Template useful to create a AWS infrastructures with terraform
- Create your github repository starting form this template.
- Configure your aws cli and set the credentials. Also refer the confluence page to work with AWS SSO.
- The ./src/init directory contains the terraform code to setup the S3 backend, the Dynamodb lock table, github openid connection and the iam role to use in the github actions
- The ./src/main directory cointains the terraform code to setup the core infrastructure.
- The .github/workflows directory contains two yaml files to run a terraform plan and apply actions. They need a github environment secret to be created: IAM_ROLE (see below.)
The following tools are required to setup the project locally.
Create:
- The s3 bucket to store terraform state
- The Dynamodb table to manage terraform locks
- The Github OpenId connection
# init uat environment
cd src/init
./terraform.sh init uat
./terraform.sh apply uat
# create uat environment
cd ../../
cd src/main
./terraform.sh init uat
./terraform.sh apply uatIn the repository two github actions are already provided:
-
terraform-plan: it runs every time new code is pushed in every branch excluded main and master. It runs terraform plan through all the environments in parallel.
-
terraform-apply: it runs terraform apply in all the environments once a PR is merged with main.
- The apply in PROD should require an approval: it depends on the Environment protection rules.
- It can also be triggerd manually in all the environment expect main.
- Create github environment for every environments:dev, uat, prod, and prod_w.
- prod_w is like prod but it is meant to be used only in the apply action in production.
- In each environment create a secret named IAM_ROLE and set its value with the arn of the role created at the very beginnig (init).
- Within prod_w set two Environment protection rules as shown in the screenshot below:
New releases are created every time PR are merged with main. A github action is responsible to create the release and it relires on the title of the PR as described in the official repository