Skip to content

Commit c39441e

Browse files
heyvaldemarheyvaldemar
committed
Amazon Route 53 Pipeline with Terraform
0 parents  commit c39441e

16 files changed

+1361
-0
lines changed

‎.github/FUNDING.yml

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
github: heyvaldemar
2+
patreon: heyvaldemar
3+
ko_fi: heyvaldemar
4+
custom: ['paypal.com/paypalme/heyValdemarCOM', 'buymeacoffee.com/heyValdemar', 'ko-fi.com/heyValdemar']

‎.github/dependabot.yml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# To get started with Dependabot version updates, you'll need to specify which
2+
# package ecosystems to update and where the package manifests are located.
3+
# Please see the documentation for all configuration options:
4+
# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
5+
6+
version: 2
7+
updates:
8+
- package-ecosystem: "terraform" # See documentation for possible values
9+
directory: "/" # Location of package manifests
10+
schedule:
11+
interval: "weekly"

‎.github/workflows/00-terraform-drift-detection.yml.example

+173
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
name: 'Terraform Configuration Drift Detection'
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: '41 3 * * *' # runs nightly at 3:41 am
7+
8+
# Special permissions required for OIDC authentication
9+
permissions:
10+
id-token: write
11+
contents: read
12+
issues: write
13+
14+
env:
15+
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
16+
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
17+
AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
18+
19+
jobs:
20+
terraform-plan:
21+
name: 'Terraform Plan'
22+
runs-on: ubuntu-latest
23+
env:
24+
# This is needed since we are running terraform with read-only permissions
25+
ARM_SKIP_PROVIDER_REGISTRATION: true
26+
outputs:
27+
tfplanExitCode: ${{ steps.tf-plan.outputs.exitcode }}
28+
29+
steps:
30+
# Checkout the repository to the GitHub Actions runner
31+
- name: Checkout
32+
uses: actions/checkout@v3
33+
34+
# Install the latest version of the Terraform CLI
35+
- name: Setup Terraform
36+
uses: hashicorp/setup-terraform@v2
37+
with:
38+
terraform_wrapper: false
39+
40+
# Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
41+
- name: Terraform Init
42+
run: terraform init
43+
44+
# Generates an execution plan for Terraform
45+
# An exit code of 0 indicated no changes, 1 a terraform failure, 2 there are pending changes.
46+
- name: Terraform Plan
47+
id: tf-plan
48+
run: |
49+
export exitcode=0
50+
terraform plan -detailed-exitcode -no-color -out tfplan || export exitcode=$?
51+
52+
echo "exitcode=$exitcode" >> $GITHUB_OUTPUT
53+
54+
if [ $exitcode -eq 1 ]; then
55+
echo Terraform Plan Failed!
56+
exit 1
57+
else
58+
exit 0
59+
fi
60+
61+
# Save plan to artifacts
62+
- name: Publish Terraform Plan
63+
uses: actions/upload-artifact@v3
64+
with:
65+
name: tfplan
66+
path: tfplan
67+
68+
# Create string output of Terraform Plan
69+
- name: Create String Output
70+
id: tf-plan-string
71+
run: |
72+
TERRAFORM_PLAN=$(terraform show -no-color tfplan)
73+
74+
delimiter="$(openssl rand -hex 8)"
75+
echo "summary<<${delimiter}" >> $GITHUB_OUTPUT
76+
echo "## Terraform Plan Output" >> $GITHUB_OUTPUT
77+
echo "<details><summary>Click to expand</summary>" >> $GITHUB_OUTPUT
78+
echo "" >> $GITHUB_OUTPUT
79+
echo '```terraform' >> $GITHUB_OUTPUT
80+
echo "$TERRAFORM_PLAN" >> $GITHUB_OUTPUT
81+
echo '```' >> $GITHUB_OUTPUT
82+
echo "</details>" >> $GITHUB_OUTPUT
83+
echo "${delimiter}" >> $GITHUB_OUTPUT
84+
85+
# Publish Terraform Plan as task summary
86+
- name: Publish Terraform Plan to Task Summary
87+
env:
88+
SUMMARY: ${{ steps.tf-plan-string.outputs.summary }}
89+
run: |
90+
echo "$SUMMARY" >> $GITHUB_STEP_SUMMARY
91+
92+
# If changes are detected, create a new issue
93+
- name: Publish Drift Report
94+
if: steps.tf-plan.outputs.exitcode == 2
95+
uses: actions/github-script@v6
96+
env:
97+
SUMMARY: "${{ steps.tf-plan-string.outputs.summary }}"
98+
with:
99+
github-token: ${{ secrets.GITHUB_TOKEN }}
100+
script: |
101+
const body = `${process.env.SUMMARY}`;
102+
const title = 'Terraform Configuration Drift Detected';
103+
const creator = 'github-actions[bot]'
104+
105+
// Look to see if there is an existing drift issue
106+
const issues = await github.rest.issues.listForRepo({
107+
owner: context.repo.owner,
108+
repo: context.repo.repo,
109+
state: 'open',
110+
creator: creator,
111+
title: title
112+
})
113+
114+
if( issues.data.length > 0 ) {
115+
// We assume there shouldn't be more than 1 open issue, since we update any issue we find
116+
const issue = issues.data[0]
117+
118+
if ( issue.body == body ) {
119+
console.log('Drift Detected: Found matching issue with duplicate content')
120+
} else {
121+
console.log('Drift Detected: Found matching issue, updating body')
122+
github.rest.issues.update({
123+
owner: context.repo.owner,
124+
repo: context.repo.repo,
125+
issue_number: issue.number,
126+
body: body
127+
})
128+
}
129+
} else {
130+
console.log('Drift Detected: Creating new issue')
131+
132+
github.rest.issues.create({
133+
owner: context.repo.owner,
134+
repo: context.repo.repo,
135+
title: title,
136+
body: body
137+
})
138+
}
139+
140+
# If changes aren't detected, close any open drift issues
141+
- name: Publish Drift Report
142+
if: steps.tf-plan.outputs.exitcode == 0
143+
uses: actions/github-script@v6
144+
with:
145+
github-token: ${{ secrets.GITHUB_TOKEN }}
146+
script: |
147+
const title = 'Terraform Configuration Drift Detected';
148+
const creator = 'github-actions[bot]'
149+
150+
// Look to see if there is an existing drift issue
151+
const issues = await github.rest.issues.listForRepo({
152+
owner: context.repo.owner,
153+
repo: context.repo.repo,
154+
state: 'open',
155+
creator: creator,
156+
title: title
157+
})
158+
159+
if( issues.data.length > 0 ) {
160+
const issue = issues.data[0]
161+
162+
github.rest.issues.update({
163+
owner: context.repo.owner,
164+
repo: context.repo.repo,
165+
issue_number: issue.number,
166+
state: 'closed'
167+
})
168+
}
169+
170+
# Mark the workflow as failed if drift detected
171+
- name: Error on Failure
172+
if: steps.tf-plan.outputs.exitcode == 2
173+
run: exit 1

‎.github/workflows/01-terraform-unit-tests.yml.example

+97
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
name: 'Terraform Unit Tests'
2+
3+
on:
4+
push:
5+
6+
env:
7+
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
8+
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
9+
AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
10+
11+
jobs:
12+
terraform-validation:
13+
name: 'Terraform Validation'
14+
runs-on: ubuntu-latest
15+
16+
steps:
17+
# Checkout the repository to the GitHub Actions runner
18+
- name: GitHub Actions Repository Checkout
19+
uses: actions/checkout@v3
20+
21+
# Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token
22+
- name: Setup Terraform
23+
uses: hashicorp/setup-terraform@v2
24+
25+
# Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
26+
- name: Terraform Init
27+
run: terraform init -backend=false
28+
29+
# Validate terraform files
30+
- name: Terraform Validate
31+
run: terraform validate
32+
33+
# Checks that all Terraform configuration files adhere to a canonical format
34+
- name: Terraform Format
35+
run: terraform fmt -check -recursive
36+
37+
# Define a job called 'tfsec'
38+
tfsec:
39+
# Give this job a descriptive name
40+
name: 'tfsec'
41+
# This job depends on the 'terraform-validation' job
42+
needs: [terraform-validation]
43+
# This job will run on an ubuntu-latest runner
44+
runs-on: ubuntu-latest
45+
46+
steps:
47+
# Checkout the repository content to the runner
48+
- name: tfsec Repository Checkout
49+
uses: actions/checkout@master
50+
51+
# Run tfsec to check for potential security issues
52+
- name: Run tfsec
53+
uses: aquasecurity/tfsec-action@v1.0.0
54+
55+
# Define a job called 'tflint'
56+
tflint:
57+
name: 'tflint'
58+
needs: [tfsec]
59+
runs-on: ${{ matrix.os }}
60+
61+
# Define the matrix of OSs to test on
62+
strategy:
63+
matrix:
64+
os: [ubuntu-latest, macos-latest, windows-latest]
65+
66+
steps:
67+
# Checkout the repository content to the runner
68+
- name: Checkout source code
69+
uses: actions/checkout@v3
70+
71+
# Caches a directory
72+
- name: Cache plugin dir
73+
uses: actions/cache@v3
74+
with:
75+
# Path to the directory to cache
76+
path: ~/.tflint.d/plugins
77+
# Key to use for caching
78+
key: ${{ matrix.os }}-tflint-${{ hashFiles('.tflint.hcl') }}
79+
80+
# Sets up TFLint
81+
- name: Setup TFLint
82+
uses: terraform-linters/setup-tflint@v3
83+
with:
84+
# Version of TFLint to set up
85+
tflint_version: v0.38.1
86+
87+
# Display the version of TFLint
88+
- name: Show version
89+
run: tflint --version
90+
91+
# Initialize TFLint
92+
- name: Init TFLint
93+
run: tflint --init
94+
95+
# Run TFLint in compact mode
96+
- name: Run TFLint
97+
run: tflint -f compact

0 commit comments

Comments
 (0)