Skip to content

Commit a7eae19

Browse files
ZordrakZordrak
authored
Merge pull request #32 from tfutils/release_1.6.1
Update v1.6.1
2 parents 13addcf + e115020 commit a7eae19

15 files changed

+459
-191
lines changed

‎CHANGELOG.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,22 @@
1+
## 1.6.1 (24/05/2021)
2+
3+
FEATURES:
4+
5+
* Added `-d/--detailed-exitcode` to propagate terraform exit codes to shell
6+
* Added `-n/--no-color` appends -co-color to all tf calls
7+
* Added `-w/--compact-warnings` appends -compact-warnings to all terraform calls
8+
9+
BUG FIXES:
10+
11+
* Getopt fixes
12+
* Various small fixes
13+
14+
NOTES:
15+
16+
* Support for early versions of terraform has been dropped (<0.11)
17+
* Default backend bucket name has changed, pass in -b to overwrite
18+
* Scaffold bootstrap updated
19+
120
## 1.4.3 (16/12/2019)
221

322
* Remove extraneous eval from secret parsing

‎README.md‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -105,14 +105,17 @@ The terraformscaffold script is invoked as bin/terraform.sh. Once a state bucket
105105

106106
```bash
107107
bin/terraform.sh \
108-
-a/--action `action` \
109-
-b/--bucket-prefix `bucket_prefix` \
110-
-c/--component `component_name` \
111-
-e/--environment `environment` \
112-
-g/--group `group` (optional) \
113-
-i/--build-id `build_id` (optional) \
114-
-p/--project `project` \
115-
-r/--region `region` \
108+
-a/--action `action` \
109+
-b/--bucket-prefix `bucket_prefix` \
110+
-c/--component `component_name` \
111+
-e/--environment `environment` \
112+
-g/--group `group` (optional) \
113+
-i/--build-id `build_id` (optional) \
114+
-p/--project `project` \
115+
-r/--region `region` \
116+
-d/--detailed-exitcode (optional) \
117+
-n/--no-color (optional) \
118+
-w/--compact-warnings (optional) \
116119
-- \
117120
<additional arguments to forward to the terraform binary call>
118121
```
@@ -133,4 +136,7 @@ Where:
133136
* `group` (optional): The name of the group to which the environment belongs, permitting the use of a group tfvars file as a "meta-environment" shared by more than one environment
134137
* `project`: The name of the project being deployed, as per the default bucket-prefix and state file keyspace
135138
* `region` (optional): The AWS region name unique to all components and terraform processes. Defaults to the value of the _AWS_DEFAULT_REGION_ environment variable.
139+
* `detailed-exitcode` (optional): Passes detailed exit code flag to terraform.
140+
* `no-color` (optional): Passes no-color flag to terraform.
141+
* `compact-warnings` (optional): Passes compact-warnings flag to terraform.
136142
* `additional arguments`: Any arguments provided after "--" will be passed directly to terraform as its own arguments, e.g. allowing the provision of a 'target=value' parameter.

‎bin/terraform.sh‎

Lines changed: 202 additions & 157 deletions
Large diffs are not rendered by default.

‎bootstrap/.terraform-version‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
latest:^0.11
1+
0.14.7

‎bootstrap/data_iam_policy_document_bucket.tf‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
data "aws_iam_policy_document" "bucket" {
2+
statement {
3+
sid = "DontAllowNonSecureConnection"
4+
effect = "Deny"
5+
6+
actions = [
7+
"s3:*",
8+
]
9+
10+
resources = [
11+
aws_s3_bucket.bucket.arn,
12+
"${aws_s3_bucket.bucket.arn}/*",
13+
]
14+
15+
principals {
16+
type = "AWS"
17+
18+
identifiers = [
19+
"*",
20+
]
21+
}
22+
23+
condition {
24+
test = "Bool"
25+
variable = "aws:SecureTransport"
26+
27+
values = [
28+
"false",
29+
]
30+
}
31+
}
32+
33+
statement {
34+
sid = "AllowManagedAccountsToList"
35+
effect = "Allow"
36+
37+
actions = [
38+
"s3:ListBucket",
39+
]
40+
41+
resources = [
42+
aws_s3_bucket.bucket.arn,
43+
]
44+
45+
principals {
46+
type = "AWS"
47+
identifiers = local.ro_principals
48+
}
49+
}
50+
51+
statement {
52+
sid = "AllowManagedAccountsToGet"
53+
effect = "Allow"
54+
55+
actions = [
56+
"s3:GetObject",
57+
]
58+
59+
resources = [
60+
"${aws_s3_bucket.bucket.arn}/*",
61+
]
62+
63+
principals {
64+
type = "AWS"
65+
identifiers = local.ro_principals
66+
}
67+
}
68+
}

‎bootstrap/data_iam_policy_document_kms_key_s3.tf‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
data "aws_iam_policy_document" "kms_key_s3" {
2+
statement {
3+
sid = "AllowLocalIAMAdministration"
4+
effect = "Allow"
5+
6+
actions = [
7+
"*",
8+
]
9+
10+
resources = [
11+
"*",
12+
]
13+
14+
principals {
15+
type = "AWS"
16+
identifiers = [
17+
"arn:aws:iam::${var.aws_account_id}:root",
18+
]
19+
}
20+
}
21+
22+
statement {
23+
sid = "AllowManagedAccountsToUse"
24+
effect = "Allow"
25+
26+
actions = [
27+
"kms:Decrypt",
28+
"kms:DescribeKey",
29+
"kms:Encrypt",
30+
"kms:GenerateDataKey",
31+
"kms:GenerateDataKeyPair",
32+
"kms:GenerateDataKeyPairWithoutPlaintext",
33+
"kms:GenerateDataKeyWithoutPlaintext",
34+
"kms:ReEncrypt",
35+
]
36+
37+
resources = [
38+
"*",
39+
]
40+
41+
principals {
42+
type = "AWS"
43+
identifiers = local.ro_principals
44+
}
45+
}
46+
}

‎bootstrap/kms_key_s3.tf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
resource "aws_kms_key" "s3" {
2+
description = "tfscaffold Bootstrap S3 Bucket"
3+
deletion_window_in_days = 10
4+
enable_key_rotation = true
5+
6+
policy = data.aws_iam_policy_document.kms_key_s3.json
7+
8+
# This does not use default tag map merging because bootstrapping is special
9+
# You should use default tag map merging elsewhere
10+
tags = {
11+
Name = "tfscaffold Bootstrap S3 Bucket"
12+
Environment = var.environment
13+
Project = var.project
14+
Component = var.component
15+
Account = var.aws_account_id
16+
}
17+
}

‎bootstrap/locals.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
locals {
2+
ro_principals = compact(distinct(flatten([
3+
var.tfscaffold_ro_principals,
4+
"arn:aws:iam::${var.aws_account_id}:root",
5+
])))
6+
}

‎bootstrap/outputs.tf‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,23 @@
1+
output "bucket_arn" {
2+
value = aws_s3_bucket.bucket.arn
3+
}
4+
15
output "bucket_name" {
2-
value = "${aws_s3_bucket.bucket.id}"
6+
value = aws_s3_bucket.bucket.id
7+
}
8+
9+
output "bucket_policy" {
10+
value = data.aws_iam_policy_document.bucket.json
11+
}
12+
13+
output "kms_key_arn" {
14+
value = aws_kms_key.s3.arn
15+
}
16+
17+
output "kms_key_id" {
18+
value = aws_kms_key.s3.id
19+
}
20+
21+
output "kms_key_policy" {
22+
value = data.aws_iam_policy_document.kms_key_s3.json
323
}

‎bootstrap/provider_aws.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
# The default AWS provider in the default region
22
provider "aws" {
3-
region = "${var.region}"
3+
region = var.region
44

55
# For no reason other than redundant safety
66
# we only allow the use of the AWS Account
77
# specified in the environment variables.
88
# This helps to prevent accidents.
99
allowed_account_ids = [
10-
"${var.aws_account_id}",
10+
var.aws_account_id,
1111
]
1212
}

0 commit comments

Comments
 (0)