Merge pull request #3 from cmdlabs/uplift-to-tf12

Updated code to terraform 0.12.0

Author: fahad-tariq

CHANGELOG.md

@@ -4,10 +4,17 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.0] - 2019-06-03
+### Breaking
+- Updated code to terraform 0.12.0
+
+### Fixed
+- Added IAM permissions to allow deletion of workspaces. Fixes #2
+
 ## [0.2.0] - 2019-02-09
 ### Changed
 - All resources are now prefixed allowing multiple backends to be deployed into the same account
-- Workspaces have been changed to prefixes rather than full paths.
+- Workspaces have been changed to prefixes rather than full paths
 
 ## [0.1.0] - 2019-01-27
 ### Added

backend_roles.tf

@@ -2,30 +2,36 @@
 resource "aws_iam_role" "backend-all" {
   name               = "${var.resource_prefix}-terraform-backend"
   description        = "Allows access to all Terraform workspaces"
-  assume_role_policy = "${data.aws_iam_policy_document.backend-assume-role-all.json}"
+  assume_role_policy = data.aws_iam_policy_document.backend-assume-role-all.json
 }
 
 resource "aws_iam_role_policy" "backend-all" {
   name   = "${var.resource_prefix}-terraform-backend"
-  policy = "${data.aws_iam_policy_document.iam-role-policy.json}"
+  policy = data.aws_iam_policy_document.iam-role-policy.json
   role   = "${var.resource_prefix}-terraform-backend"
 
-  depends_on = ["aws_iam_role.backend-all"]
+  depends_on = [aws_iam_role.backend-all]
 }
 
 #These roles are limited to their specific workspace through the use of S3 resource permissions
 resource "aws_iam_role" "backend-restricted" {
-  count              = "${length(var.workspace_prefixes)}"
+  count              = length(var.workspace_prefixes)
   name               = "${var.resource_prefix}-terraform-backend-${element(var.workspace_prefixes, count.index)}"
   description        = "Allows access to the ${element(var.workspace_prefixes, count.index)} workspace prefix "
-  assume_role_policy = "${element(data.aws_iam_policy_document.backend-assume-role-restricted.*.json, count.index)}"
+  assume_role_policy = element(
+    data.aws_iam_policy_document.backend-assume-role-restricted.*.json,
+    count.index,
+  )
 }
 
 resource "aws_iam_role_policy" "backend-restricted" {
-  count  = "${length(var.workspace_prefixes)}"
+  count  = length(var.workspace_prefixes)
   name   = "${var.resource_prefix}-terraform-backend-${element(var.workspace_prefixes, count.index)}"
-  policy = "${element(data.aws_iam_policy_document.iam-role-policy-restricted.*.json, count.index)}"
+  policy = element(
+    data.aws_iam_policy_document.iam-role-policy-restricted.*.json,
+    count.index,
+  )
   role   = "${var.resource_prefix}-terraform-backend-${element(var.workspace_prefixes, count.index)}"
 
-  depends_on = ["aws_iam_role.backend-restricted"]
+  depends_on = [aws_iam_role.backend-restricted]
 }

examples/main.tf

@@ -1,7 +1,7 @@
 module "tf-backend" {
   source = "../"
 
-  resource_prefix = "deantftest"
+  resource_prefix = "cmdlabtftest"
   bucket_region = "ap-southeast-2"
 
   bucket_sse_algorithm = "AES256"

examples/providers.tf

@@ -0,0 +1,4 @@
+provider "aws" {
+  version = "~> 2.0"
+  region = "ap-southeast-2"
+}

iam_policy.tf

@@ -1,13 +1,13 @@
 data "aws_iam_policy_document" "iam-role-policy-restricted" {
-  count = "${length(var.workspace_prefixes)}"
+  count = length(var.workspace_prefixes)
 
   statement {
     actions   = ["s3:ListBucket"]
     resources = ["arn:aws:s3:::${aws_s3_bucket.backend.id}"]
   }
 
   statement {
-    actions   = ["s3:GetObject", "s3:PutObject"]
+    actions   = ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"]
     resources = ["arn:aws:s3:::${aws_s3_bucket.backend.id}/env:/${element(var.workspace_prefixes, count.index)}*"]
   }
 
@@ -24,7 +24,7 @@ data "aws_iam_policy_document" "iam-role-policy" {
   }
 
   statement {
-    actions   = ["s3:GetObject", "s3:PutObject"]
+    actions   = ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"]
     resources = ["arn:aws:s3:::${aws_s3_bucket.backend.id}/*"]
   }
 
@@ -40,20 +40,34 @@ data "aws_iam_policy_document" "backend-assume-role-all" {
 
     principals {
       type        = "AWS"
-      identifiers = ["${split(",", lookup(var.assume_policy, "all", data.aws_caller_identity.current.account_id))}"]
+      identifiers = split(
+        ",",
+        lookup(
+          var.assume_policy,
+          "all",
+          data.aws_caller_identity.current.account_id,
+        ),
+      )
     }
   }
 }
 
 data "aws_iam_policy_document" "backend-assume-role-restricted" {
-  count = "${length(var.workspace_prefixes)}"
+  count = length(var.workspace_prefixes)
 
   statement {
     actions = ["sts:AssumeRole"]
 
     principals {
       type        = "AWS"
-      identifiers = ["${split(",", lookup(var.assume_policy, "${element(var.workspace_prefixes, count.index)}", data.aws_caller_identity.current.account_id))}"]
+      identifiers = split(
+        ",",
+        lookup(
+          var.assume_policy,
+          element(var.workspace_prefixes, count.index),
+          data.aws_caller_identity.current.account_id,
+        ),
+      )
     }
   }
 }

main.tf

@@ -1,6 +1,6 @@
 resource "aws_s3_bucket" "backend" {
   bucket = "${var.resource_prefix}-terraform-backend"
-  region = "${var.bucket_region}"
+  region = var.bucket_region
   acl    = "private"
 
   versioning {
@@ -10,14 +10,14 @@ resource "aws_s3_bucket" "backend" {
   server_side_encryption_configuration {
     rule {
       apply_server_side_encryption_by_default {
-        sse_algorithm = "${var.bucket_sse_algorithm}"
+        sse_algorithm = var.bucket_sse_algorithm
       }
     }
   }
 }
 
 resource "aws_s3_bucket_public_access_block" "backend" {
-  bucket = "${aws_s3_bucket.backend.id}"
+  bucket = aws_s3_bucket.backend.id
 
   block_public_acls       = true
   block_public_policy     = true

outputs.tf

@@ -1,11 +1,14 @@
 output "state_bucket_id" {
-  value = "${aws_s3_bucket.backend.id}"
+  value = aws_s3_bucket.backend.id
 }
 
 output "dynamo_lock_table" {
-  value = "${aws_dynamodb_table.lock.id}"
+  value = aws_dynamodb_table.lock.id
 }
 
 output "iam_roles" {
-  value = "${concat(aws_iam_role.backend-all.*.arn, aws_iam_role.backend-restricted.*.arn)}"
+  value = concat(
+    aws_iam_role.backend-all.*.arn,
+    aws_iam_role.backend-restricted.*.arn,
+  )
 }

versions.tf

@@ -0,0 +1,4 @@
+
+terraform {
+  required_version = ">= 0.12"
+}