[PLT-890] add legacy variable to tfstate service and create backends (#212)

juliareynolds-nava · gfreeman-navapbc · gsf · web-flow · commit af97746b3b57 · 2025-04-17T11:39:30.000-06:00
## 🎫 Ticket https://jira.cms.gov/browse/PLT-890 ## 🛠 Changes backend files defining s3 state buckets for greenfield apps ## ℹ️ Context  Add backends to the TF in the platform repo (each backend is a 2-line file for each of the vpcs). We expect to have 12 new VPCs. ## 🧪 Validation Buckets are created in S3 with tfstate files for each new backend definition file. --------- Co-authored-by: Grant Freeman <129095098+gfreeman-navapbc@users.noreply.github.com> Co-authored-by: Sean Fern <seanfern@navapbc.com>
diff --git a/terraform/.terraform-version b/terraform/.terraform-version
@@ -1 +1 @@
-1.5.5
+1.10.5
diff --git a/terraform/backends/ab2d-dev-gf.s3.tfbackend b/terraform/backends/ab2d-dev-gf.s3.tfbackend
@@ -0,0 +1,2 @@
+bucket       = "ab2d-dev-tfstate-20250417141439646700000001"
+use_lockfile = true
diff --git a/terraform/backends/ab2d-prod-gf.s3.tfbackend b/terraform/backends/ab2d-prod-gf.s3.tfbackend
@@ -0,0 +1,2 @@
+bucket       = "ab2d-prod-tfstate-20250411202936776600000001"
+use_lockfile = true
diff --git a/terraform/backends/ab2d-sandbox-gf.s3.tfbackend b/terraform/backends/ab2d-sandbox-gf.s3.tfbackend
@@ -0,0 +1,2 @@
+bucket       = "ab2d-sandbox-tfstate-20250416200059224300000001"
+use_lockfile = true
diff --git a/terraform/backends/ab2d-test-gf.s3.tfbackend b/terraform/backends/ab2d-test-gf.s3.tfbackend
@@ -0,0 +1,2 @@
+bucket       = "ab2d-test-tfstate-20250410134820763500000001"
+use_lockfile = true
diff --git a/terraform/backends/bcda-dev-gf.s3.tfbackend b/terraform/backends/bcda-dev-gf.s3.tfbackend
@@ -0,0 +1,2 @@
+bucket       = "bcda-dev-tfstate-20250409202710600700000001"
+use_lockfile = true
diff --git a/terraform/backends/bcda-prod-gf.s3.tfbackend b/terraform/backends/bcda-prod-gf.s3.tfbackend
@@ -0,0 +1,2 @@
+bucket       = "bcda-prod-tfstate-20250411203841436200000001"
+use_lockfile = true
diff --git a/terraform/backends/bcda-sandbox-gf.s3.tfbackend b/terraform/backends/bcda-sandbox-gf.s3.tfbackend
@@ -0,0 +1,2 @@
+bucket       = "bcda-sandbox-tfstate-20250416201512973800000001"
+use_lockfile = true
diff --git a/terraform/backends/bcda-test-gf.s3.tfbackend b/terraform/backends/bcda-test-gf.s3.tfbackend
@@ -0,0 +1,2 @@
+bucket       = "bcda-test-tfstate-20250409171646342600000001"
+use_lockfile = true
diff --git a/terraform/backends/cdap-mgmt-gf.s3.tfbackend b/terraform/backends/cdap-mgmt-gf.s3.tfbackend
@@ -0,0 +1,2 @@
+bucket       = "cdap-mgmt-tfstate-20250416203557378600000001"
+use_lockfile = true
diff --git a/terraform/backends/dpc-dev-gf.s3.tfbackend b/terraform/backends/dpc-dev-gf.s3.tfbackend
@@ -0,0 +1,2 @@
+bucket       = "dpc-dev-tfstate-20250409165915907400000001"
+use_lockfile = true
diff --git a/terraform/backends/dpc-prod-gf.s3.tfbackend b/terraform/backends/dpc-prod-gf.s3.tfbackend
@@ -0,0 +1,2 @@
+bucket       = "dpc-prod-tfstate-20250411204900543700000001"
+use_lockfile = true
diff --git a/terraform/backends/dpc-sandbox-gf.s3.tfbackend b/terraform/backends/dpc-sandbox-gf.s3.tfbackend
@@ -0,0 +1,2 @@
+bucket       = "dpc-sandbox-tfstate-20250416202240532700000001"
+use_lockfile = true
diff --git a/terraform/backends/dpc-test-gf.s3.tfbackend b/terraform/backends/dpc-test-gf.s3.tfbackend
@@ -0,0 +1,2 @@
+bucket       = "dpc-test-tfstate-20250410145524530000000001"
+use_lockfile = true
diff --git a/terraform/modules/bucket/main.tf b/terraform/modules/bucket/main.tf
@@ -9,7 +9,7 @@ module "bucket_key" {
 
 resource "aws_s3_bucket" "this" {
   bucket        = var.legacy == true ? var.name : null
-  bucket_prefix = var.legacy == false ? var.name : null
+  bucket_prefix = var.legacy == false ? "${var.name}-" : null
   force_destroy = true
 }
 
@@ -88,9 +88,15 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
     }
   }
 }
+
+data "aws_iam_account_alias" "current" {}
+
 data "aws_s3_bucket" "bucket_access_logs" {
-  bucket = "${data.aws_caller_identity.current.account_id}-bucket-access-logs"
+  bucket = (var.legacy == true ? "${data.aws_caller_identity.current.account_id}-bucket-access-logs" :
+    data.aws_iam_account_alias.current.account_alias == "aws-cms-oeda-bcda-prod" ? "bucket-access-logs-20250411172631068600000001" :
+      "bucket-access-logs-20250409172631068600000001")
 }
+
 resource "aws_s3_bucket_logging" "this" {
   bucket = aws_s3_bucket.this.id
 
diff --git a/terraform/modules/bucket/versions.tf b/terraform/modules/bucket/versions.tf
@@ -4,5 +4,4 @@ terraform {
       source = "hashicorp/aws"
     }
   }
-  required_version = "~> 1.5.5"
 }
diff --git a/terraform/modules/function/versions.tf b/terraform/modules/function/versions.tf
@@ -5,5 +5,4 @@ terraform {
       version = "~> 5.8.0"
     }
   }
-  required_version = "~> 1.5.5"
 }
diff --git a/terraform/modules/queue/versions.tf b/terraform/modules/queue/versions.tf
@@ -5,5 +5,4 @@ terraform {
       version = "~> 5.8.0"
     }
   }
-  required_version = "~> 1.5.5"
 }
diff --git a/terraform/services/bucket-access-logs/main.tf b/terraform/services/bucket-access-logs/main.tf
@@ -1,7 +1,8 @@
 data "aws_caller_identity" "current" {}
 
 resource "aws_s3_bucket" "bucket_access_logs" {
-  bucket        = "${data.aws_caller_identity.current.account_id}-bucket-access-logs"
+  bucket        = var.legacy == true ? "${data.aws_caller_identity.current.account_id}-bucket-access-logs" : null
+  bucket_prefix = var.legacy == false ? "bucket-access-logs-" : null
   force_destroy = true
 }
 
diff --git a/terraform/services/bucket-access-logs/variables.tf b/terraform/services/bucket-access-logs/variables.tf
@@ -0,0 +1,5 @@
+variable "legacy" {
+  description = "Is this deployment in the greenfield environment (false)?"
+  type        = bool
+  default     = true
+}
diff --git a/terraform/services/github-actions-runner/lambdas-download/versions.tf b/terraform/services/github-actions-runner/lambdas-download/versions.tf
diff --git a/terraform/services/github-actions-runner/versions.tf b/terraform/services/github-actions-runner/versions.tf
@@ -13,5 +13,4 @@ terraform {
   backend "s3" {
     key = "github-actions/terraform.tfstate"
   }
-  required_version = "~> 1.5.5"
 }
diff --git a/terraform/services/tfstate/.terraform.lock.hcl b/terraform/services/tfstate/.terraform.lock.hcl
diff --git a/terraform/services/tfstate/README.md b/terraform/services/tfstate/README.md
@@ -1,6 +1,6 @@
 # Terraform for initializing tfstate resources
 
-This terraform creates the S3 buckets and DynamoDB table for storing terraform state in AWS.
+This terraform creates the S3 buckets for storing terraform state in AWS.
 
 To create the resources with the first run of `terraform init`, comment out the backend block in terraform.tf. This will create a local terraform.tfstate file.
 
diff --git a/terraform/services/tfstate/main.tf b/terraform/services/tfstate/main.tf
@@ -11,4 +11,10 @@ module "tfstate_bucket" {
 module "tfstate_table" {
   source = "../../modules/table"
   name   = local.name
+  count  = var.legacy == true ? 1 : 0
+}
+
+moved {
+  from = module.tfstate_table
+  to   = module.tfstate_table[0]
 }
diff --git a/terraform/services/tfstate/outputs.tf b/terraform/services/tfstate/outputs.tf
diff --git a/terraform/services/tfstate/variables.tf b/terraform/services/tfstate/variables.tf
@@ -1,18 +1,18 @@
 variable "app" {
-  description = "The application name (ab2d, bcda, dpc)"
+  description = "The application name (ab2d, bcda, dpc, cdap)"
   type        = string
   validation {
-    condition     = contains(["ab2d", "bcda", "dpc"], var.app)
-    error_message = "Valid value for app is ab2d, bcda, or dpc."
+    condition     = contains(["ab2d", "bcda", "dpc", "cdap"], var.app)
+    error_message = "Valid value for app is ab2d, bcda, dpc, or cdap."
   }
 }
 
 variable "env" {
-  description = "The application environment (dev, test, sbx, prod, mgmt)"
+  description = "The application environment (dev, test, sbx, sandbox, prod, mgmt)"
   type        = string
   validation {
-    condition     = contains(["dev", "test", "sbx", "prod", "mgmt"], var.env)
-    error_message = "Valid value for env is dev, test, sbx, prod, or mgmt."
+    condition     = contains(["dev", "test", "sbx", "sandbox", "prod", "mgmt"], var.env)
+    error_message = "Valid value for env is dev, test, sbx, sandbox, prod, or mgmt."
   }
 }
 

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+bucket = "ab2d-dev-tfstate-20250417141439646700000001"`
	`2`	`+use_lockfile = true`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+bucket = "ab2d-prod-tfstate-20250411202936776600000001"`
	`2`	`+use_lockfile = true`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+bucket = "ab2d-sandbox-tfstate-20250416200059224300000001"`
	`2`	`+use_lockfile = true`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+bucket = "ab2d-test-tfstate-20250410134820763500000001"`
	`2`	`+use_lockfile = true`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+bucket = "bcda-dev-tfstate-20250409202710600700000001"`
	`2`	`+use_lockfile = true`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+bucket = "bcda-prod-tfstate-20250411203841436200000001"`
	`2`	`+use_lockfile = true`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+bucket = "bcda-sandbox-tfstate-20250416201512973800000001"`
	`2`	`+use_lockfile = true`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+bucket = "bcda-test-tfstate-20250409171646342600000001"`
	`2`	`+use_lockfile = true`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+bucket = "cdap-mgmt-tfstate-20250416203557378600000001"`
	`2`	`+use_lockfile = true`