218 terraform lockfiles use s3 not dynamodb

.github/ISSUE_TEMPLATE/pre-work-template-devops-security.md

@@ -35,9 +35,8 @@ As a new member on the HfLA devops-security team, fill in the following fields a
     - [ ] [Generating user access keys](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#generating-access-keys-for-aws-cli)
 - [ ] Complete the instructions in [AWS Documentation](https://docs.aws.amazon.com/cli/v1/userguide/cli-chap-install.html) and choose your operating system to install AWS CLI. 
 - [ ] Complete the instruction in [AWS Documentation](https://docs.aws.amazon.com/cli/latest/userguide/cli-authentication-short-term.html) to setup the AWS CLI.
-- [ ] Follow the instructions in [Creating a backend state](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#creating-backend-state) to create the S3 bucket and DynamoDB table.
-  - [ ] Create the S3 bucket
-  - [ ] Create the DynamoDB table
+- [ ] Follow the instructions in [Creating a backend state](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#creating-backend-state) to create the S3 bucket.
+- [ ] Create the S3 bucket
 - [ ] Install Terraform locally by following the instructions of the installation guide mentioned in [Installing Terraform](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#installing-terraform)
 - [ ] Install Terraform Docs locally by following the instructions of the installation guide mentioned in [Installing Terraform docs](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#installing-terraform-docs)
 - [ ] Complete the instructions in [Clone the repository](https://github.com/hackforla/devops-security/blob/main/CONTRIBUTING.md#clone-the-repository)
@@ -78,7 +77,7 @@ Note: You must be authenticated to your AWS account via the CLI for the next com
 If you are unable to authenticate from your local machine using the CLI, post in the #ops channel in Slack so that the team can help you get unblocked.
 - [ ] Execute the command `terraform init` to initialize terraform in the directory. Address any failures that arise (if any).
 - [ ] Execute the command `terraform plan` this will output a plan replicating the same IAM resources as the devops security account. Address any failures that arise (if any).
-- [ ] Then execute the command `terraform apply` this will create all of the resources that are currently managed by Devops Security. All of the resources created here incur zero cost except for the Dynamo DB installation, which should remain in the free tier. **
+- [ ] Then execute the command `terraform apply` this will create all of the resources that are currently managed by Devops Security.  All of the resources created here incur zero cost.
   - [ ] **If you have cost concerns, Run a Terraform Destroy to take down all of the resources you created (don't worry, you can recreate them just as quickly). If you create resources outside of what's described in this issue, you may incur charges.**
 - [ ] Update the README using Terraform Docs to document changes
   - [ ] ```terraform-docs -c .terraform.docs.yml .```

CONTRIBUTING.md

@@ -154,22 +154,6 @@ aws s3api put-bucket-encryption --bucket USERNAME-hfla-ops-terraform-state --ser
 }'
 ```
 
-#### Set up DynamoDB to store the backend state
-
-- Create table `hfla_ops_terraform_table`
-- Set partition key to `LockID` with a type of `string`
-- Choose on-demand capacity
-
-You can create the table from the AWS UI, CloudShell, or from the CLI using the following command:
-
-```bash
-aws dynamodb create-table \
-    --table-name hfla_ops_terraform_table \
-    --attribute-definitions AttributeName=LockID,AttributeType=S \
-    --key-schema AttributeName=LockID,KeyType=HASH \
-    --billing-mode PAY_PER_REQUEST
-```
-
 <sub>[Back to Top](#)</sub>
 ***
 
@@ -248,7 +232,7 @@ After creating a backend state, create a `backend.tfvars` file in the `terraform
 bucket         = "USERNAME-hfla-ops-terraform-state"
 key            = "devops-security/terraform.tfstate"
 region         = "us-west-2"
-dynamodb_table = "hfla_ops_terraform_table"
+use_lockfile   = true
 encrypt        = true
 ```
 

terraform/aws-custom-policies/tf-plan-scoped.json

@@ -25,20 +25,6 @@
         "arn:aws:s3:::hfla-ops-terraform-state",
         "arn:aws:s3:::hfla-ops-terraform-state/*"
       ]
-    },
-    {
-      "Sid": "AllowDynamoDBLockTableAccessForTerraformPlan",
-      "Effect": "Allow",
-      "Action": [
-        "dynamodb:PutItem",
-        "dynamodb:DeleteItem",
-        "dynamodb:GetItem",
-        "dynamodb:UpdateItem",
-        "dynamodb:DescribeTable"
-      ],
-      "Resource": [
-        "arn:aws:dynamodb:us-west-2:035866691871:table/hfla_ops_terraform_table"
-      ]
     }
   ]
 }

terraform/backend.tf

@@ -4,6 +4,7 @@ terraform {
   // CI silently upgraded itself -- state has been written by 1.7 through 1.16.
   // This line alone chooses the CI Terraform version.
   required_version = "~> 1.16.0"
+  // Locking config lives in terraform/prod.backend.tfvars (use_lockfile).
   backend "s3" {
   }
   required_providers {

terraform/prod.backend.tfvars

@@ -1,5 +1,5 @@
 bucket         = "hfla-ops-terraform-state"
 key            = "devops-security/terraform.tfstate"
 region         = "us-west-2"
-dynamodb_table = "hfla_ops_terraform_table"
+use_lockfile   = true
 encrypt        = true