From e9c492d149d991a7d8864d532964043ec9ef3aaf Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Fri, 25 Apr 2025 16:37:01 +0200 Subject: [PATCH] Add OpenTofu setup and configuration for AWS infrastructure - Create action for setting up OpenTofu environment - Update Terraform workflow to use OpenTofu for infrastructure management - Modify backend configuration for S3 with new bucket and region - Add S3 bucket resources with lifecycle configuration - Update local variables and remove deprecated files - Include required Python packages for OpenTofu --- .github/actions/setup-opentofu/action.yml | 15 ++++++ .github/workflows/terraform-aws-iac-apply.yml | 12 ++--- .gitignore | 1 + requirements/opentofu.txt | 1 + sectool.env | 2 + terraform/aws-iac/.vault | 1 - terraform/aws-iac/backend.tf | 6 +-- terraform/aws-iac/buckets.tf | 51 +++++++++++++++++++ terraform/aws-iac/config.tf | 7 ++- terraform/aws-iac/variables.tf | 2 +- terraform/aws-iac/vars/main.tfvars | 1 - terraform/aws-iac/versions.tf | 3 -- 12 files changed, 85 insertions(+), 17 deletions(-) create mode 100644 .github/actions/setup-opentofu/action.yml create mode 100644 requirements/opentofu.txt create mode 100644 sectool.env delete mode 100644 terraform/aws-iac/.vault create mode 100644 terraform/aws-iac/buckets.tf delete mode 100644 terraform/aws-iac/vars/main.tfvars delete mode 100644 terraform/aws-iac/versions.tf diff --git a/.github/actions/setup-opentofu/action.yml b/.github/actions/setup-opentofu/action.yml new file mode 100644 index 0000000..1ebb5ae --- /dev/null +++ b/.github/actions/setup-opentofu/action.yml @@ -0,0 +1,15 @@ +name: Setup OpenTofu Environment +description: Prepare the environment for A13labs CI/CD pipelines + +runs: + using: "composite" + steps: + - name: Setup OpenTofu + uses: opentofu/setup-opentofu@v1 + with: + terraform_version: 1.9.1 + + - name: Install required python packages + shell: bash + run: | + python3 -m pip install -r requirements/opentofu.txt diff --git a/.github/workflows/terraform-aws-iac-apply.yml b/.github/workflows/terraform-aws-iac-apply.yml index b275342..929cdf2 100644 --- a/.github/workflows/terraform-aws-iac-apply.yml +++ b/.github/workflows/terraform-aws-iac-apply.yml @@ -9,7 +9,7 @@ on: paths: - "terraform/aws-iac/**" jobs: - terraform-apply: + opentofu-apply: runs-on: ubuntu-latest steps: @@ -21,15 +21,15 @@ jobs: - name: Setup environment uses: ./.github/actions/setup-env - - name: Setup Terraform environment - uses: ./.github/actions/setup-terraform-env + - name: Setup OpenTofu environment + uses: ./.github/actions/setup-opentofu-env - - name: Terraform Init and Apply + - name: OpenTofu Init and Apply env: BW_PROJECT_ID: ${{ secrets.BW_PROJECT_ID }} BW_ORGANIZATION_ID: ${{ secrets.BW_ORGANIZATION_ID }} BW_ACCESS_TOKEN: ${{ secrets.BW_ACCESS_TOKEN }} run: | cd terraform/aws-iac - sectool -f ../../sectool.json exec terraform init - sectool -f ../../sectool.json exec terraform apply --auto-approve + sectool -f ../../sectool.json exec tofu init + sectool -f ../../sectool.json exec tofu apply --auto-approve diff --git a/.gitignore b/.gitignore index ce20b2c..390e8f9 100644 --- a/.gitignore +++ b/.gitignore @@ -42,3 +42,4 @@ drafts/* .molecule *.auto.tfvars dev/* +.ansible \ No newline at end of file diff --git a/requirements/opentofu.txt b/requirements/opentofu.txt new file mode 100644 index 0000000..441145a --- /dev/null +++ b/requirements/opentofu.txt @@ -0,0 +1 @@ +bcrypt \ No newline at end of file diff --git a/sectool.env b/sectool.env new file mode 100644 index 0000000..865ddf9 --- /dev/null +++ b/sectool.env @@ -0,0 +1,2 @@ +AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY +AWS_SECRET_ACCESS_KEY=$AWS_SECRET_KEY diff --git a/terraform/aws-iac/.vault b/terraform/aws-iac/.vault deleted file mode 100644 index 7007d14..0000000 --- a/terraform/aws-iac/.vault +++ /dev/null @@ -1 +0,0 @@ -../../repository.vault \ No newline at end of file diff --git a/terraform/aws-iac/backend.tf b/terraform/aws-iac/backend.tf index 2b8c733..01b292e 100644 --- a/terraform/aws-iac/backend.tf +++ b/terraform/aws-iac/backend.tf @@ -1,7 +1,7 @@ terraform { backend "s3" { - bucket = "a13labs.infra" - key = "aws-alarms.tfstate" - region = "us-east-1" + bucket = "a13labs.infra.eu" + key = "aws.core.infra.tfstate" + region = "eu-west-1" } } diff --git a/terraform/aws-iac/buckets.tf b/terraform/aws-iac/buckets.tf new file mode 100644 index 0000000..c8726e3 --- /dev/null +++ b/terraform/aws-iac/buckets.tf @@ -0,0 +1,51 @@ +resource "aws_s3_bucket" "infra_bucket" { + bucket = "a13labs.infra.eu" + force_destroy = true +} + +resource "aws_s3_bucket_public_access_block" "infra_bucket" { + bucket = aws_s3_bucket.infra_bucket.id + + block_public_acls = true + ignore_public_acls = true + block_public_policy = true + restrict_public_buckets = true +} + +resource "aws_s3_bucket_versioning" "infra_bucket" { + bucket = aws_s3_bucket.infra_bucket.id + + versioning_configuration { + status = "Enabled" + } +} + +resource "aws_s3_bucket_lifecycle_configuration" "infra_bucket" { + bucket = aws_s3_bucket.infra_bucket.id + + rule { + id = "clenaup" + status = "Enabled" + filter { + prefix = "/" + } + expiration { + days = 30 + } + } +} + +import { + id = "a13labs.infra.eu" + to = aws_s3_bucket.infra_bucket +} + +import { + id = "a13labs.infra.eu" + to = aws_s3_bucket_public_access_block.infra_bucket +} + +import { + id = "a13labs.infra.eu" + to = aws_s3_bucket_versioning.infra_bucket +} diff --git a/terraform/aws-iac/config.tf b/terraform/aws-iac/config.tf index 9464646..ae9d6b6 100644 --- a/terraform/aws-iac/config.tf +++ b/terraform/aws-iac/config.tf @@ -1,5 +1,8 @@ locals { - region = "us-east-1" + region = "eu-west-1" billing_alarm_limit = 20 - billing_alarm_emails = "c.alexandre.pires@gmail.com" + billing_alarm_emails = "c.alexandre.pires@alexpires.me" + account_id = data.aws_caller_identity.current.account_id } + +data "aws_caller_identity" "current" {} diff --git a/terraform/aws-iac/variables.tf b/terraform/aws-iac/variables.tf index cdcef80..e9ccbe6 100644 --- a/terraform/aws-iac/variables.tf +++ b/terraform/aws-iac/variables.tf @@ -1,4 +1,4 @@ variable "region" { description = "AWS Default region" - default = "us-east-1" + default = "eu-west-1" } diff --git a/terraform/aws-iac/vars/main.tfvars b/terraform/aws-iac/vars/main.tfvars deleted file mode 100644 index 8b13789..0000000 --- a/terraform/aws-iac/vars/main.tfvars +++ /dev/null @@ -1 +0,0 @@ - diff --git a/terraform/aws-iac/versions.tf b/terraform/aws-iac/versions.tf deleted file mode 100644 index 6b6318d..0000000 --- a/terraform/aws-iac/versions.tf +++ /dev/null @@ -1,3 +0,0 @@ -terraform { - required_version = ">= 0.13" -}