsmanager:GetSecretValue",
77+
"secretsmanager:DescribeSecret",
78+
"secretsmanager:GetResourcePolicy"
7479

75-
]
76-
Effect = "Allow"
77-
Resource = "*"
78-
Condition = {
79-
StringEquals = {
80-
"secretsmanager:ResourceTag/Purpose" = local.rg_tags["Purpose"]
81-
}
82-
}
83-
},
84-
{
85-
Sid = "AllowDynamoDBActionsOnLockTable"
86-
Effect = "Allow",
87-
Action = [
88-
"dynamodb:DescribeTable",
89-
"dynamodb:GetItem",
90-
"dynamodb:PutItem",
91-
"dynamodb:DeleteItem"
92-
],
93-
Resource = [ aws_dynamodb_table.state_lock_table.arn ]
94-
}
9580
]
96-
})
97-
}
81+
Effect = "Allow"
82+
Resource = "*"
83+
Condition = {
84+
StringEquals = {
85+
"secretsmanager:ResourceTag/Purpose" = local.rg_tags["Purpose"]
86+
}
87+
}
88+
},
89+
{
90+
Sid = "AllowDynamoDBActionsOnLockTable"
91+
Effect = "Allow",
92+
Action = [
93+
"dynamodb:DescribeTable",
94+
"dynamodb:GetItem",
95+
"dynamodb:PutItem",
96+
"dynamodb:DeleteItem"
97+
],
98+
Resource = [aws_dynamodb_table.state_lock_table.arn]
99+
}
100+
]
101+
})
102+
}

‎modules/github-aws-oidc/outputs.tf‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
11
output "s3_bucket_name" {
22
description = "The name of the s3 bucket holding terraform state."
3-
value = aws_s3_bucket.state_bucket.bucket
3+
value = aws_s3_bucket.state_bucket.bucket
44
}
55

66
output "s3_bucket_region" {
77
description = "The region the s3 bucket holding terraform state was created in."
8-
value = aws_s3_bucket.state_bucket.region
8+
value = aws_s3_bucket.state_bucket.region
99
}
1010

1111
output "dynamodb_table_name" {
1212
description = "The name of the dynamodb table that was created to store lock file ids."
13-
value = aws_dynamodb_table.state_lock_table.name
13+
value = aws_dynamodb_table.state_lock_table.name
1414
}
1515

1616
output "organizations_runner_role" {
1717
description = "The ARN of the role that the github action runner should assume for the organizations repo"
18-
value = aws_iam_role.organizations_role.arn
19-
}
18+
value = aws_iam_role.organizations_role.arn
19+
}

‎modules/github-aws-oidc/resource_group.tf‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,18 +4,18 @@ locals {
44
}
55
}
66

7-
resource "aws_resourcegroups_group" "github_foundations_rg" {
7+
resource "aws_resourcegroups_group" "github_foundations_rg" {
88
name = var.rg_name
99

1010
resource_query {
1111
query = jsonencode({
12-
"ResourceTypeFilters" = [ "AWS::AllSupported" ]
13-
"TagFilters" = [
14-
{
15-
"Key"="Purpose"
16-
"Values"=[ local.rg_tags.Purpose ]
17-
}
18-
]
12+
"ResourceTypeFilters" = ["AWS::AllSupported"]
13+
"TagFilters" = [
14+
{
15+
"Key" = "Purpose"
16+
"Values" = [local.rg_tags.Purpose]
17+
}
18+
]
1919
})
2020
}
2121
}

‎modules/github-aws-oidc/storage.tf‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
11
resource "aws_kms_key" "encryption_key" {
22
description = "This key is used to encrypt state bucket objects"
33
deletion_window_in_days = 10
4-
4+
enable_key_rotation = true
5+
56
tags = local.rg_tags
67
}
78

9+
#trivy:ignore:s3-bucket-logging
810
resource "aws_s3_bucket" "state_bucket" {
911
bucket = var.bucket_name
1012

@@ -29,12 +31,24 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "state_bucket_encr
2931
}
3032
}
3133

34+
resource "aws_s3_bucket_public_access_block" "state_bucket_access" {
35+
bucket = aws_s3_bucket.state_bucket.id
36+
block_public_acls = true
37+
block_public_policy = true
38+
ignore_public_acls = true
39+
restrict_public_buckets = true
40+
}
41+
42+
#trivy:ignore:avd-aws-0025
3243
resource "aws_dynamodb_table" "state_lock_table" {
3344
name = var.tflock_db_name
3445
read_capacity = var.tflock_db_read_capacity
3546
write_capacity = var.tflock_db_write_capacity
3647
billing_mode = var.tflock_db_billing_mode
3748
hash_key = "LockID"
49+
point_in_time_recovery {
50+
enabled = true
51+
}
3852

3953
attribute {
4054
name = "LockID"

‎modules/github-aws-oidc/variables.tf‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,66 +1,66 @@
11
# Resource Group Variables
22
variable "rg_name" {
3-
type = string
3+
type = string
44
description = "The name of the AWS resource group to create for github foundation resources."
5-
default = "GithubFoundationResources"
5+
default = "GithubFoundationResources"
66
}
77

88
# Bucket Variables
99
variable "bucket_name" {
10-
type = string
10+
type = string
1111
description = "The name of the s3 bucket that will store terraform state."
12-
default = "GithubFoundationState"
12+
default = "GithubFoundationState"
1313
}
1414

1515
# DynamoDB Variables
1616
variable "tflock_db_name" {
17-
type = string
17+
type = string
1818
description = "The name of the dynamodb table that will store lock file ids."
19-
default = "TFLockIds"
19+
default = "TFLockIds"
2020
}
2121

2222
variable "tflock_db_read_capacity" {
23-
type = number
23+
type = number
2424
description = "The read capacity to set for the dynamodb table storing lock file ids. Only required if billing mode is `PROVISIONED`. Defaults to 20."
25-
default = 20
25+
default = 20
2626
}
2727

2828
variable "tflock_db_write_capacity" {
29-
type = number
29+
type = number
3030
description = "The write capacity to set for the dynamodb table storing lock file ids. Only required if billing mode is `PROVISIONED`. Defaults to 20."
31-
default = 20
31+
default = 20
3232
}
3333

3434
variable "tflock_db_billing_mode" {
35-
type = string
35+
type = string
3636
description = "The billing mode to use for the dynamodb table storing lock file ids. Defaults to `PROVISIONED`."
37-
default = "PROVISIONED"
37+
default = "PROVISIONED"
3838
}
3939

4040
# IAM Variables
4141

4242
variable "github_thumbprints" {
43-
type = list(string)
43+
type = list(string)
4444
description = "A list of top intermediate certifact authority thumbprints to use for setting up an openid connect provider with github. Info on how to obtain thumbprints here: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html"
4545
validation {
4646
error_message = "The list must be a minimum length of 1 and has a maximum length of 5"
47-
condition = length(var.github_thumbprints) >=1 && length(var.github_thumbprints) <= 5
47+
condition = length(var.github_thumbprints) >= 1 && length(var.github_thumbprints) <= 5
4848
}
4949
}
5050

5151
variable "organizations_role_name" {
52-
type = string
52+
type = string
5353
description = "The name of the role that will be assummed by the github runner for the organizations repository."
54-
default = "GhFoundationsOrganizationsAction"
54+
default = "GhFoundationsOrganizationsAction"
5555
}
5656

5757
variable "github_foundations_organization_name" {
58-
type = string
58+
type = string
5959
description = "The owner of the github foundations organizations repository. This value should be whatever github account you plan to make the repository under."
6060
}
6161

6262
variable "organizations_repo_name" {
63-
type = string
63+
type = string
6464
description = "The name of the github foundations organizations repository. Defaults to `organizations`"
65-
default = "organizations"
66-
}
65+
default = "organizations"
66+
}

0 commit comments

Comments
 (0)