VIA-373 AJ/AS Update GitHub workflow for all environments to deploy IAM before app

ankur-jain-nhs · ankur-jain-nhs · commit b64b962f4e1e · 2025-09-29T16:34:34.000+01:00
diff --git a/.github/workflows/stage-4-deploy.yaml b/.github/workflows/stage-4-deploy.yaml
@@ -81,15 +81,15 @@ jobs:
         run: echo "TF_VAR_alarms_slack_channel_id=${{ secrets.ALARMS_SLACK_CHANNEL_ID }}" >> $GITHUB_ENV
       - name: "Set the app version being deployed"
         run: echo "TF_VAR_app_version=${{ steps.tag-or-sha.outputs.value }}" >> $GITHUB_ENV
-      - name: "Terraform init (shared)"
-        id: init-shared
-        run: TF_ENV=shared make terraform-init
-      - name: "Terraform plan (shared)"
-        id: plan-shared
-        run: TF_ENV=shared make terraform-plan opts="-out=terraform-shared.tfplan"
-      - name: "Terraform apply (shared)"
-        id: apply-shared
-        run: TF_ENV=shared make terraform-apply opts="-auto-approve" opts="terraform-shared.tfplan"
+      - name: "Terraform init (iam)"
+        id: init-iam
+        run: TF_ENV=${{ inputs.environment }}/iam make terraform-init
+      - name: "Terraform plan (iam)"
+        id: plan-iam
+        run: TF_ENV=${{ inputs.environment }}/iam make terraform-plan opts="-out=terraform-iam.tfplan"
+      - name: "Terraform apply (iam)"
+        id: apply-iam
+        run: TF_ENV=${{ inputs.environment }}/iam make terraform-apply opts="-auto-approve" opts="terraform-iam.tfplan"
       - name: "Terraform init (app)"
         id: init-app
         run: TF_ENV=${{ inputs.environment }} make terraform-init
diff --git a/infrastructure/environments/dev/iam/.terraform.lock.hcl b/infrastructure/environments/dev/iam/.terraform.lock.hcl
diff --git a/infrastructure/environments/dev/iam/data.tf b/infrastructure/environments/dev/iam/data.tf
diff --git a/infrastructure/environments/dev/iam/locals.tf b/infrastructure/environments/dev/iam/locals.tf
diff --git a/infrastructure/environments/dev/iam/main.tf b/infrastructure/environments/dev/iam/main.tf
@@ -1,5 +1,5 @@
 module "deploy_iam" {
-  source = "../../modules/deploy_iam"
+  source = "../../../modules/deploy_iam"
 
   account_id        = data.aws_caller_identity.current.account_id
   prefix            = local.prefix
diff --git a/infrastructure/environments/dev/iam/provider.tf b/infrastructure/environments/dev/iam/provider.tf
diff --git a/infrastructure/environments/dev/iam/variables.tf b/infrastructure/environments/dev/iam/variables.tf
diff --git a/infrastructure/environments/preprod/iam/.terraform.lock.hcl b/infrastructure/environments/preprod/iam/.terraform.lock.hcl
diff --git a/infrastructure/environments/preprod/iam/data.tf b/infrastructure/environments/preprod/iam/data.tf
@@ -0,0 +1 @@
+data "aws_caller_identity" "current" {}
diff --git a/infrastructure/environments/preprod/iam/locals.tf b/infrastructure/environments/preprod/iam/locals.tf
@@ -0,0 +1,29 @@
+locals {
+  region = "eu-west-2"
+
+  project_identifier           = "vaccinations-app"
+  project_identifier_shortcode = "vita"
+
+  environment      = "preprod"
+  deploy_workspace = var.is_github_action ? "gh" : terraform.workspace
+  prefix           = "${local.deploy_workspace}-${local.project_identifier_shortcode}-${data.aws_caller_identity.current.account_id}"
+
+  default_tags = {
+    ManagedBy   = "Terraform"
+    Project     = local.project_identifier
+    Environment = local.environment
+  }
+}
+
+resource "null_resource" "check_workspace" {
+  lifecycle {
+    precondition {
+      condition     = var.is_github_action || terraform.workspace != "default"
+      error_message = <<EOT
+  ❌ Default workspace is not allowed locally. It is reserved for GitHub actions.
+  ✅ Please switch to a named workspace like this (replace <name> with your workspace):
+  ( cd infrastructure/environments/dev; terraform workspace select <name>; terraform workspace list )
+  EOT
+    }
+  }
+}
diff --git a/infrastructure/environments/preprod/iam/main.tf b/infrastructure/environments/preprod/iam/main.tf
@@ -0,0 +1,10 @@
+module "deploy_iam" {
+  source = "../../../modules/deploy_iam"
+
+  account_id        = data.aws_caller_identity.current.account_id
+  prefix            = local.prefix
+  region            = local.region
+  environment       = local.environment
+  project_shortcode = local.project_identifier_shortcode
+  is_local          = !var.is_github_action
+}
diff --git a/infrastructure/environments/preprod/iam/provider.tf b/infrastructure/environments/preprod/iam/provider.tf
@@ -0,0 +1,24 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+
+  backend "s3" {
+    bucket = "vaccinations-app-tfstate-preprod"
+    key    = "iam/terraform.tfstate"
+    region = "eu-west-2"
+
+    use_lockfile = true
+    encrypt      = true
+  }
+}
+
+provider "aws" {
+  region = local.region
+  default_tags {
+    tags = local.default_tags
+  }
+}
diff --git a/infrastructure/environments/preprod/iam/variables.tf b/infrastructure/environments/preprod/iam/variables.tf
@@ -0,0 +1,5 @@
+variable "is_github_action" {
+  type        = bool
+  default     = false
+  description = "Whether terraform is run within GitHub action"
+}
diff --git a/infrastructure/environments/prod/iam/.terraform.lock.hcl b/infrastructure/environments/prod/iam/.terraform.lock.hcl
diff --git a/infrastructure/environments/prod/iam/data.tf b/infrastructure/environments/prod/iam/data.tf
@@ -0,0 +1 @@
+data "aws_caller_identity" "current" {}
diff --git a/infrastructure/environments/prod/iam/locals.tf b/infrastructure/environments/prod/iam/locals.tf
@@ -0,0 +1,29 @@
+locals {
+  region = "eu-west-2"
+
+  project_identifier           = "vaccinations-app"
+  project_identifier_shortcode = "vita"
+
+  environment      = "prod"
+  deploy_workspace = var.is_github_action ? "gh" : terraform.workspace
+  prefix           = "${local.deploy_workspace}-${local.project_identifier_shortcode}-${data.aws_caller_identity.current.account_id}"
+
+  default_tags = {
+    ManagedBy   = "Terraform"
+    Project     = local.project_identifier
+    Environment = local.environment
+  }
+}
+
+resource "null_resource" "check_workspace" {
+  lifecycle {
+    precondition {
+      condition     = var.is_github_action || terraform.workspace != "default"
+      error_message = <<EOT
+  ❌ Default workspace is not allowed locally. It is reserved for GitHub actions.
+  ✅ Please switch to a named workspace like this (replace <name> with your workspace):
+  ( cd infrastructure/environments/dev; terraform workspace select <name>; terraform workspace list )
+  EOT
+    }
+  }
+}
diff --git a/infrastructure/environments/prod/iam/main.tf b/infrastructure/environments/prod/iam/main.tf
@@ -0,0 +1,10 @@
+module "deploy_iam" {
+  source = "../../../modules/deploy_iam"
+
+  account_id        = data.aws_caller_identity.current.account_id
+  prefix            = local.prefix
+  region            = local.region
+  environment       = local.environment
+  project_shortcode = local.project_identifier_shortcode
+  is_local          = !var.is_github_action
+}
diff --git a/infrastructure/environments/prod/iam/provider.tf b/infrastructure/environments/prod/iam/provider.tf
@@ -0,0 +1,24 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+
+  backend "s3" {
+    bucket = "vaccinations-app-tfstate-prod"
+    key    = "iam/terraform.tfstate"
+    region = "eu-west-2"
+
+    use_lockfile = true
+    encrypt      = true
+  }
+}
+
+provider "aws" {
+  region = local.region
+  default_tags {
+    tags = local.default_tags
+  }
+}
diff --git a/infrastructure/environments/prod/iam/variables.tf b/infrastructure/environments/prod/iam/variables.tf
@@ -0,0 +1,5 @@
+variable "is_github_action" {
+  type        = bool
+  default     = false
+  description = "Whether terraform is run within GitHub action"
+}
diff --git a/infrastructure/environments/test/iam/.terraform.lock.hcl b/infrastructure/environments/test/iam/.terraform.lock.hcl
diff --git a/infrastructure/environments/test/iam/data.tf b/infrastructure/environments/test/iam/data.tf
@@ -0,0 +1 @@
+data "aws_caller_identity" "current" {}
diff --git a/infrastructure/environments/test/iam/locals.tf b/infrastructure/environments/test/iam/locals.tf
@@ -0,0 +1,29 @@
+locals {
+  region = "eu-west-2"
+
+  project_identifier           = "vaccinations-app"
+  project_identifier_shortcode = "vita"
+
+  environment      = "test"
+  deploy_workspace = var.is_github_action ? "gh" : terraform.workspace
+  prefix           = "${local.deploy_workspace}-${local.project_identifier_shortcode}-${data.aws_caller_identity.current.account_id}"
+
+  default_tags = {
+    ManagedBy   = "Terraform"
+    Project     = local.project_identifier
+    Environment = local.environment
+  }
+}
+
+resource "null_resource" "check_workspace" {
+  lifecycle {
+    precondition {
+      condition     = var.is_github_action || terraform.workspace != "default"
+      error_message = <<EOT
+  ❌ Default workspace is not allowed locally. It is reserved for GitHub actions.
+  ✅ Please switch to a named workspace like this (replace <name> with your workspace):
+  ( cd infrastructure/environments/dev; terraform workspace select <name>; terraform workspace list )
+  EOT
+    }
+  }
+}
diff --git a/infrastructure/environments/test/iam/main.tf b/infrastructure/environments/test/iam/main.tf
@@ -0,0 +1,10 @@
+module "deploy_iam" {
+  source = "../../../modules/deploy_iam"
+
+  account_id        = data.aws_caller_identity.current.account_id
+  prefix            = local.prefix
+  region            = local.region
+  environment       = local.environment
+  project_shortcode = local.project_identifier_shortcode
+  is_local          = !var.is_github_action
+}
diff --git a/infrastructure/environments/test/iam/provider.tf b/infrastructure/environments/test/iam/provider.tf
@@ -0,0 +1,24 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+
+  backend "s3" {
+    bucket = "vaccinations-app-tfstate-test"
+    key    = "iam/terraform.tfstate"
+    region = "eu-west-2"
+
+    use_lockfile = true
+    encrypt      = true
+  }
+}
+
+provider "aws" {
+  region = local.region
+  default_tags {
+    tags = local.default_tags
+  }
+}
diff --git a/infrastructure/environments/test/iam/variables.tf b/infrastructure/environments/test/iam/variables.tf
@@ -0,0 +1,5 @@
+variable "is_github_action" {
+  type        = bool
+  default     = false
+  description = "Whether terraform is run within GitHub action"
+}

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+data "aws_caller_identity" "current" {}`