Hosted zone import and variables change

Author: robertnovac1

infra/environments/int/variables.tfvars

@@ -1,7 +1,8 @@
-imms_account_id = "084828561157"
-dspp_account_id = "603871901111"
-admin_role      = "aws-reserved/sso.amazonaws.com/eu-west-2/AWSReservedSSO_PREPROD-IMMS-Admin_acce656dcacf6f4c"
-dev_ops_role    = "aws-reserved/sso.amazonaws.com/eu-west-2/AWSReservedSSO_PREPROD-IMMS-Devops_1d28e4f37b940bcd"
-auto_ops_role   = "auto-ops"
-dspp_admin_role = "root"
-environment     = "int"
+imms_account_id   = "084828561157"
+dspp_account_id   = "603871901111"
+admin_role        = "role/aws-reserved/sso.amazonaws.com/eu-west-2/AWSReservedSSO_PREPROD-IMMS-Admin_acce656dcacf6f4c"
+dev_ops_role      = "role/aws-reserved/sso.amazonaws.com/eu-west-2/AWSReservedSSO_PREPROD-IMMS-Devops_1d28e4f37b940bcd"
+auto_ops_role     = "role/auto-ops"
+dspp_admin_role   = "root"
+environment       = "int"
+route53_zone_name = "imms.int.vds.platform.nhs.uk"

infra/environments/non-prod/variables.tfvars

@@ -1,7 +1,8 @@
-imms_account_id = "345594581768"
-dspp_account_id = "603871901111"
-admin_role      = "root" # We shouldn't be using the root account. There should be an Admin role
-dev_ops_role    = "DevOps"
-auto_ops_role   = "auto-ops"
-dspp_admin_role = "root"
-environment     = "non-prod"
+imms_account_id   = "345594581768"
+dspp_account_id   = "603871901111"
+admin_role        = "root" # We shouldn't be using the root account. There should be an Admin role
+dev_ops_role      = "role/DevOps"
+auto_ops_role     = "role/auto-ops"
+dspp_admin_role   = "root"
+environment       = "non-prod"
+route53_zone_name = "imms.dev.vds.platform.nhs.uk"

infra/environments/prod/variables.tfvars

@@ -1,8 +1,9 @@
 imms_account_id = "664418956997"
 dspp_account_id = "232116723729"
 # TODO: Fill in the values below
-admin_role      = "" # We shouldn't be using the root account. There should be an Admin role
-dev_ops_role    = ""
-auto_ops_role   = "auto-ops"
-dspp_admin_role = "root"
-environment     = "prod"
+admin_role        = "" # We shouldn't be using the root account. There should be an Admin role
+dev_ops_role      = ""
+auto_ops_role     = "role/auto-ops"
+dspp_admin_role   = "root"
+environment       = "prod"
+route53_zone_name = "imms.prod.vds.platform.nhs.uk" #TBC 

infra/kms.tf

@@ -4,7 +4,7 @@ locals {
     Sid    = "AllowKeyAdministration",
     Effect = "Allow",
     Principal = {
-      AWS = "arn:aws:iam::${var.imms_account_id}:role/${var.admin_role}"
+      AWS = "arn:aws:iam::${var.imms_account_id}:${var.admin_role}"
     },
     Action = [
       "kms:Create*",
@@ -30,7 +30,7 @@ locals {
     Sid    = "KMSKeyUserAccess",
     Effect = "Allow",
     Principal = {
-      AWS = "arn:aws:iam::${var.imms_account_id}:role/${var.auto_ops_role}"
+      AWS = "arn:aws:iam::${var.imms_account_id}:${var.auto_ops_role}"
     },
     Action = [
       "kms:Encrypt",
@@ -43,7 +43,7 @@ locals {
     Sid    = "KMSKeyUserAccessForDevOps",
     Effect = "Allow",
     Principal = {
-      AWS = "arn:aws:iam::${var.imms_account_id}:role/${var.dev_ops_role}"
+      AWS = "arn:aws:iam::${var.imms_account_id}:${var.dev_ops_role}"
     },
     Action = [
       "kms:Encrypt",

infra/networking.tf

@@ -52,3 +52,7 @@ resource "aws_route" "igw_route" {
   destination_cidr_block = "0.0.0.0/16"
   gateway_id             = aws_internet_gateway.default.id
 }
+
+resource "aws_route53_zone" "hosted_zone" {
+  name = var.route53_zone_name
+}

infra/variables.tf

@@ -8,6 +8,7 @@ variable "auto_ops_role" {}
 variable "admin_role" {}
 variable "dev_ops_role" {}
 variable "dspp_admin_role" {}
+variable "route53_zone_name" {}
 variable "build_agent_account_id" {
   default = "958002497996"
 }