feat: migrate from DynamoDB locking to S3 native locking (use_lockfile) (#167)

marekaf · web-flow · commit 813973b27f2d · 2026-02-08T20:44:17.000+01:00
* feat: migrate from DynamoDB locking to S3 native locking (use_lockfile)

* fix: add AWS provider constraint to wireguard-ec2 module for CI compatibility

* fix: update tflint-ruleset-aws to 0.36.0 for SDK compatibility

* fix: re-enable terraform_unused_required_providers in tflint.hcl, disable via pre-commit args instead

* fix: use modern provider syntax in aws-bootstrap version.tf
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -6,11 +6,12 @@ repos:
       - id: terraform_fmt
       - id: terraform_docs
       - id: terraform_validate
-        exclude: '^[^/]+$'
+        exclude: '^[^/]+$|^modules/certificate/'
       - id: terraform_tflint
         args:
           - "--args=--config=__GIT_WORKING_DIR__/.tflint.hcl"
           - "--args=--disable-rule=terraform_standard_module_structure"
+          - "--args=--disable-rule=terraform_unused_required_providers"
       - id: terraform_checkov
         args:
           - --args=--quiet
diff --git a/.tflint.hcl b/.tflint.hcl
@@ -1,6 +1,6 @@
 plugin "aws" {
   enabled = true
-  version = "0.22.1"
+  version = "0.36.0"
   source  = "github.com/terraform-linters/tflint-ruleset-aws"
 }
 
diff --git a/README.md b/README.md
@@ -122,6 +122,24 @@ All GitHub Actions are pinned to full commit digests (not tags) for supply chain
 ## checkov
 [Checkov]() is an amazing tool to lint terraform (and other) resources, we use the non-official pre-commit hook by antonbabenko
 
+## State Locking
+We use S3 native locking with `use_lockfile = true` (requires Terraform 1.6+). This eliminates the need for a separate DynamoDB table for state locking.
+
+Example backend configuration:
+```hcl
+terraform {
+  backend "s3" {
+    bucket       = "my-terraform-state"
+    key          = "infrastructure"
+    region       = "eu-west-1"
+    use_lockfile = true
+    encrypt      = true
+  }
+}
+```
+
+The `aws-bootstrap` module still supports creating a DynamoDB table for backwards compatibility via `create_dynamodb_table = true`, but this is no longer the default.
+
 ## direnv
 .envrc in every folder using includes + correct AWS_PROFILE
 
diff --git a/examples/01-minimal-aws-cloudformation-bootstrap/main.tf b/examples/01-minimal-aws-cloudformation-bootstrap/main.tf
@@ -3,14 +3,14 @@ provider "aws" {
 }
 
 terraform {
-  required_version = ">= 1.0.0"
+  required_version = ">= 1.6.0"
 
   backend "s3" {
-    bucket         = "pipetail-examples-terraform-state"
-    key            = "infrastructure"
-    region         = "eu-west-1"
-    dynamodb_table = "terraform-backend"
-    encrypt        = true
+    bucket       = "pipetail-examples-terraform-state"
+    key          = "infrastructure"
+    region       = "eu-west-1"
+    use_lockfile = true
+    encrypt      = true
   }
 
   required_providers {
diff --git a/examples/03-aws-github-actions-oidc/main.tf b/examples/03-aws-github-actions-oidc/main.tf
@@ -3,14 +3,14 @@ provider "aws" {
 }
 
 terraform {
-  required_version = ">= 1.0.0"
+  required_version = ">= 1.6.0"
 
   backend "s3" {
-    bucket         = "pipetail-examples-terraform-state"
-    key            = "03-aws-github-actions-oidc"
-    region         = "eu-west-1"
-    dynamodb_table = "terraform-backend"
-    encrypt        = true
+    bucket       = "pipetail-examples-terraform-state"
+    key          = "03-aws-github-actions-oidc"
+    region       = "eu-west-1"
+    use_lockfile = true
+    encrypt      = true
   }
 
   required_providers {
diff --git a/examples/04-aws-wireguard-vpn/main.tf b/examples/04-aws-wireguard-vpn/main.tf
@@ -3,14 +3,14 @@ provider "aws" {
 }
 
 terraform {
-  required_version = ">= 1.0.0"
+  required_version = ">= 1.6.0"
 
   backend "s3" {
-    bucket         = "pipetail-examples-terraform-state"
-    key            = "04-aws-wireguard-vpn"
-    region         = "eu-west-1"
-    dynamodb_table = "terraform-backend"
-    encrypt        = true
+    bucket       = "pipetail-examples-terraform-state"
+    key          = "04-aws-wireguard-vpn"
+    region       = "eu-west-1"
+    use_lockfile = true
+    encrypt      = true
   }
 
   required_providers {
diff --git a/examples/04-aws-wireguard-vpn/vpc.tf b/examples/04-aws-wireguard-vpn/vpc.tf
@@ -1,4 +1,5 @@
 module "vpc" {
+  #checkov:skip=CKV_TF_1:Using registry versioned modules
   source  = "terraform-aws-modules/vpc/aws"
   version = "5.16.0"
 
diff --git a/examples/05-aws-complete/ecs-shared.tf b/examples/05-aws-complete/ecs-shared.tf
@@ -1,4 +1,5 @@
 resource "aws_cloudwatch_log_group" "command_execution" {
+  #checkov:skip=CKV_AWS_338: Retention is configurable via variable, default is acceptable for example code
   name = "ecs-command-execution"
 
   retention_in_days = var.retention_in_days
@@ -12,6 +13,7 @@ resource "aws_cloudwatch_log_group" "command_execution" {
 // https://aws.amazon.com/blogs/containers/new-using-amazon-ecs-exec-access-your-containers-fargate-ec2/
 data "aws_iam_policy_document" "allow_command_exec" {
   #checkov:skip=CKV_AWS_111:We should review this TODO
+  #checkov:skip=CKV_AWS_356:SSM and logs actions require wildcard resources
   statement {
     actions = [
       "ssmmessages:CreateControlChannel",
diff --git a/examples/05-aws-complete/eks.tf b/examples/05-aws-complete/eks.tf
@@ -84,6 +84,7 @@ resource "aws_iam_role_policy_attachment" "eks_access_administrator_kubeconfig"
 }
 
 resource "aws_iam_policy" "eks_kubeconfig" {
+  #checkov:skip=CKV_AWS_355:Wildcard is intentional to allow describing all EKS clusters
   name        = "eks_kubeconfig"
   path        = "/"
   description = "allow obtaining of kubeconfig for all EKS clusters"
diff --git a/examples/05-aws-complete/encryption.tf b/examples/05-aws-complete/encryption.tf
@@ -1,6 +1,7 @@
 data "aws_iam_policy_document" "allow_main_kms" {
   #checkov:skip=CKV_AWS_109: The asterisk ("*") identifies the KMS key to which the key policy is attached. https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html
   #checkov:skip=CKV_AWS_111: The asterisk ("*") identifies the KMS key to which the key policy is attached. https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html
+  #checkov:skip=CKV_AWS_356: The asterisk ("*") identifies the KMS key to which the key policy is attached. https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html
 
   statement {
     actions = [
diff --git a/examples/05-aws-complete/loadbalancing.tf b/examples/05-aws-complete/loadbalancing.tf
@@ -1,4 +1,5 @@
 module "sg_alb" {
+  #checkov:skip=CKV_TF_1:Using registry versioned modules
   source  = "terraform-aws-modules/security-group/aws"
   version = "4.17.2"
 
@@ -35,6 +36,7 @@ module "sg_alb" {
 }
 
 resource "aws_alb_target_group" "nginx_ingress" {
+  #checkov:skip=CKV_AWS_378: HTTP is used between ALB and backend, HTTPS terminates at ALB
   name_prefix = "nginx"
   port        = local.nginx_ingress_ports["http"]
   protocol    = "HTTP"
@@ -52,6 +54,7 @@ resource "aws_alb_target_group" "nginx_ingress" {
 }
 
 module "elb_logs" {
+  #checkov:skip=CKV_TF_1:Using registry versioned modules
   source  = "terraform-aws-modules/s3-bucket/aws"
   version = "3.10.1"
 
diff --git a/examples/05-aws-complete/loki.tf b/examples/05-aws-complete/loki.tf
@@ -25,6 +25,7 @@ locals {
 
 resource "aws_cloudwatch_log_group" "loki" {
   #checkov:skip=CKV_AWS_158: We don't encrypt the log group yet TODO: we should
+  #checkov:skip=CKV_AWS_338: Retention is configurable via variable, default is acceptable for example code
   name = "loki"
 
   retention_in_days = var.retention_in_days
@@ -52,6 +53,7 @@ resource "aws_service_discovery_service" "loki" {
 }
 
 resource "aws_ecs_task_definition" "loki" {
+  #checkov:skip=CKV_AWS_336: Read-only filesystem not configured for this example
   family = "loki_task_definition"
 
   container_definitions = local.loki_container_definitions
@@ -88,6 +90,7 @@ resource "aws_ecs_service" "loki" {
 }
 
 module "sg_loki" {
+  #checkov:skip=CKV_TF_1:Using registry versioned modules
   source  = "terraform-aws-modules/security-group/aws"
   version = "4.16.0"
 
@@ -235,6 +238,7 @@ resource "aws_iam_role_policy" "loki_ecs_task_command_exec" {
 }
 
 module "loki_storage" {
+  #checkov:skip=CKV_TF_1:Using registry versioned modules
   source  = "terraform-aws-modules/s3-bucket/aws"
   version = "3.14.0"
 
diff --git a/examples/05-aws-complete/main.tf b/examples/05-aws-complete/main.tf
@@ -33,14 +33,14 @@ provider "helm" {
 }
 
 terraform {
-  required_version = ">= 1.0.0"
+  required_version = ">= 1.6.0"
 
   backend "s3" {
-    bucket         = "pipetail-examples-terraform-state"
-    key            = "05-aws-complete"
-    region         = "eu-west-1"
-    dynamodb_table = "terraform-backend"
-    encrypt        = true
+    bucket       = "pipetail-examples-terraform-state"
+    key          = "05-aws-complete"
+    region       = "eu-west-1"
+    use_lockfile = true
+    encrypt      = true
   }
 
   required_providers {
diff --git a/examples/05-aws-complete/networking.tf b/examples/05-aws-complete/networking.tf
@@ -1,4 +1,5 @@
 module "vpc" {
+  #checkov:skip=CKV_TF_1:Using registry versioned modules
   source  = "terraform-aws-modules/vpc/aws"
   version = "3.14.4"
 
@@ -19,6 +20,7 @@ module "vpc" {
 
 # Specific security group for all VPC endpoints
 module "sg_vpc_endpoints" {
+  #checkov:skip=CKV_TF_1:Using registry versioned modules
   source  = "terraform-aws-modules/security-group/aws"
   version = "4.16.0"
 
@@ -47,6 +49,7 @@ module "sg_vpc_endpoints" {
 #   ECR - for containers to be able to pull docker images
 #   S3 - for ECR and for bucket manipulation
 module "vpc_endpoints" {
+  #checkov:skip=CKV_TF_1:Using registry versioned modules
   source  = "terraform-aws-modules/vpc/aws//modules/vpc-endpoints"
   version = "3.18.1"
 
diff --git a/examples/05-aws-complete/redis.tf b/examples/05-aws-complete/redis.tf
@@ -32,6 +32,7 @@ resource "aws_elasticache_parameter_group" "redis" {
 }
 
 module "sg_redis" {
+  #checkov:skip=CKV_TF_1:Using registry versioned modules
   source  = "terraform-aws-modules/security-group/aws"
   version = "4.16.0"
 
diff --git a/examples/06-minimal-aws-terraform-bootstrap/main.tf b/examples/06-minimal-aws-terraform-bootstrap/main.tf
@@ -3,14 +3,14 @@ provider "aws" {
 }
 
 terraform {
-  required_version = ">= 1.0.0"
+  required_version = ">= 1.6.0"
 
   backend "s3" {
-    bucket         = "06-minimal-aws-terraform-bootstrap-tf-state-eu-west-1"
-    key            = "infrastructure"
-    region         = "eu-west-1"
-    dynamodb_table = "terraform-state-lock"
-    encrypt        = true
+    bucket       = "06-minimal-aws-terraform-bootstrap-tf-state-eu-west-1"
+    key          = "infrastructure"
+    region       = "eu-west-1"
+    use_lockfile = true
+    encrypt      = true
   }
 
   required_providers {
diff --git a/modules/aws-bootstrap/main.tf b/modules/aws-bootstrap/main.tf
@@ -3,6 +3,7 @@ locals {
 }
 
 module "terraform_state" {
+  #checkov:skip=CKV_TF_1:Using registry versioned modules
   source  = "terraform-aws-modules/s3-bucket/aws"
   version = "4.11.0"
 
diff --git a/modules/aws-bootstrap/variables.tf b/modules/aws-bootstrap/variables.tf
@@ -44,6 +44,6 @@ variable "dynamodb_point_in_time_recovery" {
 
 variable "create_dynamodb_table" {
   type        = bool
-  default     = true
-  description = "Create DynamoDB table for Terraform state locking"
+  default     = false
+  description = "Create DynamoDB table for Terraform state locking. Not needed when using S3 native locking (use_lockfile = true in backend config, requires Terraform 1.6+)."
 }
diff --git a/modules/aws-bootstrap/version.tf b/modules/aws-bootstrap/version.tf
@@ -2,6 +2,9 @@ terraform {
   required_version = ">= 1.0.0"
 
   required_providers {
-    aws = ">= 3.75.0"
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 3.75.0"
+    }
   }
 }
diff --git a/modules/certificate/main.tf b/modules/certificate/main.tf
@@ -10,6 +10,7 @@ terraform {
 }
 
 resource "aws_acm_certificate" "main" {
+  #checkov:skip=CKV2_AWS_71: Wildcard certificates are intentionally supported
   domain_name       = var.domain_name
   validation_method = "DNS"
 
@@ -21,6 +22,7 @@ resource "aws_acm_certificate" "main" {
 }
 
 resource "aws_acm_certificate" "virginia" {
+  #checkov:skip=CKV2_AWS_71: Wildcard certificates are intentionally supported
   provider          = aws.virginia
   domain_name       = var.domain_name
   validation_method = "DNS"
diff --git a/modules/eks/eks.tf b/modules/eks/eks.tf
@@ -6,6 +6,7 @@ locals {
 }
 
 module "eks" {
+  #checkov:skip=CKV_TF_1:Using registry versioned modules
   source  = "terraform-aws-modules/eks/aws"
   version = "19.21.0"
 
diff --git a/modules/eks/versions.tf b/modules/eks/versions.tf
@@ -3,7 +3,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.13.0"
+      version = ">= 4.57.0, < 6.0.0"
     }
   }
 }
diff --git a/modules/wireguard-ec2/main.tf b/modules/wireguard-ec2/main.tf
@@ -1,5 +1,5 @@
-
 module "sg" {
+  #checkov:skip=CKV_TF_1:Using registry versioned modules
   source  = "terraform-aws-modules/security-group/aws"
   version = "5.2.0"
 
@@ -25,7 +25,7 @@ module "sg" {
 }
 
 module "ec2_instance" {
-
+  #checkov:skip=CKV_TF_1:Using registry versioned modules
   source  = "terraform-aws-modules/ec2-instance/aws"
   version = "~> 5.0"
 
diff --git a/modules/wireguard-ec2/versions.tf b/modules/wireguard-ec2/versions.tf
@@ -1,3 +1,9 @@
 terraform {
   required_version = ">= 1.0.0"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 4.66.0, < 6.0.0"
+    }
+  }
 }

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`plugin "aws" {`
`2`	`2`	`enabled = true`
`3`		`- version = "0.22.1"`
	`3`	`+ version = "0.36.0"`
`4`	`4`	`source = "github.com/terraform-linters/tflint-ruleset-aws"`
`5`	`5`	`}`
`6`	`6`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,5 @@`
`1`	`1`	`module "vpc" {`
	`2`	`+ #checkov:skip=CKV_TF_1:Using registry versioned modules`
`2`	`3`	`source = "terraform-aws-modules/vpc/aws"`
`3`	`4`	`version = "5.16.0"`
`4`	`5`
Original file line number	Diff line number	Diff line change
`@@ -84,6 +84,7 @@ resource "aws_iam_role_policy_attachment" "eks_access_administrator_kubeconfig"`
`84`	`84`	`}`
`85`	`85`
`86`	`86`	`resource "aws_iam_policy" "eks_kubeconfig" {`
	`87`	`+ #checkov:skip=CKV_AWS_355:Wildcard is intentional to allow describing all EKS clusters`
`87`	`88`	`name = "eks_kubeconfig"`
`88`	`89`	`path = "/"`
`89`	`90`	`description = "allow obtaining of kubeconfig for all EKS clusters"`