Skip to content

Commit fa2fd4d

Browse files
mglotovp1gmale0n
mglotov
authored and
p1gmale0n
committed
enh: use default tags on an aws provider level (#336)
1 parent 1c2ccc6 commit fa2fd4d

File tree

10 files changed

+100
-33
lines changed

10 files changed

+100
-33
lines changed

‎terraform/layer1-aws/README.md

Lines changed: 22 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -3,20 +3,21 @@
33
| Name | Version |
44
|------|---------|
55
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | 1.4.4 |
6-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | 4.62.0 |
6+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | 5.1.0 |
77
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | 2.19.0 |
88

99
## Providers
1010

1111
| Name | Version |
1212
|------|---------|
13-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.62.0 |
13+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.1.0 |
1414

1515
## Modules
1616

1717
| Name | Source | Version |
1818
|------|--------|---------|
1919
| <a name="module_acm"></a> [acm](#module\_acm) | terraform-aws-modules/acm/aws | 4.3.2 |
20+
| <a name="module_aws_cost_allocation_tags"></a> [aws\_cost\_allocation\_tags](#module\_aws\_cost\_allocation\_tags) | ../modules/aws-cost-allocation-tags | n/a |
2021
| <a name="module_aws_ebs_csi_driver"></a> [aws\_ebs\_csi\_driver](#module\_aws\_ebs\_csi\_driver) | terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks | 5.17.0 |
2122
| <a name="module_eks"></a> [eks](#module\_eks) | terraform-aws-modules/eks/aws | 19.12.0 |
2223
| <a name="module_eventbridge"></a> [eventbridge](#module\_eventbridge) | terraform-aws-modules/eventbridge/aws | 1.17.3 |
@@ -30,25 +31,24 @@
3031

3132
| Name | Type |
3233
|------|------|
33-
| [aws_cloudtrail.main](https://registry.terraform.io/providers/hashicorp/aws/4.62.0/docs/resources/cloudtrail) | resource |
34-
| [aws_ebs_encryption_by_default.default](https://registry.terraform.io/providers/hashicorp/aws/4.62.0/docs/resources/ebs_encryption_by_default) | resource |
35-
| [aws_iam_account_password_policy.default](https://registry.terraform.io/providers/hashicorp/aws/4.62.0/docs/resources/iam_account_password_policy) | resource |
36-
| [aws_s3_bucket.cloudtrail](https://registry.terraform.io/providers/hashicorp/aws/4.62.0/docs/resources/s3_bucket) | resource |
37-
| [aws_s3_bucket_acl.cloudtrail](https://registry.terraform.io/providers/hashicorp/aws/4.62.0/docs/resources/s3_bucket_acl) | resource |
38-
| [aws_s3_bucket_lifecycle_configuration.cloudtrail](https://registry.terraform.io/providers/hashicorp/aws/4.62.0/docs/resources/s3_bucket_lifecycle_configuration) | resource |
39-
| [aws_s3_bucket_policy.cloudtrail](https://registry.terraform.io/providers/hashicorp/aws/4.62.0/docs/resources/s3_bucket_policy) | resource |
40-
| [aws_s3_bucket_public_access_block.cloudtrail](https://registry.terraform.io/providers/hashicorp/aws/4.62.0/docs/resources/s3_bucket_public_access_block) | resource |
41-
| [aws_s3_bucket_server_side_encryption_configuration.cloudtrail](https://registry.terraform.io/providers/hashicorp/aws/4.62.0/docs/resources/s3_bucket_server_side_encryption_configuration) | resource |
42-
| [aws_sns_topic.security_alerts](https://registry.terraform.io/providers/hashicorp/aws/4.62.0/docs/resources/sns_topic) | resource |
43-
| [aws_sns_topic_policy.security_alerts](https://registry.terraform.io/providers/hashicorp/aws/4.62.0/docs/resources/sns_topic_policy) | resource |
44-
| [aws_sns_topic_subscription.security_alerts](https://registry.terraform.io/providers/hashicorp/aws/4.62.0/docs/resources/sns_topic_subscription) | resource |
45-
| [aws_acm_certificate.main](https://registry.terraform.io/providers/hashicorp/aws/4.62.0/docs/data-sources/acm_certificate) | data source |
46-
| [aws_ami.eks_default_bottlerocket](https://registry.terraform.io/providers/hashicorp/aws/4.62.0/docs/data-sources/ami) | data source |
47-
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/4.62.0/docs/data-sources/availability_zones) | data source |
48-
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/4.62.0/docs/data-sources/caller_identity) | data source |
49-
| [aws_eks_cluster_auth.main](https://registry.terraform.io/providers/hashicorp/aws/4.62.0/docs/data-sources/eks_cluster_auth) | data source |
50-
| [aws_route53_zone.main](https://registry.terraform.io/providers/hashicorp/aws/4.62.0/docs/data-sources/route53_zone) | data source |
51-
| [aws_security_group.default](https://registry.terraform.io/providers/hashicorp/aws/4.62.0/docs/data-sources/security_group) | data source |
34+
| [aws_cloudtrail.main](https://registry.terraform.io/providers/hashicorp/aws/5.1.0/docs/resources/cloudtrail) | resource |
35+
| [aws_ebs_encryption_by_default.default](https://registry.terraform.io/providers/hashicorp/aws/5.1.0/docs/resources/ebs_encryption_by_default) | resource |
36+
| [aws_iam_account_password_policy.default](https://registry.terraform.io/providers/hashicorp/aws/5.1.0/docs/resources/iam_account_password_policy) | resource |
37+
| [aws_s3_bucket.cloudtrail](https://registry.terraform.io/providers/hashicorp/aws/5.1.0/docs/resources/s3_bucket) | resource |
38+
| [aws_s3_bucket_lifecycle_configuration.cloudtrail](https://registry.terraform.io/providers/hashicorp/aws/5.1.0/docs/resources/s3_bucket_lifecycle_configuration) | resource |
39+
| [aws_s3_bucket_policy.cloudtrail](https://registry.terraform.io/providers/hashicorp/aws/5.1.0/docs/resources/s3_bucket_policy) | resource |
40+
| [aws_s3_bucket_public_access_block.cloudtrail](https://registry.terraform.io/providers/hashicorp/aws/5.1.0/docs/resources/s3_bucket_public_access_block) | resource |
41+
| [aws_s3_bucket_server_side_encryption_configuration.cloudtrail](https://registry.terraform.io/providers/hashicorp/aws/5.1.0/docs/resources/s3_bucket_server_side_encryption_configuration) | resource |
42+
| [aws_sns_topic.security_alerts](https://registry.terraform.io/providers/hashicorp/aws/5.1.0/docs/resources/sns_topic) | resource |
43+
| [aws_sns_topic_policy.security_alerts](https://registry.terraform.io/providers/hashicorp/aws/5.1.0/docs/resources/sns_topic_policy) | resource |
44+
| [aws_sns_topic_subscription.security_alerts](https://registry.terraform.io/providers/hashicorp/aws/5.1.0/docs/resources/sns_topic_subscription) | resource |
45+
| [aws_acm_certificate.main](https://registry.terraform.io/providers/hashicorp/aws/5.1.0/docs/data-sources/acm_certificate) | data source |
46+
| [aws_ami.eks_default_bottlerocket](https://registry.terraform.io/providers/hashicorp/aws/5.1.0/docs/data-sources/ami) | data source |
47+
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/5.1.0/docs/data-sources/availability_zones) | data source |
48+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/5.1.0/docs/data-sources/caller_identity) | data source |
49+
| [aws_eks_cluster_auth.main](https://registry.terraform.io/providers/hashicorp/aws/5.1.0/docs/data-sources/eks_cluster_auth) | data source |
50+
| [aws_route53_zone.main](https://registry.terraform.io/providers/hashicorp/aws/5.1.0/docs/data-sources/route53_zone) | data source |
51+
| [aws_security_group.default](https://registry.terraform.io/providers/hashicorp/aws/5.1.0/docs/data-sources/security_group) | data source |
5252

5353
## Inputs
5454

@@ -75,6 +75,7 @@
7575
| <a name="input_eks_workers_additional_policies"></a> [eks\_workers\_additional\_policies](#input\_eks\_workers\_additional\_policies) | Additional IAM policy attached to EKS worker nodes | `map(string)` | <pre>{<br> "additional": "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"<br>}</pre> | no |
7676
| <a name="input_eks_write_kubeconfig"></a> [eks\_write\_kubeconfig](#input\_eks\_write\_kubeconfig) | Flag for eks module to write kubeconfig | `bool` | `false` | no |
7777
| <a name="input_environment"></a> [environment](#input\_environment) | Env name in case workspace wasn't used | `string` | `"demo"` | no |
78+
| <a name="input_is_this_payment_account"></a> [is\_this\_payment\_account](#input\_is\_this\_payment\_account) | Set it to false if a target account isn't a payer account. This variable is used to apply a configuration for cost allocation tags | `bool` | `true` | no |
7879
| <a name="input_name"></a> [name](#input\_name) | Project name, required to create unique resource names | `any` | n/a | yes |
7980
| <a name="input_node_group_br"></a> [node\_group\_br](#input\_node\_group\_br) | Bottlerocket node group configuration | <pre>object({<br> instance_type = string<br> max_capacity = number<br> min_capacity = number<br> desired_capacity = number<br> capacity_rebalance = bool<br> use_mixed_instances_policy = bool<br> mixed_instances_policy = any<br> })</pre> | <pre>{<br> "capacity_rebalance": true,<br> "desired_capacity": 0,<br> "instance_type": "t3.medium",<br> "max_capacity": 5,<br> "min_capacity": 0,<br> "mixed_instances_policy": {<br> "instances_distribution": {<br> "on_demand_base_capacity": 0,<br> "on_demand_percentage_above_base_capacity": 0<br> },<br> "override": [<br> {<br> "instance_type": "t3.medium"<br> },<br> {<br> "instance_type": "t3a.medium"<br> }<br> ]<br> },<br> "use_mixed_instances_policy": true<br>}</pre> | no |
8081
| <a name="input_node_group_ci"></a> [node\_group\_ci](#input\_node\_group\_ci) | CI node group configuration | <pre>object({<br> instance_type = string<br> max_capacity = number<br> min_capacity = number<br> desired_capacity = number<br> capacity_rebalance = bool<br> use_mixed_instances_policy = bool<br> mixed_instances_policy = any<br> })</pre> | <pre>{<br> "capacity_rebalance": false,<br> "desired_capacity": 0,<br> "instance_type": "t3.medium",<br> "max_capacity": 5,<br> "min_capacity": 0,<br> "mixed_instances_policy": {<br> "instances_distribution": {<br> "on_demand_base_capacity": 0,<br> "on_demand_percentage_above_base_capacity": 0<br> },<br> "override": [<br> {<br> "instance_type": "t3.medium"<br> },<br> {<br> "instance_type": "t3a.medium"<br> }<br> ]<br> },<br> "use_mixed_instances_policy": true<br>}</pre> | no |

‎terraform/layer1-aws/aws-cloudtrail.tf

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,6 @@ resource "aws_s3_bucket" "cloudtrail" {
1919
tags = local.tags
2020
}
2121

22-
resource "aws_s3_bucket_acl" "cloudtrail" {
23-
bucket = aws_s3_bucket.cloudtrail.id
24-
acl = "private"
25-
}
26-
2722
resource "aws_s3_bucket_lifecycle_configuration" "cloudtrail" {
2823
bucket = aws_s3_bucket.cloudtrail.id
2924

‎terraform/layer1-aws/aws-eks.tf

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -56,11 +56,6 @@ module "eks" {
5656
cluster_enabled_log_types = var.eks_cluster_enabled_log_types
5757
cloudwatch_log_group_retention_in_days = var.eks_cloudwatch_log_group_retention_in_days
5858

59-
tags = {
60-
ClusterName = local.name
61-
Environment = local.env
62-
}
63-
6459
vpc_id = module.vpc.vpc_id
6560

6661
cluster_endpoint_public_access = var.eks_cluster_endpoint_public_access
@@ -185,6 +180,7 @@ module "eks" {
185180
}
186181
}
187182

183+
tags = { "ClusterName" = local.name }
188184
}
189185

190186
module "vpc_cni_irsa" {

‎terraform/layer1-aws/main.tf

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = "4.62.0"
7+
version = "5.1.0"
88
}
99
kubernetes = {
1010
source = "hashicorp/kubernetes"
@@ -33,3 +33,24 @@ resource "aws_iam_account_password_policy" "default" {
3333
allow_users_to_change_password = var.aws_account_password_policy.allow_users_to_change_password
3434
max_password_age = var.aws_account_password_policy.max_password_age
3535
}
36+
37+
38+
module "aws_cost_allocation_tags" {
39+
count = var.is_this_payment_account ? 1 : 0
40+
41+
source = "../modules/aws-cost-allocation-tags"
42+
tags = [
43+
{
44+
tag_key = "Environment"
45+
status = "Active"
46+
},
47+
{
48+
tag_key = "Terraform"
49+
status = "Active"
50+
},
51+
{
52+
tag_key = "aws:autoscaling:groupName"
53+
status = "Active"
54+
}
55+
]
56+
}

‎terraform/layer1-aws/providers.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,13 @@
11
provider "aws" {
22
region = var.region
33
allowed_account_ids = var.allowed_account_ids
4+
default_tags {
5+
tags = {
6+
Name = local.name
7+
Environment = local.env
8+
Terraform = "true"
9+
}
10+
}
411
}
512

613
provider "kubernetes" {

‎terraform/layer1-aws/variables.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,11 @@ variable "aws_account_password_policy" {
2121
}
2222
}
2323

24+
variable "is_this_payment_account" {
25+
default = true
26+
description = "Set it to false if a target account isn't a payer account. This variable is used to apply a configuration for cost allocation tags"
27+
}
28+
2429
variable "name" {
2530
description = "Project name, required to create unique resource names"
2631
}

‎terraform/modules/aws-cost-allocation-tags/README.md

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
## Requirements
2+
3+
No requirements.
4+
5+
## Providers
6+
7+
| Name | Version |
8+
|------|---------|
9+
| <a name="provider_aws"></a> [aws](#provider\_aws) | n/a |
10+
11+
## Modules
12+
13+
No modules.
14+
15+
## Resources
16+
17+
| Name | Type |
18+
|------|------|
19+
| [aws_ce_cost_allocation_tag.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ce_cost_allocation_tag) | resource |
20+
21+
## Inputs
22+
23+
| Name | Description | Type | Default | Required |
24+
|------|-------------|------|---------|:--------:|
25+
| <a name="input_tags"></a> [tags](#input\_tags) | A list of tags to use for cost allocation tags | <pre>list(object({<br> tag_key = string<br> status = string<br> }))</pre> | n/a | yes |
26+
27+
## Outputs
28+
29+
No outputs.

‎terraform/modules/aws-cost-allocation-tags/main.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
resource "aws_ce_cost_allocation_tag" "this" {
2+
for_each = { for item in var.tags : item.tag_key => item }
3+
4+
tag_key = each.value.tag_key
5+
status = each.value.status
6+
}

‎terraform/modules/aws-cost-allocation-tags/variables.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
variable "tags" {
2+
type = list(object({
3+
tag_key = string
4+
status = string
5+
}))
6+
description = "A list of tags to use for cost allocation tags"
7+
}

‎terraform/modules/aws-pritunl/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
data "aws_region" "current" {}
22
resource "aws_eip" "this" {
3-
vpc = true
3+
domain = "vpc"
44
tags = {
55
Name = var.name
66
Environment = var.environment

0 commit comments

Comments
 (0)