Skip to content

Commit 83f1ebb

Browse files
eddalmond1eddalmond1
authored
Merge branch 'main' into dependabot/npm_and_yarn/openapitools/openapi-generator-cli-2.19.1
2 parents 9001c81 + e2827b7 commit 83f1ebb

File tree

18 files changed

+478
-1
lines changed

18 files changed

+478
-1
lines changed

‎.tool-versions‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# This file is for you! Please, updated to the versions agreed by your team.
22

3-
terraform 1.7.0
3+
terraform 1.11.1
44
pre-commit 3.6.0
55
vale 3.6.0
66
poetry 2.1.1

‎infrastructure/Makefile‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
###################
2+
## Utilities ##
3+
###################
4+
guard-%:
5+
@ if [ "${${*}}" = "" ]; then \
6+
echo "Variable $* not set"; \
7+
exit 1; \
8+
fi
9+
10+
###################
11+
#### Terraform ####
12+
###################
13+
14+
# Initializes the Terraform configuration for the specified stack and environment.
15+
terraform-init: guard-env guard-stack
16+
rm -rf ./stacks/$(stack)/.terraform
17+
terraform -chdir=./stacks/$(stack) init -var-file=stacks/_shared/tfvars/$(env).tfvars -backend-config=backends/$(env).$(stack).tfbackend -upgrade
18+
terraform -chdir=./stacks/$(stack) get -update
19+
20+
# Selects or creates a Terraform workspace for the specified stack and environment.
21+
terraform-workspace: guard-env guard-stack guard-workspace
22+
terraform -chdir=./stacks/$(stack) workspace select $(workspace) || \
23+
terraform -chdir=./stacks/$(stack) workspace new $(workspace)
24+
25+
terraform -chdir=./stacks/$(stack) workspace show
26+
27+
# Lists all Terraform workspaces for the specified stack and environment.
28+
terraform-workspace-list: guard-env guard-stack terraform-init
29+
terraform -chdir=./stacks/$(stack) workspace list
30+
31+
# Deletes a specified Terraform workspace for the stack, switching to the default workspace first.
32+
terraform-workspace-delete: guard-env guard-stack
33+
terraform -chdir=./stacks/$(stack) workspace select default
34+
terraform -chdir=./stacks/$(stack) workspace delete $(workspace)
35+
36+
# Runs a specified Terraform command (e.g., plan, apply) for the stack and environment.
37+
terraform: guard-env guard-stack guard-tf-command terraform-init terraform-workspace
38+
terraform -chdir=./stacks/$(stack) $(tf-command) -var-file=../_shared/tfvars/$(env).tfvars $(args) --parallelism=30
39+
rm -f ./terraform_outputs_$(stack).json || true
40+
terraform -chdir=./stacks/$(stack) output -json > ./build/terraform_outputs_$(stack).json
41+
42+
###################
43+
#### Bootstrap ####
44+
###################
45+
46+
# Initializes the Terraform configuration for the bootstrap stack.
47+
bootstrap-terraform-init: guard-env
48+
terraform -chdir=./stacks/bootstrap init -var-file=stacks/_shared/tfvars/$(env).tfvars -upgrade
49+
terraform -chdir=./stacks/bootstrap get -update
50+
51+
# Runs a specified Terraform command (e.g., plan, apply) for the bootstrap stack.
52+
bootstrap-terraform: guard-env guard-tf-command bootstrap-terraform-init
53+
terraform -chdir=./stacks/bootstrap $(tf-command) -var-file=../_shared/tfvars/$(env).tfvars $(args)

‎infrastructure/modules/_shared/default_variables.tf‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# tflint-ignore: terraform_unused_declarations
2+
variable "project_name" {
3+
default = "eligibility-signposting-api"
4+
type = string
5+
}
6+
7+
# tflint-ignore: terraform_unused_declarations
8+
variable "environment" {
9+
description = "The purpose of the account dev/test/ref/prod or the workspace"
10+
type = string
11+
}
12+
13+
# tflint-ignore: terraform_unused_declarations
14+
variable "tags" {
15+
description = "A map of tags to assign to resources."
16+
type = map(string)
17+
default = {}
18+
}

‎infrastructure/modules/bootstrap/tfstate/default_variables.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../_shared/default_variables.tf

‎infrastructure/modules/bootstrap/tfstate/kms.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
resource "aws_kms_key" "terraform_state_bucket_cmk" {
2+
description = "Terraform State Bucket Master Key"
3+
deletion_window_in_days = 14
4+
is_enabled = true
5+
enable_key_rotation = true
6+
tags = var.tags
7+
}
8+
9+
resource "aws_kms_alias" "terraform_state_bucket_cmk" {
10+
name = "alias/${var.project_name}-tfstate_bucket_cmk"
11+
target_key_id = aws_kms_key.terraform_state_bucket_cmk.key_id
12+
}

‎infrastructure/modules/bootstrap/tfstate/providers.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_version = ">= 1.11.1"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = "~> 5.6, != 5.71.0"
8+
}
9+
}
10+
}

‎infrastructure/modules/bootstrap/tfstate/s3.tf‎

Lines changed: 174 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,174 @@
1+
# Main state bucket
2+
resource "aws_s3_bucket" "tfstate_bucket" {
3+
bucket = "${var.project_name}-${var.environment}-tfstate"
4+
tags = {
5+
Stack = "Bootstrap"
6+
}
7+
}
8+
9+
# Enable versioning for disaster recovery
10+
resource "aws_s3_bucket_versioning" "tfstate_bucket_versioning_config" {
11+
bucket = aws_s3_bucket.tfstate_bucket.id
12+
versioning_configuration {
13+
status = "Enabled"
14+
}
15+
}
16+
# Block public access to the bucket
17+
resource "aws_s3_bucket_public_access_block" "tfstate" {
18+
bucket = aws_s3_bucket.tfstate_bucket.id
19+
20+
block_public_acls = true
21+
block_public_policy = true
22+
ignore_public_acls = true
23+
restrict_public_buckets = true
24+
}
25+
26+
# Encrypt the bucket with a KMS key
27+
resource "aws_s3_bucket_server_side_encryption_configuration" "tfstate_bucket_server_side_encryption_config" {
28+
bucket = aws_s3_bucket.tfstate_bucket.id
29+
30+
rule {
31+
apply_server_side_encryption_by_default {
32+
kms_master_key_id = aws_kms_key.terraform_state_bucket_cmk.arn
33+
sse_algorithm = "aws:kms"
34+
}
35+
bucket_key_enabled = true
36+
}
37+
}
38+
39+
resource "aws_s3_bucket_policy" "tfstate_bucket" {
40+
bucket = aws_s3_bucket.tfstate_bucket.id
41+
policy = data.aws_iam_policy_document.tfstate_s3_bucket_policy.json
42+
}
43+
44+
data "aws_iam_policy_document" "tfstate_s3_bucket_policy" {
45+
statement {
46+
sid = "AllowSslRequestsOnly"
47+
actions = [
48+
"s3:*",
49+
]
50+
effect = "Deny"
51+
resources = [
52+
aws_s3_bucket.tfstate_bucket.arn,
53+
"${aws_s3_bucket.tfstate_bucket.arn}/*",
54+
]
55+
principals {
56+
type = "*"
57+
identifiers = ["*"]
58+
}
59+
condition {
60+
test = "Bool"
61+
values = [
62+
"false",
63+
]
64+
65+
variable = "aws:SecureTransport"
66+
}
67+
}
68+
}
69+
70+
resource "aws_s3_bucket_lifecycle_configuration" "tfstate_bucket" {
71+
bucket = aws_s3_bucket.tfstate_bucket.id
72+
73+
rule {
74+
id = "TfStateBucketExpirationTransferToIa"
75+
status = "Enabled"
76+
filter {
77+
prefix = ""
78+
}
79+
80+
expiration {
81+
days = 90
82+
}
83+
84+
noncurrent_version_transition {
85+
noncurrent_days = 30
86+
storage_class = "STANDARD_IA"
87+
}
88+
89+
abort_incomplete_multipart_upload {
90+
days_after_initiation = 7
91+
}
92+
}
93+
}
94+
95+
# Logging
96+
97+
resource "aws_s3_bucket" "tfstate_s3_access_logs" {
98+
bucket = "${var.project_name}-${var.environment}-tfstate-access-logs"
99+
}
100+
101+
resource "aws_s3_bucket_logging" "s3_logging_config" {
102+
bucket = aws_s3_bucket.tfstate_bucket.id
103+
target_bucket = aws_s3_bucket.tfstate_s3_access_logs.bucket
104+
target_prefix = "bucket_logs/"
105+
}
106+
107+
resource "aws_s3_bucket_server_side_encryption_configuration" "tfstate_s3_access_logs_server_side_encryption_config" {
108+
bucket = aws_s3_bucket.tfstate_s3_access_logs.id
109+
110+
rule {
111+
apply_server_side_encryption_by_default {
112+
sse_algorithm = "AES256"
113+
}
114+
}
115+
}
116+
117+
resource "aws_s3_bucket_lifecycle_configuration" "tfstate_s3_access_logs_object_expiry_lifecycle_rule_config" {
118+
bucket = aws_s3_bucket.tfstate_s3_access_logs.id
119+
120+
rule {
121+
id = "StateBucketLogsExpiration"
122+
status = "Enabled"
123+
filter {
124+
prefix = ""
125+
}
126+
expiration {
127+
days = var.log_retention_in_days
128+
}
129+
130+
noncurrent_version_expiration {
131+
noncurrent_days = var.log_retention_in_days
132+
}
133+
}
134+
}
135+
136+
resource "aws_s3_bucket_public_access_block" "s3logs" {
137+
bucket = aws_s3_bucket.tfstate_s3_access_logs.id
138+
139+
block_public_acls = true
140+
block_public_policy = true
141+
ignore_public_acls = true
142+
restrict_public_buckets = true
143+
}
144+
145+
resource "aws_s3_bucket_policy" "tfstate_s3_access_logs_bucket_policy" {
146+
bucket = aws_s3_bucket.tfstate_s3_access_logs.id
147+
policy = data.aws_iam_policy_document.tfstate_s3_access_logs_bucket_policy.json
148+
}
149+
150+
data "aws_iam_policy_document" "tfstate_s3_access_logs_bucket_policy" {
151+
statement {
152+
sid = "AllowSSLRequestsOnly"
153+
actions = [
154+
"s3:*",
155+
]
156+
effect = "Deny"
157+
resources = [
158+
aws_s3_bucket.tfstate_s3_access_logs.arn,
159+
"${aws_s3_bucket.tfstate_s3_access_logs.arn}/*",
160+
]
161+
principals {
162+
type = "*"
163+
identifiers = ["*"]
164+
}
165+
condition {
166+
test = "Bool"
167+
values = [
168+
"false",
169+
]
170+
171+
variable = "aws:SecureTransport"
172+
}
173+
}
174+
}

‎infrastructure/modules/bootstrap/tfstate/variables.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# tflint-ignore: terraform_unused_declarations
2+
variable "log_retention_in_days" {
3+
default = 5
4+
type = number
5+
}

‎infrastructure/stacks/_shared/default_variables.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# tflint-ignore: terraform_unused_declarations
2+
variable "project_name" {
3+
default = "eligibility-signposting-api"
4+
type = string
5+
}
6+
7+
variable "environment" {
8+
default = "dev"
9+
description = "Environment"
10+
type = string
11+
}

‎infrastructure/stacks/_shared/locals.tf‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
locals {
2+
# tflint-ignore: terraform_unused_declarations
3+
environment = var.environment
4+
# tflint-ignore: terraform_unused_declarations
5+
workspace = lower(terraform.workspace)
6+
# tflint-ignore: terraform_unused_declarations
7+
runtime = "python3.13.1"
8+
9+
# tflint-ignore: terraform_unused_declarations
10+
tags = {
11+
TagVersion = "1"
12+
Programme = "Vaccinations"
13+
Project = "EligibilitySignpostingAPI"
14+
Environment = var.environment
15+
ServiceCategory = var.environment == "prod" ? "Bronze" : "N/A"
16+
Tool = "Terraform"
17+
}
18+
}

0 commit comments

Comments
 (0)