mirror of
https://github.com/Sea-Haven-Industries/payments-dashboard.git
synced 2026-09-30 04:13:12 +00:00
0e3e95c240
Some checks are pending
Deploy / Deploy to prod (push) Waiting to run
* feat(infra): migrate payments-dashboard to HCP Terraform (PLAT-79) Replace the mgmt SAM stack with a prod-only HCP workspace using the afterhours stub-plus-zip-CD seam so GitHub Actions owns function code and Terraform owns infrastructure. * fix(infra): pin secret and CMK ARNs for bootstrap-plan hcptf-bootstrap-plan cannot ssm:GetParameter or DescribeSecret, so the first plan must not data-source those values. * fix(infra): add EIP describe and DynamoDB CMK grants for first apply Scoped apply missed ec2:DescribeAddressesAttribute and kms Encrypt/Decrypt/GenerateDataKey on the table CMK.
145 lines
3.1 KiB
HCL
145 lines
3.1 KiB
HCL
data "aws_availability_zones" "available" {
|
|
state = "available"
|
|
}
|
|
|
|
resource "aws_vpc" "this" {
|
|
cidr_block = "10.20.0.0/16"
|
|
enable_dns_support = true
|
|
enable_dns_hostnames = true
|
|
|
|
tags = {
|
|
Name = "payments-dashboard-vpc"
|
|
}
|
|
}
|
|
|
|
resource "aws_subnet" "private" {
|
|
vpc_id = aws_vpc.this.id
|
|
cidr_block = "10.20.1.0/24"
|
|
availability_zone = data.aws_availability_zones.available.names[0]
|
|
|
|
tags = {
|
|
Name = "payments-dashboard-private"
|
|
}
|
|
}
|
|
|
|
resource "aws_subnet" "public" {
|
|
vpc_id = aws_vpc.this.id
|
|
cidr_block = "10.20.2.0/24"
|
|
availability_zone = data.aws_availability_zones.available.names[0]
|
|
|
|
tags = {
|
|
Name = "payments-dashboard-public"
|
|
}
|
|
}
|
|
|
|
resource "aws_internet_gateway" "this" {
|
|
vpc_id = aws_vpc.this.id
|
|
|
|
tags = {
|
|
Name = "payments-dashboard-igw"
|
|
}
|
|
}
|
|
|
|
resource "aws_eip" "nat" {
|
|
domain = "vpc"
|
|
|
|
tags = {
|
|
Name = "payments-dashboard-nat"
|
|
}
|
|
|
|
depends_on = [aws_internet_gateway.this]
|
|
}
|
|
|
|
resource "aws_nat_gateway" "this" {
|
|
allocation_id = aws_eip.nat.id
|
|
subnet_id = aws_subnet.public.id
|
|
|
|
tags = {
|
|
Name = "payments-dashboard-nat"
|
|
}
|
|
|
|
depends_on = [aws_internet_gateway.this]
|
|
}
|
|
|
|
resource "aws_route_table" "public" {
|
|
vpc_id = aws_vpc.this.id
|
|
|
|
tags = {
|
|
Name = "payments-dashboard-public"
|
|
}
|
|
}
|
|
|
|
resource "aws_route" "public_default" {
|
|
route_table_id = aws_route_table.public.id
|
|
destination_cidr_block = "0.0.0.0/0"
|
|
gateway_id = aws_internet_gateway.this.id
|
|
}
|
|
|
|
resource "aws_route_table_association" "public" {
|
|
subnet_id = aws_subnet.public.id
|
|
route_table_id = aws_route_table.public.id
|
|
}
|
|
|
|
resource "aws_route_table" "private" {
|
|
vpc_id = aws_vpc.this.id
|
|
|
|
tags = {
|
|
Name = "payments-dashboard-private"
|
|
}
|
|
}
|
|
|
|
resource "aws_route" "private_default" {
|
|
route_table_id = aws_route_table.private.id
|
|
destination_cidr_block = "0.0.0.0/0"
|
|
nat_gateway_id = aws_nat_gateway.this.id
|
|
}
|
|
|
|
resource "aws_route_table_association" "private" {
|
|
subnet_id = aws_subnet.private.id
|
|
route_table_id = aws_route_table.private.id
|
|
}
|
|
|
|
resource "aws_vpc_endpoint" "s3" {
|
|
vpc_id = aws_vpc.this.id
|
|
service_name = "com.amazonaws.${var.aws_region}.s3"
|
|
vpc_endpoint_type = "Gateway"
|
|
route_table_ids = [
|
|
aws_route_table.public.id,
|
|
aws_route_table.private.id,
|
|
]
|
|
|
|
tags = {
|
|
Name = "payments-dashboard-s3"
|
|
}
|
|
}
|
|
|
|
resource "aws_vpc_endpoint" "dynamodb" {
|
|
vpc_id = aws_vpc.this.id
|
|
service_name = "com.amazonaws.${var.aws_region}.dynamodb"
|
|
vpc_endpoint_type = "Gateway"
|
|
route_table_ids = [
|
|
aws_route_table.public.id,
|
|
aws_route_table.private.id,
|
|
]
|
|
|
|
tags = {
|
|
Name = "payments-dashboard-dynamodb"
|
|
}
|
|
}
|
|
|
|
resource "aws_security_group" "lambda" {
|
|
name = "payments-dashboard-lambda"
|
|
description = "Payments Dashboard Lambda outbound access"
|
|
vpc_id = aws_vpc.this.id
|
|
|
|
tags = {
|
|
Name = "payments-dashboard-lambda"
|
|
}
|
|
}
|
|
|
|
resource "aws_vpc_security_group_egress_rule" "lambda_all" {
|
|
security_group_id = aws_security_group.lambda.id
|
|
ip_protocol = "-1"
|
|
cidr_ipv4 = "0.0.0.0/0"
|
|
description = "All outbound for BoA and AWS APIs"
|
|
}
|