commit c98363857166f52c0072d816f9ab2e8b1d6da6ab Author: Conner McCall Date: Thu Aug 20 07:33:33 2020 -0500 change: initial commit contains sloped.me domain records and backend configuration diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..1eed3c7 --- /dev/null +++ b/.gitignore @@ -0,0 +1,32 @@ +### Terraform ### +# Local .terraform directories +**/.terraform/* + +# .tfstate files +*.tfstate +*.tfstate.* + +# Crash log files +crash.log + +# Ignore any .tfvars files that are generated automatically for each Terraform run. Most +# .tfvars files are managed as part of configuration and so should be included in +# version control. +# +# example.tfvars + +# Ignore override files as they are usually used to override resources locally and so +# are not checked in +override.tf +override.tf.json +*_override.tf +*_override.tf.json + +# Include override files you do wish to add to version control using negated pattern +# !example_override.tf + +# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan +# example: *tfplan* +plan +out.plan +terraform.tfvars diff --git a/remote-backend/README.md b/remote-backend/README.md new file mode 100644 index 0000000..f5667a6 --- /dev/null +++ b/remote-backend/README.md @@ -0,0 +1,6 @@ +# tf-backend-support +These files are used to prepare our terraform backend environment. They create an S3 bucket for storing terraform remote state, another S3 bucket for storing logs of the changes to terraform state for auditing purposes, and creates a DynamoDB table used by terraform for locking and consistency. These configs are only run once to initialize the environment, so these resources are available for the rest of our terraform configs to store remote state and handle locking for to allow for safe use across a team. + +NOTE: there is a known issue with the DynamoDB table disabled ttl attribute, +but you can still `terraform apply` config updates to the two s3 buckets even with this error: +https://github.com/terraform-providers/terraform-provider-aws/issues/10304 diff --git a/remote-backend/main.tf b/remote-backend/main.tf new file mode 100644 index 0000000..90b9f3d --- /dev/null +++ b/remote-backend/main.tf @@ -0,0 +1,97 @@ +# Get the AWS accountID +data "aws_caller_identity" "current" { +} + + +# Create S3 buckets for logging and tfstate +resource "aws_s3_bucket" "tflogs" { + bucket = var.s3bucketlogs + acl = "log-delivery-write" + + tags = { + Name = var.s3bucketlogs + "ManagedBy" = "terraform" + } + + # Enable server-side encryption by default + server_side_encryption_configuration { + rule { + apply_server_side_encryption_by_default { + sse_algorithm = "AES256" + } + } + } +} + +resource "aws_s3_bucket" "tfstate" { + bucket = var.s3bucketstate + + tags = { + Name = var.s3bucketstate + "ManagedBy" = "terraform" + } + + logging { + target_bucket = aws_s3_bucket.tflogs.id + target_prefix = "log/" + } + + versioning { + enabled = true + } + + lifecycle { + prevent_destroy = true + } + + # Enable server-side encryption by default + server_side_encryption_configuration { + rule { + apply_server_side_encryption_by_default { + sse_algorithm = "AES256" + } + } + } +} + +resource "aws_s3_bucket_policy" "tfstate" { + bucket = aws_s3_bucket.tfstate.id + policy = <