Skip to content

Commit 19641fa

Browse files
damienjburksdamienjburks
committed
updating codebase
1 parent 62ae688 commit 19641fa

File tree

11 files changed

+340
-0
lines changed

11 files changed

+340
-0
lines changed

‎.github/workflows/main.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
on:
2+
push:
3+
branches:
4+
- main
5+
workflow_dispatch:
6+
7+
jobs:
8+
terraform-apply:
9+
uses: ./.github/workflows/terraform-apply.yml
10+
permissions:
11+
contents: read
12+
secrets: inherit

‎.github/workflows/terraform-apply.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: "Terraform Apply"
2+
3+
on:
4+
workflow_call:
5+
6+
env:
7+
TF_CLOUD_ORGANIZATION: "DSB"
8+
TF_API_TOKEN: "${{ secrets.TF_API_TOKEN }}"
9+
TF_WORKSPACE: "dsb-blogging-assistant"
10+
CONFIG_DIRECTORY: "./"
11+
12+
jobs:
13+
terraform:
14+
name: "Terraform Apply"
15+
runs-on: ubuntu-latest
16+
permissions:
17+
contents: read
18+
steps:
19+
- name: Checkout
20+
uses: actions/checkout@v4
21+
22+
- name: Upload Configuration
23+
uses: hashicorp/tfc-workflows-github/actions/[email protected]
24+
id: apply-upload
25+
with:
26+
workspace: ${{ env.TF_WORKSPACE }}
27+
directory: ${{ env.CONFIG_DIRECTORY }}
28+
29+
- name: Create Apply Run
30+
uses: hashicorp/tfc-workflows-github/actions/[email protected]
31+
id: apply-run
32+
with:
33+
workspace: ${{ env.TF_WORKSPACE }}
34+
configuration_version: ${{ steps.apply-upload.outputs.configuration_version_id }}
35+
36+
- name: Apply
37+
uses: hashicorp/tfc-workflows-github/actions/[email protected]
38+
if: fromJSON(steps.apply-run.outputs.payload).data.attributes.actions.IsConfirmable
39+
id: apply
40+
with:
41+
run: ${{ steps.apply-run.outputs.run_id }}
42+
comment: "Apply Run from GitHub Actions CI ${{ github.sha }}"

‎.github/workflows/terraform-lint.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: Terraform Linting and Formatting
2+
3+
on:
4+
workflow_call:
5+
6+
jobs:
7+
lint-and-format:
8+
name: Lint and Format Terraform Files
9+
runs-on: ubuntu-latest
10+
11+
steps:
12+
- name: Checkout repository
13+
uses: actions/checkout@v3
14+
15+
- name: Set up Terraform
16+
uses: hashicorp/setup-terraform@v2
17+
with:
18+
terraform_version: latest
19+
20+
- name: Format Terraform files
21+
run: terraform fmt -check

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
# .tfstate files
55
*.tfstate
66
*.tfstate.*
7+
*.terraform.lock.hcl
78

89
# Crash log files
910
crash.log

‎README.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# AWS DevSecOps Pipeline - Terraform
2+
3+
# Steps
4+
5+
1. Setup Terraform Cloud and create API Key
6+
1. Save key as a token on your local machine and in your repository settings within GitHub
7+
1. Create your GitHub OAUTH Token and save it as an environment variable within Terraform Cloud.

‎buildspecs/buildproject.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
version: 0.2
2+
3+
phases:
4+
install:
5+
commands:
6+
- echo "Starting the install phase..."
7+
pre_build:
8+
commands:
9+
- echo "Starting the pre-build phase..."
10+
build:
11+
commands:
12+
- echo "Hello, World!"
13+
post_build:
14+
commands:
15+
- echo "Build phase complete. Exiting..."

‎buildspecs/ossdepscan.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
version: 0.2
2+
3+
phases:
4+
install:
5+
commands:
6+
- echo "Starting the install phase..."
7+
pre_build:
8+
commands:
9+
- echo "Starting the pre-build phase..."
10+
build:
11+
commands:
12+
- echo "Hello, World!"
13+
post_build:
14+
commands:
15+
- echo "Build phase complete. Exiting..."

‎buildspecs/sastscanning.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
version: 0.2
2+
3+
phases:
4+
install:
5+
commands:
6+
- echo "Starting the install phase..."
7+
pre_build:
8+
commands:
9+
- echo "Starting the pre-build phase..."
10+
build:
11+
commands:
12+
- echo "Hello, World!"
13+
post_build:
14+
commands:
15+
- echo "Build phase complete. Exiting..."

‎main.tf‎

Lines changed: 194 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,194 @@
1+
resource "random_id" "id" {
2+
byte_length = 8
3+
}
4+
5+
resource "aws_s3_bucket" "codepipeline_artifacts" {
6+
bucket = "codepipeline-artifacts-${random_id.id.hex}"
7+
8+
tags = {
9+
Name = "CodePipelineArtifactsBucket"
10+
Environment = "DevSecOps"
11+
}
12+
}
13+
14+
resource "aws_secretsmanager_secret" "github_token" {
15+
name = "github-oauth-token"
16+
description = "GitHub OAuth token for CodePipeline access"
17+
}
18+
19+
resource "aws_secretsmanager_secret_version" "github_token" {
20+
secret_id = aws_secretsmanager_secret.github_token.id
21+
secret_string = "your-personal-access-token" # Replace this with the GitHub Personal Access Token
22+
}
23+
24+
resource "aws_iam_role" "codepipeline_role" {
25+
name = "${var.resource_prefix}-pipeline-role"
26+
27+
assume_role_policy = jsonencode({
28+
Version = "2012-10-17"
29+
Statement = [
30+
{
31+
Action = "sts:AssumeRole"
32+
Effect = "Allow"
33+
Principal = {
34+
Service = "codepipeline.amazonaws.com"
35+
}
36+
}
37+
]
38+
})
39+
}
40+
41+
resource "aws_iam_policy" "codepipeline_policy" {
42+
name = "CodePipelinePolicy-${random_id.id.hex}"
43+
description = "Policy for CodePipeline"
44+
45+
policy = jsonencode({
46+
Version = "2012-10-17"
47+
Statement = [
48+
{
49+
Effect = "Allow"
50+
Action = [
51+
"s3:*",
52+
"codebuild:*",
53+
"iam:PassRole",
54+
"secretsmanager:GetSecretValue"
55+
]
56+
Resource = "*"
57+
}
58+
]
59+
})
60+
}
61+
62+
resource "aws_iam_role_policy_attachment" "codepipeline_policy_attach" {
63+
role = aws_iam_role.codepipeline_role.name
64+
policy_arn = aws_iam_policy.codepipeline_policy.arn
65+
}
66+
67+
resource "aws_codepipeline" "pipeline" {
68+
name = "${var.resource_prefix}-devsecops-pipeline"
69+
role_arn = aws_iam_role.codepipeline_role.arn
70+
71+
artifact_store {
72+
type = "S3"
73+
location = aws_s3_bucket.codepipeline_artifacts.id
74+
}
75+
76+
stage {
77+
name = "Source"
78+
79+
action {
80+
name = "Source"
81+
category = "Source"
82+
owner = "ThirdParty"
83+
provider = "GitHub"
84+
version = "1"
85+
output_artifacts = ["SourceArtifact"]
86+
87+
configuration = {
88+
Owner = "your-github-username"
89+
Repo = "your-repository-name"
90+
Branch = "main"
91+
OAuthToken = aws_secretsmanager_secret_version.github_token.secret_string
92+
}
93+
}
94+
}
95+
96+
97+
stage {
98+
name = "Build"
99+
100+
action {
101+
name = "Build"
102+
category = "Build"
103+
owner = "AWS"
104+
provider = "CodeBuild"
105+
version = "1"
106+
input_artifacts = ["SourceArtifact"]
107+
output_artifacts = ["BuildArtifact"]
108+
109+
configuration = {
110+
ProjectName = aws_codebuild_project.build_project.name
111+
}
112+
}
113+
}
114+
115+
stage {
116+
name = "Scan"
117+
118+
action {
119+
name = "StaticCodeAnalysis"
120+
category = "Test"
121+
owner = "AWS"
122+
provider = "CodeBuild"
123+
version = "1"
124+
input_artifacts = ["BuildArtifact"]
125+
126+
configuration = {
127+
ProjectName = aws_codebuild_project.static_analysis_project.name
128+
}
129+
}
130+
}
131+
}
132+
133+
resource "aws_codebuild_project" "build_project" {
134+
name = "${var.resource_prefix}-build-prj"
135+
service_role = aws_iam_role.codepipeline_role.arn
136+
137+
environment {
138+
compute_type = "BUILD_GENERAL1_SMALL"
139+
image = "aws/codebuild/standard:5.0"
140+
type = "LINUX_CONTAINER"
141+
privileged_mode = true
142+
}
143+
144+
source {
145+
type = "NO_SOURCE"
146+
buildspec = file("./buildspecs/buildproject.yml")
147+
}
148+
149+
artifacts {
150+
type = "CODEPIPELINE"
151+
}
152+
}
153+
154+
resource "aws_codebuild_project" "static_analysis_project" {
155+
name = "${var.resource_prefix}-sast-scanning-prj"
156+
service_role = aws_iam_role.codepipeline_role.arn
157+
158+
environment {
159+
compute_type = "BUILD_GENERAL1_SMALL"
160+
image = "aws/codebuild/standard:5.0"
161+
type = "LINUX_CONTAINER"
162+
privileged_mode = true
163+
}
164+
165+
source {
166+
type = "NO_SOURCE"
167+
buildspec = file("./buildspecs/sastscanning.yml")
168+
}
169+
170+
artifacts {
171+
type = "CODEPIPELINE"
172+
}
173+
}
174+
175+
resource "aws_codebuild_project" "oss_scanning_project" {
176+
name = "${var.resource_prefix}-oss-scanning-prj"
177+
service_role = aws_iam_role.codepipeline_role.arn
178+
179+
environment {
180+
compute_type = "BUILD_GENERAL1_SMALL"
181+
image = "aws/codebuild/standard:5.0"
182+
type = "LINUX_CONTAINER"
183+
privileged_mode = true
184+
}
185+
186+
source {
187+
type = "NO_SOURCE"
188+
buildspec = file("./buildspecs/ossdepscan.yml")
189+
}
190+
191+
artifacts {
192+
type = "CODEPIPELINE"
193+
}
194+
}

‎provider.tf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
provider "aws" {
2+
region = "us-east-1"
3+
}
4+
5+
terraform {
6+
cloud {
7+
organization = "DSB"
8+
9+
workspaces {
10+
name = "dsb-aws-devsecops-pipelines"
11+
}
12+
}
13+
}

0 commit comments

Comments
 (0)