Skip to content

Commit 277a0b8

Browse files
gambol99gambol99
committed
feat: adding the initial module
0 parents  commit 277a0b8

9 files changed

+248
-0
lines changed

‎.github/workflows/release.yml

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
name: Release
3+
4+
on:
5+
push:
6+
tags:
7+
- "v*"
8+
9+
jobs:
10+
release:
11+
uses: appvia/appvia-cicd-workflows/.github/workflows/terraform-module-release.yml@main
12+
name: GitHub Release

‎.github/workflows/terraform.yml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
name: Terraform
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
branches:
9+
- main
10+
11+
jobs:
12+
module-validation:
13+
uses: appvia/appvia-cicd-workflows/.github/workflows/terraform-module-validation.yml@main
14+
name: Module Validation
15+
with:
16+
working-directory: .

‎.gitignore

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Local .terraform directories
2+
**/.terraform/*
3+
4+
# .tfstate files
5+
*.tfstate
6+
*.tfstate.*
7+
8+
# Crash log files
9+
crash.log
10+
crash.*.log
11+
12+
# Ignore override files as they are usually used to override resources locally and so
13+
# are not checked in
14+
override.tf
15+
override.tf.json
16+
*_override.tf
17+
*_override.tf.json
18+
19+
# Include override files you do wish to add to version control using negated pattern
20+
# !example_override.tf
21+
22+
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
23+
# example: *tfplan*
24+
25+
# Ignore CLI configuration files
26+
.terraformrc
27+
terraform.rc
28+
29+
# Other
30+
.DS_Store
31+
todo.md
32+

‎.terraform.lock.hcl

+25
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎README.md

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
<!-- BEGIN_TF_DOCS -->
2+
## Requirements
3+
4+
| Name | Version |
5+
|------|---------|
6+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
7+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 5.0 |
8+
9+
## Providers
10+
11+
| Name | Version |
12+
|------|---------|
13+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.42.0 |
14+
15+
## Modules
16+
17+
No modules.
18+
19+
## Resources
20+
21+
| Name | Type |
22+
|------|------|
23+
| [aws_cloudformation_stack.management](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudformation_stack) | resource |
24+
| [aws_cloudformation_stack_set.boundary](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudformation_stack_set) | resource |
25+
| [aws_cloudformation_stack_set_instance.root](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudformation_stack_set_instance) | resource |
26+
| [aws_organizations_organization.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/organizations_organization) | data source |
27+
28+
## Inputs
29+
30+
| Name | Description | Type | Default | Required |
31+
|------|-------------|------|---------|:--------:|
32+
| <a name="input_capabilities"></a> [capabilities](#input\_capabilities) | The capabilities required to deploy the cloudformation template | `list(string)` | <pre>[<br> "CAPABILITY_NAMED_IAM",<br> "CAPABILITY_AUTO_EXPAND",<br> "CAPABILITY_IAM"<br>]</pre> | no |
33+
| <a name="input_description"></a> [description](#input\_description) | The description of the cloudformation stack | `string` | n/a | yes |
34+
| <a name="input_enable_management_account"></a> [enable\_management\_account](#input\_enable\_management\_account) | Enable the deployment to the management account | `bool` | `false` | no |
35+
| <a name="input_max_concurrent_count"></a> [max\_concurrent\_count](#input\_max\_concurrent\_count) | The maximum number of concurrent deployments | `number` | `10` | no |
36+
| <a name="input_name"></a> [name](#input\_name) | The name of the cloudformation stack | `string` | n/a | yes |
37+
| <a name="input_parameters"></a> [parameters](#input\_parameters) | The parameters to pass to the cloudformation template | `map(string)` | `{}` | no |
38+
| <a name="input_region"></a> [region](#input\_region) | The region to deploy the cloudformation template | `string` | n/a | yes |
39+
| <a name="input_tags"></a> [tags](#input\_tags) | The tags to apply to the cloudformation stack | `map(string)` | n/a | yes |
40+
| <a name="input_template"></a> [template](#input\_template) | The body of the cloudformation template to deploy | `string` | n/a | yes |
41+
42+
## Outputs
43+
44+
| Name | Description |
45+
|------|-------------|
46+
| <a name="output_stack_instance_id"></a> [stack\_instance\_id](#output\_stack\_instance\_id) | The arn for the cloudformation stack instance when deployed to management account |
47+
| <a name="output_stack_set_arn"></a> [stack\_set\_arn](#output\_stack\_set\_arn) | The arn for the cloudformation stack set |
48+
<!-- END_TF_DOCS -->

‎main.tf

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
2+
data "aws_organizations_organization" "current" {}
3+
4+
## Create the default iam boundary used the pipelines
5+
# tfsec:ignore:aws-iam-no-policy-wildcards
6+
resource "aws_cloudformation_stack_set" "boundary" {
7+
name = var.name
8+
capabilities = var.capabilities
9+
description = var.description
10+
parameters = var.parameters
11+
permission_model = "SERVICE_MANAGED"
12+
template_body = var.template
13+
tags = var.tags
14+
15+
operation_preferences {
16+
failure_tolerance_count = 0
17+
max_concurrent_count = var.max_concurrent_count
18+
}
19+
20+
auto_deployment {
21+
enabled = true
22+
retain_stacks_on_account_removal = true
23+
}
24+
}
25+
26+
## Deploy the permissive boundary to the organizational root
27+
resource "aws_cloudformation_stack_set_instance" "root" {
28+
deployment_targets {
29+
organizational_unit_ids = [data.aws_organizations_organization.current.roots[0].id]
30+
}
31+
region = var.region
32+
stack_set_name = aws_cloudformation_stack_set.boundary.name
33+
}
34+
35+
## Deployment of same stacko the management account
36+
resource "aws_cloudformation_stack" "management" {
37+
count = var.enable_management_account ? 1 : 0
38+
39+
capabilities = var.capabilities
40+
name = var.name
41+
on_failure = "ROLLBACK"
42+
parameters = var.parameters
43+
tags = var.tags
44+
template_body = var.template
45+
}

‎outputs.tf

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
output "stack_set_arn" {
2+
description = "The arn for the cloudformation stack set"
3+
value = aws_cloudformation_stack_set.boundary.arn
4+
}
5+
6+
output "stack_instance_id" {
7+
description = "The arn for the cloudformation stack instance when deployed to management account"
8+
value = var.enable_management_account ? aws_cloudformation_stack.management[0].id : null
9+
}
10+
11+

‎variables.tf

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
variable "capabilities" {
2+
description = "The capabilities required to deploy the cloudformation template"
3+
type = list(string)
4+
default = ["CAPABILITY_NAMED_IAM", "CAPABILITY_AUTO_EXPAND", "CAPABILITY_IAM"]
5+
}
6+
7+
variable "description" {
8+
description = "The description of the cloudformation stack"
9+
type = string
10+
}
11+
12+
variable "enable_management_account" {
13+
description = "Enable the deployment to the management account"
14+
type = bool
15+
default = false
16+
}
17+
18+
variable "max_concurrent_count" {
19+
description = "The maximum number of concurrent deployments"
20+
type = number
21+
default = 10
22+
}
23+
24+
variable "name" {
25+
description = "The name of the cloudformation stack"
26+
type = string
27+
}
28+
29+
variable "parameters" {
30+
description = "The parameters to pass to the cloudformation template"
31+
type = map(string)
32+
default = {}
33+
}
34+
35+
variable "region" {
36+
description = "The region to deploy the cloudformation template"
37+
type = string
38+
}
39+
40+
variable "tags" {
41+
description = "The tags to apply to the cloudformation stack"
42+
type = map(string)
43+
}
44+
45+
variable "template" {
46+
description = "The body of the cloudformation template to deploy"
47+
type = string
48+
}
49+

‎versions.tf

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_version = ">= 1.0"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = "~> 5.0"
8+
}
9+
}
10+
}

0 commit comments

Comments
 (0)