diff --git a/.github/ISSUE_TEMPLATE/pre-work-template-devops-security.md b/.github/ISSUE_TEMPLATE/pre-work-template-devops-security.md index 7816d21..05bfa63 100644 --- a/.github/ISSUE_TEMPLATE/pre-work-template-devops-security.md +++ b/.github/ISSUE_TEMPLATE/pre-work-template-devops-security.md @@ -35,9 +35,8 @@ As a new member on the HfLA devops-security team, fill in the following fields a - [ ] [Generating user access keys](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#generating-access-keys-for-aws-cli) - [ ] Complete the instructions in [AWS Documentation](https://docs.aws.amazon.com/cli/v1/userguide/cli-chap-install.html) and choose your operating system to install AWS CLI. - [ ] Complete the instruction in [AWS Documentation](https://docs.aws.amazon.com/cli/latest/userguide/cli-authentication-short-term.html) to setup the AWS CLI. -- [ ] Follow the instructions in [Creating a backend state](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#creating-backend-state) to create the S3 bucket and DynamoDB table. - - [ ] Create the S3 bucket - - [ ] Create the DynamoDB table +- [ ] Follow the instructions in [Creating a backend state](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#creating-backend-state) to create the S3 bucket. +- [ ] Create the S3 bucket - [ ] Install Terraform locally by following the instructions of the installation guide mentioned in [Installing Terraform](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#installing-terraform) - [ ] Install Terraform Docs locally by following the instructions of the installation guide mentioned in [Installing Terraform docs](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#installing-terraform-docs) - [ ] Complete the instructions in [Clone the repository](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#clone-the-repository) @@ -78,7 +77,7 @@ Note: You must be authenticated to your AWS account via the CLI for the next com If you are unable to authenticate from your local machine using the CLI, post in the #ops channel in Slack so that the team can help you get unblocked. - [ ] Execute the command `terraform init` to initialize terraform in the directory. Address any failures that arise (if any). - [ ] Execute the command `terraform plan` this will output a plan replicating the same IAM resources as the devops security account. Address any failures that arise (if any). -- [ ] Then execute the command `terraform apply` this will create all of the resources that are currently managed by Devops Security. All of the resources created here incur zero cost except for the Dynamo DB installation, which should remain in the free tier. ** +- [ ] Then execute the command `terraform apply` this will create all of the resources that are currently managed by Devops Security. All of the resources created here incur zero cost. - [ ] **If you have cost concerns, Run a Terraform Destroy to take down all of the resources you created (don't worry, you can recreate them just as quickly). If you create resources outside of what's described in this issue, you may incur charges.** - [ ] Update the README using Terraform Docs to document changes - [ ] ```terraform-docs -c .terraform.docs.yml .``` diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index e9796b1..235fa17 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -154,22 +154,6 @@ aws s3api put-bucket-encryption --bucket USERNAME-hfla-ops-terraform-state --ser }' ``` -#### Set up DynamoDB to store the backend state - -- Create table `hfla_ops_terraform_table` -- Set partition key to `LockID` with a type of `string` -- Choose on-demand capacity - -You can create the table from the AWS UI, CloudShell, or from the CLI using the following command: - -```bash -aws dynamodb create-table \ - --table-name hfla_ops_terraform_table \ - --attribute-definitions AttributeName=LockID,AttributeType=S \ - --key-schema AttributeName=LockID,KeyType=HASH \ - --billing-mode PAY_PER_REQUEST -``` - [Back to Top](#) *** @@ -248,7 +232,7 @@ After creating a backend state, create a `backend.tfvars` file in the `terraform bucket = "USERNAME-hfla-ops-terraform-state" key = "devops-security/terraform.tfstate" region = "us-west-2" -dynamodb_table = "hfla_ops_terraform_table" +use_lockfile = true encrypt = true ``` diff --git a/terraform/aws-custom-policies/tf-plan-scoped.json b/terraform/aws-custom-policies/tf-plan-scoped.json index b476dcf..5bb6404 100644 --- a/terraform/aws-custom-policies/tf-plan-scoped.json +++ b/terraform/aws-custom-policies/tf-plan-scoped.json @@ -25,20 +25,6 @@ "arn:aws:s3:::hfla-ops-terraform-state", "arn:aws:s3:::hfla-ops-terraform-state/*" ] - }, - { - "Sid": "AllowDynamoDBLockTableAccessForTerraformPlan", - "Effect": "Allow", - "Action": [ - "dynamodb:PutItem", - "dynamodb:DeleteItem", - "dynamodb:GetItem", - "dynamodb:UpdateItem", - "dynamodb:DescribeTable" - ], - "Resource": [ - "arn:aws:dynamodb:us-west-2:035866691871:table/hfla_ops_terraform_table" - ] } ] } diff --git a/terraform/backend.tf b/terraform/backend.tf index b02f4fb..cae7150 100644 --- a/terraform/backend.tf +++ b/terraform/backend.tf @@ -4,6 +4,7 @@ terraform { // CI silently upgraded itself -- state has been written by 1.7 through 1.16. // This line alone chooses the CI Terraform version. required_version = "~> 1.16.0" + // Locking config lives in terraform/prod.backend.tfvars (use_lockfile). backend "s3" { } required_providers { diff --git a/terraform/prod.backend.tfvars b/terraform/prod.backend.tfvars index 995edf6..7d25399 100644 --- a/terraform/prod.backend.tfvars +++ b/terraform/prod.backend.tfvars @@ -1,5 +1,5 @@ bucket = "hfla-ops-terraform-state" key = "devops-security/terraform.tfstate" region = "us-west-2" -dynamodb_table = "hfla_ops_terraform_table" +use_lockfile = true encrypt = true \ No newline at end of file