Michael Freno
7b925c89bd
- P2: Replace wget with curl for ECS health check (Alpine lacks wget) - P2: Add AWS credentials step to CI terraform-plan job for S3 backend auth - P3: Remove unused GitHub provider from infra/main.tf Co-Authored-By: Paperclip <noreply@paperclip.ing>
146 lines
3.1 KiB
HCL
146 lines
3.1 KiB
HCL
variable "environment" {
|
|
description = "Deployment environment"
|
|
type = string
|
|
}
|
|
|
|
variable "project_name" {
|
|
description = "Project name"
|
|
type = string
|
|
}
|
|
|
|
resource "aws_s3_bucket" "terraform_state" {
|
|
bucket = "${var.project_name}-${var.environment}-terraform-state"
|
|
|
|
tags = {
|
|
Name = "${var.project_name}-${var.environment}-terraform-state"
|
|
}
|
|
}
|
|
|
|
resource "aws_s3_bucket_public_access_block" "terraform_state" {
|
|
bucket = aws_s3_bucket.terraform_state.id
|
|
|
|
block_public_acls = true
|
|
block_public_policy = true
|
|
ignore_public_acls = true
|
|
restrict_public_buckets = true
|
|
}
|
|
|
|
resource "aws_s3_bucket_versioning" "terraform_state" {
|
|
bucket = aws_s3_bucket.terraform_state.id
|
|
versioning_configuration {
|
|
status = "Enabled"
|
|
}
|
|
}
|
|
|
|
resource "aws_s3_bucket_server_side_encryption_configuration" "terraform_state" {
|
|
bucket = aws_s3_bucket.terraform_state.id
|
|
|
|
rule {
|
|
apply_server_side_encryption_by_default {
|
|
sse_algorithm = "aws:kms"
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "aws_s3_bucket_lifecycle_configuration" "terraform_state" {
|
|
bucket = aws_s3_bucket.terraform_state.id
|
|
|
|
rule {
|
|
id = "expire-noncurrent"
|
|
status = "Enabled"
|
|
|
|
noncurrent_version_expiration {
|
|
noncurrent_days = 30
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "aws_s3_bucket" "artifacts" {
|
|
bucket = "${var.project_name}-${var.environment}-artifacts"
|
|
|
|
tags = {
|
|
Name = "${var.project_name}-${var.environment}-artifacts"
|
|
}
|
|
}
|
|
|
|
resource "aws_s3_bucket_public_access_block" "artifacts" {
|
|
bucket = aws_s3_bucket.artifacts.id
|
|
|
|
block_public_acls = true
|
|
block_public_policy = true
|
|
ignore_public_acls = true
|
|
restrict_public_buckets = true
|
|
}
|
|
|
|
resource "aws_s3_bucket_versioning" "artifacts" {
|
|
bucket = aws_s3_bucket.artifacts.id
|
|
versioning_configuration {
|
|
status = "Enabled"
|
|
}
|
|
}
|
|
|
|
resource "aws_s3_bucket_server_side_encryption_configuration" "artifacts" {
|
|
bucket = aws_s3_bucket.artifacts.id
|
|
|
|
rule {
|
|
apply_server_side_encryption_by_default {
|
|
sse_algorithm = "aws:kms"
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "aws_s3_bucket" "logs" {
|
|
bucket = "${var.project_name}-${var.environment}-logs"
|
|
|
|
tags = {
|
|
Name = "${var.project_name}-${var.environment}-logs"
|
|
}
|
|
}
|
|
|
|
resource "aws_s3_bucket_public_access_block" "logs" {
|
|
bucket = aws_s3_bucket.logs.id
|
|
|
|
block_public_acls = true
|
|
block_public_policy = true
|
|
ignore_public_acls = true
|
|
restrict_public_buckets = true
|
|
}
|
|
|
|
resource "aws_s3_bucket_server_side_encryption_configuration" "logs" {
|
|
bucket = aws_s3_bucket.logs.id
|
|
|
|
rule {
|
|
apply_server_side_encryption_by_default {
|
|
sse_algorithm = "aws:kms"
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "aws_s3_bucket_lifecycle_configuration" "logs" {
|
|
bucket = aws_s3_bucket.logs.id
|
|
|
|
rule {
|
|
id = "expire-old-logs"
|
|
status = "Enabled"
|
|
|
|
expiration {
|
|
days = 90
|
|
}
|
|
}
|
|
}
|
|
|
|
output "bucket_name" {
|
|
description = "Terraform state S3 bucket name"
|
|
value = aws_s3_bucket.terraform_state.id
|
|
}
|
|
|
|
output "artifacts_bucket_name" {
|
|
description = "Artifacts S3 bucket name"
|
|
value = aws_s3_bucket.artifacts.id
|
|
}
|
|
|
|
output "logs_bucket_name" {
|
|
description = "Logs S3 bucket name"
|
|
value = aws_s3_bucket.logs.id
|
|
}
|