Skip to content

Commit c772646

Browse files
aknyshaknysh
authored
Bump terraform-ecs-web-app and github-repository-webhooks versions. Update README (#11)
1 parent eb275af commit c772646

File tree

5 files changed

+103
-33
lines changed

5 files changed

+103
-33
lines changed

‎README.md

Lines changed: 40 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -90,20 +90,42 @@ What this module does not provision:
9090

9191
### GitHub Repo Scopes
9292

93-
We suggest creating a personal access token for a GitHub bot user with the following scopes:
93+
This module accepts two GitHub tokens:
9494

95-
- `repo`
96-
* `repo:status`
97-
* `repo_deployment`
98-
* `public_repo`
99-
* `repo:invite`
100-
- `admin:repo_hook`
101-
* `write:repo_hook`
102-
* `read:repo_hook`
95+
1. `github_oauth_token` with permissions to pull private repos. Used by CodePipeline to clone repos before the build, and by the atlantis server to clone repos and comment on Pull Requests.
10396

104-
![GitHub Repo Scopes](docs/github-repo-scopes.png)
97+
The token needs the following OAuth scopes:
10598

106-
**IMPORTANT:** Do not commit this `github_oauth_token` to source control (e.g. via `terraform.tvfars`).
99+
- `repo`
100+
* `repo:status`
101+
* `repo_deployment`
102+
* `public_repo`
103+
* `repo:invite`
104+
105+
2. `github_webhooks_token` with permissions to create GitHub webhooks.
106+
Only used by [Terraform GitHub Provider](https://www.terraform.io/docs/providers/github/index.html) when provisioning the module.
107+
It must be provided either in the `github_webhooks_token` variable, or it can also be sourced from the `GITHUB_TOKEN` environment variable.
108+
109+
The token needs the following OAuth scopes:
110+
111+
- `admin:repo_hook`
112+
* `write:repo_hook`
113+
* `read:repo_hook`
114+
115+
We suggest the following steps when creating the tokens and provisioning the module:
116+
117+
1. Create a GitHub bot user
118+
2. Create the two Personal Access Tokens and add them to the bot
119+
3. In `github.com/<org>/<repo>/settings/collaboration`, create a Team for the bot and add the bot user to it
120+
4. Give `Admin` permissions to the Team (select it from the dropdown). We need it temporalily to provision GitHub webhooks on the repo
121+
5. Provision the module with Terraform.
122+
[Terraform GitHub Provider](https://www.terraform.io/docs/providers/github/index.html) will use the `github_webhooks_token` to create webhooks on the repo
123+
6. Go to `github.com/<org>/<repo>/settings/hooks` and make sure that two webhooks have been created: one for the CodePipeline with `Releases` events,
124+
the other is for the `atlantis` server with `Issue comments`, `Pull request reviews`, `Pull requests`, `Pull request review comments` and `Pushes` events
125+
7. **IMPORTANT:** Remove the `Admin` permissions and add `Read` permissions for the bot Team.
126+
The CodePipeline and `atlantis` server will use the `github_oauth_token` to clone repos, which does not require escalated privileges
127+
128+
**IMPORTANT:** Do not commit the tokens to source control (_e.g._ via `terraform.tvfars`).
107129

108130
## Usage
109131

@@ -120,7 +142,11 @@ Module usage examples:
120142
- [with Cognito authentication](examples/with_cognito_authentication) - complete example with Cognito authentication
121143

122144

123-
**NOTE:** if no `github_oauth_token` is set, this module attempts to look one up from SSM.
145+
**NOTE:**
146+
147+
If no `github_oauth_token` is set, the module attempts to look one up from SSM.
148+
149+
If no `github_webhooks_token` is set, [Terraform GitHub Provider](https://www.terraform.io/docs/providers/github/index.html) attempts to look one up in the `GITHUB_TOKEN` environment variable.
124150

125151
```
126152
module "atlantis" {
@@ -225,6 +251,7 @@ Available targets:
225251
| build_timeout | How long in minutes, from 5 to 480 (8 hours), for AWS CodeBuild to wait until timing out any related build that does not get marked as completed. | string | `5` | no |
226252
| chamber_format | Format to store parameters in SSM, for consumption with chamber | string | `/%s/%s` | no |
227253
| chamber_service | SSM parameter service name for use with chamber. This is used in chamber_format where /$chamber_service/$parameter would be the default. | string | `atlantis` | no |
254+
| codepipeline_s3_bucket_force_destroy | A boolean that indicates all objects should be deleted from the CodePipeline artifact store S3 bucket so that the bucket can be destroyed without error | string | `false` | no |
228255
| container_cpu | Atlantis CPUs per task | string | `256` | no |
229256
| container_memory | Atlantis memory per task | string | `512` | no |
230257
| default_backend_image | ECS default (bootstrap) image | string | `cloudposse/default-backend:0.1.2` | no |
@@ -235,6 +262,7 @@ Available targets:
235262
| enabled | Whether to create the resources. Set to `false` to prevent the module from creating any resources | string | `false` | no |
236263
| github_oauth_token | GitHub Oauth token. If not provided the token is looked up from SSM. | string | `` | no |
237264
| github_oauth_token_ssm_name | SSM param name to lookup GitHub OAuth token if not provided | string | `` | no |
265+
| github_webhooks_token | GitHub OAuth Token with permissions to create webhooks. If not provided, can be sourced from the `GITHUB_TOKEN` environment variable | string | `` | no |
238266
| healthcheck_path | Healthcheck path | string | `/healthz` | no |
239267
| hostname | Atlantis URL | string | `` | no |
240268
| kms_key_id | KMS key ID used to encrypt SSM SecureString parameters | string | `` | no |

‎README.yaml

Lines changed: 38 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -111,20 +111,42 @@ introduction: |-
111111
112112
### GitHub Repo Scopes
113113
114-
We suggest creating a personal access token for a GitHub bot user with the following scopes:
114+
This module accepts two GitHub tokens:
115115
116-
- `repo`
117-
* `repo:status`
118-
* `repo_deployment`
119-
* `public_repo`
120-
* `repo:invite`
121-
- `admin:repo_hook`
122-
* `write:repo_hook`
123-
* `read:repo_hook`
116+
1. `github_oauth_token` with permissions to pull private repos. Used by CodePipeline to clone repos before the build, and by the atlantis server to clone repos and comment on Pull Requests.
124117
125-
![GitHub Repo Scopes](docs/github-repo-scopes.png)
118+
The token needs the following OAuth scopes:
126119
127-
**IMPORTANT:** Do not commit this `github_oauth_token` to source control (e.g. via `terraform.tvfars`).
120+
- `repo`
121+
* `repo:status`
122+
* `repo_deployment`
123+
* `public_repo`
124+
* `repo:invite`
125+
126+
2. `github_webhooks_token` with permissions to create GitHub webhooks.
127+
Only used by [Terraform GitHub Provider](https://www.terraform.io/docs/providers/github/index.html) when provisioning the module.
128+
It must be provided either in the `github_webhooks_token` variable, or it can also be sourced from the `GITHUB_TOKEN` environment variable.
129+
130+
The token needs the following OAuth scopes:
131+
132+
- `admin:repo_hook`
133+
* `write:repo_hook`
134+
* `read:repo_hook`
135+
136+
We suggest the following steps when creating the tokens and provisioning the module:
137+
138+
1. Create a GitHub bot user
139+
2. Create the two Personal Access Tokens and add them to the bot
140+
3. In `github.com/<org>/<repo>/settings/collaboration`, create a Team for the bot and add the bot user to it
141+
4. Give `Admin` permissions to the Team (select it from the dropdown). We need it temporalily to provision GitHub webhooks on the repo
142+
5. Provision the module with Terraform.
143+
[Terraform GitHub Provider](https://www.terraform.io/docs/providers/github/index.html) will use the `github_webhooks_token` to create webhooks on the repo
144+
6. Go to `github.com/<org>/<repo>/settings/hooks` and make sure that two webhooks have been created: one for the CodePipeline with `Releases` events,
145+
the other is for the `atlantis` server with `Issue comments`, `Pull request reviews`, `Pull requests`, `Pull request review comments` and `Pushes` events
146+
7. **IMPORTANT:** Remove the `Admin` permissions and add `Read` permissions for the bot Team.
147+
The CodePipeline and `atlantis` server will use the `github_oauth_token` to clone repos, which does not require escalated privileges
148+
149+
**IMPORTANT:** Do not commit the tokens to source control (_e.g._ via `terraform.tvfars`).
128150
129151
# How to use this project
130152
usage: |-
@@ -136,7 +158,11 @@ usage: |-
136158
- [with Cognito authentication](examples/with_cognito_authentication) - complete example with Cognito authentication
137159
138160
139-
**NOTE:** if no `github_oauth_token` is set, this module attempts to look one up from SSM.
161+
**NOTE:**
162+
163+
If no `github_oauth_token` is set, the module attempts to look one up from SSM.
164+
165+
If no `github_webhooks_token` is set, [Terraform GitHub Provider](https://www.terraform.io/docs/providers/github/index.html) attempts to look one up in the `GITHUB_TOKEN` environment variable.
140166
141167
```
142168
module "atlantis" {

‎docs/terraform.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@
5151
| build_timeout | How long in minutes, from 5 to 480 (8 hours), for AWS CodeBuild to wait until timing out any related build that does not get marked as completed. | string | `5` | no |
5252
| chamber_format | Format to store parameters in SSM, for consumption with chamber | string | `/%s/%s` | no |
5353
| chamber_service | SSM parameter service name for use with chamber. This is used in chamber_format where /$chamber_service/$parameter would be the default. | string | `atlantis` | no |
54+
| codepipeline_s3_bucket_force_destroy | A boolean that indicates all objects should be deleted from the CodePipeline artifact store S3 bucket so that the bucket can be destroyed without error | string | `false` | no |
5455
| container_cpu | Atlantis CPUs per task | string | `256` | no |
5556
| container_memory | Atlantis memory per task | string | `512` | no |
5657
| default_backend_image | ECS default (bootstrap) image | string | `cloudposse/default-backend:0.1.2` | no |
@@ -61,6 +62,7 @@
6162
| enabled | Whether to create the resources. Set to `false` to prevent the module from creating any resources | string | `false` | no |
6263
| github_oauth_token | GitHub Oauth token. If not provided the token is looked up from SSM. | string | `` | no |
6364
| github_oauth_token_ssm_name | SSM param name to lookup GitHub OAuth token if not provided | string | `` | no |
65+
| github_webhooks_token | GitHub OAuth Token with permissions to create webhooks. If not provided, can be sourced from the `GITHUB_TOKEN` environment variable | string | `` | no |
6466
| healthcheck_path | Healthcheck path | string | `/healthz` | no |
6567
| hostname | Atlantis URL | string | `` | no |
6668
| kms_key_id | KMS key ID used to encrypt SSM SecureString parameters | string | `` | no |

‎main.tf

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,8 @@ module "ssh_key_pair" {
4646
}
4747

4848
module "webhooks" {
49-
source = "git::https://github.com/cloudposse/terraform-github-repository-webhooks.git?ref=tags/0.3.0"
50-
github_token = "${local.github_oauth_token}"
49+
source = "git::https://github.com/cloudposse/terraform-github-repository-webhooks.git?ref=tags/0.4.0"
50+
github_token = "${var.github_webhooks_token}"
5151
webhook_secret = "${local.atlantis_gh_webhook_secret}"
5252
webhook_url = "${local.atlantis_webhook_url}"
5353
enabled = "${local.enabled}"
@@ -57,7 +57,7 @@ module "webhooks" {
5757
}
5858

5959
module "web_app" {
60-
source = "git::https://github.com/cloudposse/terraform-aws-ecs-web-app.git?ref=tags/0.19.0"
60+
source = "git::https://github.com/cloudposse/terraform-aws-ecs-web-app.git?ref=tags/0.21.0"
6161
namespace = "${var.namespace}"
6262
stage = "${var.stage}"
6363
name = "${var.name}"
@@ -110,12 +110,15 @@ module "web_app" {
110110

111111
alb_ingress_healthcheck_path = "${var.healthcheck_path}"
112112

113-
github_oauth_token = "${local.github_oauth_token}"
114-
repo_owner = "${var.repo_owner}"
115-
repo_name = "${var.repo_name}"
116-
branch = "${var.branch}"
117-
build_timeout = "${var.build_timeout}"
118-
badge_enabled = "false"
113+
github_oauth_token = "${local.github_oauth_token}"
114+
github_webhooks_token = "${var.github_webhooks_token}"
115+
repo_owner = "${var.repo_owner}"
116+
repo_name = "${var.repo_name}"
117+
branch = "${var.branch}"
118+
build_timeout = "${var.build_timeout}"
119+
badge_enabled = "false"
120+
121+
codepipeline_s3_bucket_force_destroy = "${var.codepipeline_s3_bucket_force_destroy}"
119122

120123
alb_target_group_alarms_enabled = "${local.enabled}"
121124
alb_target_group_alarms_3xx_threshold = "25"

‎variables.tf

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,12 +44,23 @@ variable "github_oauth_token" {
4444
default = ""
4545
}
4646

47+
variable "github_webhooks_token" {
48+
type = "string"
49+
description = "GitHub OAuth Token with permissions to create webhooks. If not provided, can be sourced from the `GITHUB_TOKEN` environment variable"
50+
default = ""
51+
}
52+
4753
variable "github_oauth_token_ssm_name" {
4854
type = "string"
4955
description = "SSM param name to lookup GitHub OAuth token if not provided"
5056
default = ""
5157
}
5258

59+
variable "codepipeline_s3_bucket_force_destroy" {
60+
description = "A boolean that indicates all objects should be deleted from the CodePipeline artifact store S3 bucket so that the bucket can be destroyed without error"
61+
default = false
62+
}
63+
5364
variable "enabled" {
5465
type = "string"
5566
default = "false"

0 commit comments

Comments
 (0)