Skip to content

Commit ef2dff7

Browse files
gambol99gambol99
committed
feat: reworking the module
1 parent 4f6f23c commit ef2dff7

File tree

25 files changed

+240
-338
lines changed

25 files changed

+240
-338
lines changed

.github/workflows/terraform-module-validation.yml renamed to .github/workflows/terraform.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
name: Terraform
23
on:
34
push:
@@ -6,7 +7,6 @@ on:
67
pull_request:
78
branches:
89
- main
9-
- vnext
1010

1111
permissions:
1212
contents: read

‎README.md‎

Lines changed: 29 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,38 @@
88

99
# Appvia Support Roles
1010

11-
This repository provides a collection of sub modules used to provision the appropriate support roles and permissions with accounts. Please take a look at the examples folder for samples of how to implement.
11+
This repository provides a collection of Terraform sub-modules used to provision the appropriate support roles and permissions within your AWS accounts. Each module is independently deployable and scoped to a specific support function.
12+
13+
## Modules
14+
15+
### [LZA Support](modules/lza/README.md)
16+
17+
Deploys into your **AWS management account** (where Control Tower and the Landing Zone Accelerator pipeline run). It provisions a cross-account IAM role that Appvia's support team can assume to monitor and troubleshoot the LZA deployment.
18+
19+
Key resources:
20+
- `AppviaLZASupportRole` — cross-account role with a trust policy scoped to Appvia's SSO role
21+
- `AppviaLZASupportPolicy` — grants view and trigger access to CodePipeline, CloudFormation, CodeBuild, and CodeCommit
22+
- `AppviaCostAnalysisSupportPolicy` *(optional)* — grants read access to Cost Explorer, Billing, and Cost Optimization Hub; enabled via `enable_cost_analysis_support = true`
23+
24+
→ [Module README](modules/lza/README.md) · [Example](examples/lza-support/README.md)
25+
26+
---
27+
28+
### [Cost Analysis Support](modules/costanalysis/README.md)
29+
30+
Deploys into your **AWS Cost Analysis account** (where CUDOS dashboards and CUR data are hosted). It provisions a cross-account IAM role that Appvia's team can assume to support the CUDOS platform and cost reporting tooling.
31+
32+
Key resources:
33+
- `AppviaCostAnalysisSupportRole` — cross-account role with a trust policy scoped to Appvia's SSO role
34+
- `AppviaCudosSupportPolicy` — grants access to QuickSight, Athena, Glue, S3 (CID/CUDOS buckets), Step Functions, Lambda, and CloudWatch Logs
35+
36+
→ [Module README](modules/costanalysis/README.md) · [Example](examples/cost-analysis-support/README.md)
37+
38+
---
1239

1340
## Deployment
1441

15-
View the examples directory for a sample deployment.
42+
See the [examples](examples/) directory for sample deployments of each module.
1643

1744
<!-- BEGIN_TF_DOCS -->
1845
## Providers

‎examples/cost-analysis-support/.terraform.lock.hcl‎

Lines changed: 17 additions & 17 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎examples/cost-analysis-support/README.md‎

Lines changed: 14 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,22 @@
11
# Example: AWS Cost Analysis Support
22

3-
This example demonstrates how to deploy the AWS Cost Analysis support resources using Terraform in your AWS Cost Analysis Account.
3+
This example demonstrates how to deploy the AWS Cost Analysis support resources using Terraform in your **AWS Cost Analysis account** (where CUDOS dashboards and CUR data are hosted).
4+
5+
The module provisions the following:
6+
7+
- **`AppviaCostAnalysisSupportRole`** — a cross-account IAM role that Appvia's team can assume (via a trust policy scoped to Appvia's SSO role in account `730335310409`) to support the CUDOS platform and cost reporting tooling.
8+
- **`AppviaCudosSupportPolicy`** — a customer-managed IAM policy granting access to:
9+
- **QuickSight** — view and manage analyses, dashboards, datasets, and data sources
10+
- **Athena** — full access for running CID/CUDOS queries
11+
- **Glue** — read access and the ability to update tables used by the dashboards
12+
- **S3** — list and read access to `cid-*`, `cudos-dashboard-*`, and `aws-athena-query-results-cid-*` buckets, plus write access for Athena query results
13+
- **Step Functions** — view and trigger executions for CUDOS data refresh workflows
14+
- **Lambda** — read access to functions used by CID/CUDOS
15+
- **CloudWatch Logs** — read access to `/aws/lambda/CID-DC*` log groups and CloudWatch alarms
416

517
## Deployment
618

7-
1. Copy the `terraform.tfvars.example` file to `terraform.tfvars` and update with your values.
19+
1. Copy the `terraform.tfvars.sample` file to `terraform.tfvars` and update with your values.
820
2. Run `terraform init -upgrade`
921
3. Run `terraform plan -out=tfplan`
1022
4. Run `terraform apply tfplan`
@@ -18,27 +30,10 @@ The `terraform-docs` utility is used to generate this README. Follow the below s
1830
3. Run `terraform-docs markdown table --output-file ${PWD}/README.md --output-mode inject .`
1931

2032
<!-- BEGIN_TF_DOCS -->
21-
## Requirements
22-
23-
| Name | Version |
24-
|------|---------|
25-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
26-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 5.0 |
27-
2833
## Providers
2934

3035
No providers.
3136

32-
## Modules
33-
34-
| Name | Source | Version |
35-
|------|--------|---------|
36-
| <a name="module_appvia_cost_analysis_support_role"></a> [appvia\_cost\_analysis\_support\_role](#module\_appvia\_cost\_analysis\_support\_role) | ../../modules/costanalysis | n/a |
37-
38-
## Resources
39-
40-
No resources.
41-
4237
## Inputs
4338

4439
| Name | Description | Type | Default | Required |

‎examples/cost-analysis-support/terraform.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ terraform {
66
required_providers {
77
aws = {
88
source = "hashicorp/aws"
9-
version = "~> 5.0"
9+
version = ">= 6.0.0"
1010
}
1111
}
1212
}

‎examples/lza-support/.terraform.lock.hcl‎

Lines changed: 17 additions & 17 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎examples/lza-support/README.md‎

Lines changed: 9 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,17 @@
22

33
This example demonstrates how to deploy the AWS Landing Zone Accelerator (LZA) support resources using Terraform in your AWS Management Account where Control Tower is configured.
44

5+
The module provisions the following in your management account:
6+
7+
- **`AppviaLZASupportRole`** — an IAM role that Appvia's support team can assume (via a cross-account trust policy) to manage and troubleshoot the LZA pipeline. It grants read access to CodePipeline, CloudFormation, CodeBuild, and CodeCommit, with the ability to trigger the `AWSAccelerator-Pipeline`, and limited write access to the `aws-accelerator-config` CodeCommit repository.
8+
- **`AppviaLZASupportPolicy`** — a customer-managed IAM policy attached to the support role containing the above permissions.
9+
- **`AppviaCostAnalysisSupportPolicy`** *(optional)* — an additional policy attached to the support role granting read access to Cost Explorer, AWS Billing, Cost Optimization Hub, and Carbon Footprint data. Enabled via `enable_cost_analysis_support = true`.
10+
11+
The trust policy on the support role allows assumption only from a specific Appvia-managed IAM role in the Appvia AWS account (`755035180280` by default), scoped to an SSO role ARN.
12+
513
## Deployment
614

7-
1. Copy the `terraform.tfvars.example` file to `terraform.tfvars` and update with your values.
15+
1. Copy the `terraform.tfvars.sample` file to `terraform.tfvars` and update with your values.
816
2. Run `terraform init -upgrade`
917
3. Run `terraform plan -out=tfplan`
1018
4. Run `terraform apply tfplan`
@@ -18,27 +26,10 @@ The `terraform-docs` utility is used to generate this README. Follow the below s
1826
3. Run `terraform-docs markdown table --output-file ${PWD}/README.md --output-mode inject .`
1927

2028
<!-- BEGIN_TF_DOCS -->
21-
## Requirements
22-
23-
| Name | Version |
24-
|------|---------|
25-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
26-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 5.0 |
27-
2829
## Providers
2930

3031
No providers.
3132

32-
## Modules
33-
34-
| Name | Source | Version |
35-
|------|--------|---------|
36-
| <a name="module_appvia_lza_support_role"></a> [appvia\_lza\_support\_role](#module\_appvia\_lza\_support\_role) | ../../modules/lza | n/a |
37-
38-
## Resources
39-
40-
No resources.
41-
4233
## Inputs
4334

4435
| Name | Description | Type | Default | Required |
@@ -50,7 +41,6 @@ No resources.
5041

5142
| Name | Description |
5243
|------|-------------|
53-
| <a name="output_appvia_cost_analysis_support_role_arn"></a> [appvia\_cost\_analysis\_support\_role\_arn](#output\_appvia\_cost\_analysis\_support\_role\_arn) | The ARN of the IAM role to be assumed by the support team for cost analysis |
5444
| <a name="output_appvia_landing_zone_support_role_arn"></a> [appvia\_landing\_zone\_support\_role\_arn](#output\_appvia\_landing\_zone\_support\_role\_arn) | The name of the Landing Zone Support IAM role to be assumed by the Appvia support team |
5545
<!-- END_TF_DOCS -->
5646

‎examples/lza-support/outputs.tf‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,3 @@ output "appvia_landing_zone_support_role_arn" {
22
description = "The name of the Landing Zone Support IAM role to be assumed by the Appvia support team"
33
value = module.appvia_lza_support_role.landing_support_role_arn
44
}
5-
6-
output "appvia_cost_analysis_support_role_arn" {
7-
description = "The ARN of the IAM role to be assumed by the support team for cost analysis"
8-
value = module.appvia_lza_support_role.cost_analysis_support_role_arn
9-
}

‎examples/lza-support/terraform.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ terraform {
66
required_providers {
77
aws = {
88
source = "hashicorp/aws"
9-
version = "~> 5.0"
9+
version = ">= 6.0.0"
1010
}
1111
}
1212
}

‎modules/costanalysis/.terraform.lock.hcl‎

Lines changed: 0 additions & 38 deletions
This file was deleted.

0 commit comments

Comments
 (0)