mirror of
https://github.com/Sea-Haven-Industries/shoc-backend.git
synced 2026-10-01 18:03:13 +00:00
Adam Moussa
25c2e84e8f
Add import-only dev and staging state with least-privilege HCP authentication and plan safety guards.
43 lines
2.2 KiB
HCL
43 lines
2.2 KiB
HCL
data "aws_caller_identity" "current" {}
|
|
|
|
data "aws_iam_openid_connect_provider" "terraform_cloud" {
|
|
count = var.create_tfc_oidc_provider ? 0 : 1
|
|
url = "https://app.terraform.io"
|
|
}
|
|
|
|
locals {
|
|
account_id = data.aws_caller_identity.current.account_id
|
|
|
|
hcp_sub_prefix = "organization:${var.hcp_organization}:project:${var.hcp_project}:workspace:${var.hcp_workload_workspace}:run_phase"
|
|
|
|
tfc_oidc_arn = var.create_tfc_oidc_provider ? aws_iam_openid_connect_provider.terraform_cloud[0].arn : data.aws_iam_openid_connect_provider.terraform_cloud[0].arn
|
|
|
|
github_deploy_role_arn = "arn:aws:iam::${local.account_id}:role/tf-managed/${var.github_deploy_role_name}"
|
|
eb_ec2_role_arn = "arn:aws:iam::${local.account_id}:role/tf-managed/${var.eb_ec2_role_name}"
|
|
github_oidc_arn = "arn:aws:iam::${local.account_id}:oidc-provider/token.actions.githubusercontent.com"
|
|
hosted_zone_arn = "arn:aws:route53:::hostedzone/${var.hosted_zone_id}"
|
|
eb_service_role_arn = "arn:aws:iam::${local.account_id}:role/${var.eb_service_role_name}"
|
|
|
|
application_arn = "arn:aws:elasticbeanstalk:${var.aws_region}:${local.account_id}:application/${var.eb_application_name}"
|
|
environment_arn = "arn:aws:elasticbeanstalk:${var.aws_region}:${local.account_id}:environment/${var.eb_application_name}/${var.eb_environment_name}"
|
|
rds_arn = "arn:aws:rds:${var.aws_region}:${local.account_id}:db:${var.rds_identifier}"
|
|
|
|
live_protected_role_arns = [
|
|
"arn:aws:iam::${local.account_id}:role/githubdeploy-shoc-backend-dev",
|
|
"arn:aws:iam::${local.account_id}:role/cdk-hnb659fds-*",
|
|
"arn:aws:iam::${local.account_id}:role/OrganizationAccountAccessRole",
|
|
"arn:aws:iam::${local.account_id}:role/shoc-backend-dev",
|
|
]
|
|
|
|
live_eb_environment_arn = "arn:aws:elasticbeanstalk:${var.aws_region}:${local.account_id}:environment/shoc-backend/shoc-backend-dev"
|
|
live_cfn_stack_arn = "arn:aws:cloudformation:${var.aws_region}:${local.account_id}:stack/awseb-e-hehnrqjjrt-stack/*"
|
|
}
|
|
|
|
resource "terraform_data" "account_guard" {
|
|
lifecycle {
|
|
precondition {
|
|
condition = local.account_id == var.aws_account_id
|
|
error_message = "Refuse to apply outside seahaven-external-dev (${var.aws_account_id}). Caller is ${local.account_id}."
|
|
}
|
|
}
|
|
}
|