@cryptotaxi247 / infra-1 / commits / 9b1732fd

terraform: split state in two

Make it possible for the infra team to take ownership of part of the infra.

zimbatm committed Oct 20, 2023 at 13:10 UTC 9b1732fddb1d5b25a08d845247be13d49d926a5c
20 files changed +187 -25
terraform-iam/.gitignore new
+1
@@ -0,0 +1 @@
1 +/.envrc.local
terraform-iam/README.md new
+40
@@ -0,0 +1,40 @@
1 +# For the bits that are not nixops-able
2 +
3 +This module is for superadmins in the team.
4 +
5 +This terraform root module manages:
6 +* IAM roles
7 +
8 +## Setup
9 +
10 +In order to use this, make sure to install direnv and Nix with flakes enabled.
11 +
12 +Then run `direnv allow` to load the environment with the runtime dependencies.
13 +
14 +Run `aws sso login` to acquire a temporary token.
15 +
16 +## Usage
17 +
18 +The first time the following command has to be run to initialize the state
19 +file and plugins:
20 +
21 +```sh
22 +terraform init
23 +```
24 +
25 +Then run the following command to diff the changes and then apply if approved:
26 +
27 +```sh
28 +terraform apply
29 +```
30 +
31 +## Terraform workflow
32 +
33 +Write the Terraform code and test the changes using `terraform validate`.
34 +
35 +Before committing run `terraform fmt`.
36 +
37 +Once the code is ready to be deployed, create a new PR with the attached
38 +output of `terraform plan`.
39 +
40 +Once the PR is merged, run `terraform apply` to apply the changes.
terraform-iam/aws-config new
+6
@@ -0,0 +1,6 @@
1 +[profile nixos-prod]
2 +sso_start_url = https://nixos.awsapps.com/start
3 +sso_region = eu-north-1
4 +sso_account_id = 080433136561
5 +sso_role_name = AWSAdministratorAccess
6 +region = eu-north-1
terraform-iam/fastlylog.tf new
+4
@@ -0,0 +1,4 @@
1 +module "fastlylogs" {
2 + source = "./fastlylog"
3 + fastly_customer_id = local.fastly_customer_id
4 +}
terraform-iam/fastlylog/main.tf renamed
terraform-iam/fastlylog/outputs.tf renamed
terraform-iam/fastlylog/variables.tf renamed
terraform-iam/flake.lock new
+26
@@ -0,0 +1,26 @@
1 +{
2 + "nodes": {
3 + "nixpkgs": {
4 + "locked": {
5 + "lastModified": 1694092552,
6 + "narHash": "sha256-kEb8kyIFTKt1RLRfsKVVuBG+EY29zp6kWLOtdK9Bcu4=",
7 + "owner": "NixOS",
8 + "repo": "nixpkgs",
9 + "rev": "319a44b173a6467859b6c8e60d96e2287526f685",
10 + "type": "github"
11 + },
12 + "original": {
13 + "id": "nixpkgs",
14 + "ref": "master",
15 + "type": "indirect"
16 + }
17 + },
18 + "root": {
19 + "inputs": {
20 + "nixpkgs": "nixpkgs"
21 + }
22 + }
23 + },
24 + "root": "root",
25 + "version": 7
26 +}
terraform-iam/flake.nix new
+26
@@ -0,0 +1,26 @@
1 +{
2 + inputs.nixpkgs.url = "nixpkgs/master";
3 +
4 + outputs = flakes @ { self, nixpkgs }: {
5 +
6 + devShell.x86_64-linux =
7 + with import nixpkgs { system = "x86_64-linux"; };
8 + mkShell {
9 + packages = [
10 + awscli2
11 + (terraform.withPlugins (p: with p; [
12 + aws
13 + fastly
14 + netlify
15 + secret
16 + ]))
17 + ];
18 +
19 + shellHook = ''
20 + alias tf=terraform
21 + '';
22 + };
23 +
24 + };
25 +
26 +}
terraform-iam/locals.tf new
+3
@@ -0,0 +1,3 @@
1 +locals {
2 + fastly_customer_id = "1RhOVUmKLBjCFTU4i9Cekx"
3 +}
terraform-iam/outputs.tf new
+3
@@ -0,0 +1,3 @@
1 +output "fastlylogs" {
2 + value = module.fastlylogs
3 +}
terraform-iam/providers.tf new
+12
@@ -0,0 +1,12 @@
1 +provider "aws" {
2 + region = "eu-west-1"
3 + profile = "nixos-prod"
4 +}
5 +
6 +provider "aws" {
7 + alias = "us"
8 + region = "us-east-1"
9 + profile = "nixos-prod"
10 +}
11 +
12 +provider "fastly" {}
terraform-iam/terraform.tf new
+24
@@ -0,0 +1,24 @@
1 +terraform {
2 + backend "s3" {
3 + bucket = "nixos-terraform-state"
4 + encrypt = true
5 + key = "targets/terraform-iam"
6 + region = "eu-west-1"
7 + profile = "nixos-prod"
8 + }
9 +
10 + required_providers {
11 + aws = {
12 + source = "hashicorp/aws"
13 + }
14 + fastly = {
15 + source = "fastly/fastly"
16 + }
17 + netlify = {
18 + source = "AegirHealth/netlify"
19 + }
20 + secret = {
21 + source = "numtide/secret"
22 + }
23 + }
24 +}
terraform/aws-config
+2 -1
@@ -2,4 +2,5 @@
2 sso_start_url = https://nixos.awsapps.com/start
3 sso_region = eu-north-1
4 sso_account_id = 080433136561
5 -sso_role_name = AWSAdministratorAccess
5 +sso_role_name = AWSPowerUserAccess
6 +region = eu-north-1
terraform/cache.tf
+5 -5
@@ -236,15 +236,15 @@ resource "fastly_service_vcl" "cache" {
236
237 logging_s3 {
238 name = "${local.cache_domain}-to-s3"
239 - bucket_name = module.fastlylogs.bucket_name
239 + bucket_name = local.fastlylogs["bucket_name"]
240 compression_codec = "zstd"
241 - domain = module.fastlylogs.s3_domain
242 - format = module.fastlylogs.format
241 + domain = local.fastlylogs["s3_domain"]
242 + format = local.fastlylogs["format"]
243 format_version = 2
244 path = "${local.cache_domain}/"
245 - period = module.fastlylogs.period
245 + period = local.fastlylogs["period"]
246 message_type = "blank"
247 - s3_iam_role = module.fastlylogs.iam_role_arn
247 + s3_iam_role = local.fastlylogs["iam_role_arn"]
248 }
249 }
250
terraform/channels.tf
+5 -5
@@ -214,15 +214,15 @@ resource "fastly_service_vcl" "channels" {
214
215 logging_s3 {
216 name = "${local.channels_domain}-to-s3"
217 - bucket_name = module.fastlylogs.bucket_name
217 + bucket_name = local.fastlylogs["bucket_name"]
218 compression_codec = "zstd"
219 - domain = module.fastlylogs.s3_domain
220 - format = module.fastlylogs.format
219 + domain = local.fastlylogs["s3_domain"]
220 + format = local.fastlylogs["format"]
221 format_version = 2
222 path = "${local.channels_domain}/"
223 - period = module.fastlylogs.period
223 + period = local.fastlylogs["period"]
224 message_type = "blank"
225 - s3_iam_role = module.fastlylogs.iam_role_arn
225 + s3_iam_role = local.fastlylogs["iam_role_arn"]
226 }
227 }
228
terraform/locals.tf
+10
@@ -5,4 +5,14 @@ locals {
5 fastly_tls12_sni_configuration_id = "5PXBTa6c01Xoh54ylNwmVA"
6
7 fastly_shield = "iad-va-us"
8 +
9 + fastlylogs = data.terraform_remote_state.terraform-iam.outputs.fastlylogs
10 +
11 + # fastlylogs = {
12 + # bucket_name = "fastly-logs-20220622145016462800000001"
13 + # iam_role_arn = "arn:aws:iam::080433136561:role/system/FastlyLogForwarder"
14 + # period = 3600
15 + # format = "{\"asn\": %%{client.as.number}V,\"elapsed_usec\": %%{json.escape(time.elapsed.usec)}V,\"fastly_is_edge\": %%{if(fastly.ff.visits_this_service == 0, \"true\", \"false\")}V,\"fastly_server\": \"%%{json.escape(server.identity)}V\",\"geo_country\": \"%%{json.escape(client.geo.country_name)}V\",\"geo_region\": \"%%{json.escape(client.geo.region.utf8)}V\",\"geo_speed\": \"%%{json.escape(client.geo.conn_speed)}V\",\"host\": \"%%{json.escape(if(req.http.Fastly-Orig-Host, req.http.Fastly-Orig-Host, req.http.Host))}V\",\"request_method\": \"%%{json.escape(req.method)}V\",\"request_protocol\": \"%%{json.escape(req.proto)}V\",\"request_referer\": \"%%{json.escape(req.http.referer)}V\",\"request_size\": %%{json.escape(req.bytes_read)}V,\"request_user_agent\": \"%%{json.escape(req.http.User-Agent)}V\",\"response_body_size\": %%{resp.body_bytes_written}V,\"response_reason\": %%{if(resp.response, \"%22\"+json.escape(resp.response)+\"%22\", \"null\")}V,\"response_state\": \"%%{json.escape(fastly_info.state)}V\",\"response_status\": \"%%{resp.status}V\",\"timestamp\": \"%%{strftime(\\{\"%Y-%m-%dT%H:%M:%S%z\"\\}, time.start)}V\",\"tls_client_cipher\": \"%%{json.escape(if(tls.client.cipher, tls.client.cipher, \"null\"))}V\",\"tls_client_protocol\": \"%%{json.escape(if(tls.client.protocol, tls.client.protocol, \"null\"))}V\",\"url\": \"%%{json.escape(req.url)}V\"}"
16 + # s3_domain = "s3.eu-west-1.amazonaws.com"
17 + # }
18 }
terraform/nixpkgs-tarballs.tf
+5 -5
@@ -259,15 +259,15 @@ resource "fastly_service_vcl" "nixpkgs-tarballs" {
259
260 logging_s3 {
261 name = "${local.tarballs_domain}-to-s3"
262 - bucket_name = module.fastlylogs.bucket_name
262 + bucket_name = local.fastlylogs["bucket_name"]
263 compression_codec = "zstd"
264 - domain = module.fastlylogs.s3_domain
265 - format = module.fastlylogs.format
264 + domain = local.fastlylogs["s3_domain"]
265 + format = local.fastlylogs["format"]
266 format_version = 2
267 path = "${local.tarballs_domain}/"
268 - period = module.fastlylogs.period
268 + period = local.fastlylogs["period"]
269 message_type = "blank"
270 - s3_iam_role = module.fastlylogs.iam_role_arn
270 + s3_iam_role = local.fastlylogs["iam_role_arn"]
271 }
272 }
273
terraform/releases.tf
+5 -5
@@ -213,15 +213,15 @@ resource "fastly_service_vcl" "releases" {
213
214 logging_s3 {
215 name = "${local.releases_domain}-to-s3"
216 - bucket_name = module.fastlylogs.bucket_name
216 + bucket_name = local.fastlylogs["bucket_name"]
217 compression_codec = "zstd"
218 - domain = module.fastlylogs.s3_domain
219 - format = module.fastlylogs.format
218 + domain = local.fastlylogs["s3_domain"]
219 + format = local.fastlylogs["format"]
220 format_version = 2
221 path = "${local.releases_domain}/"
222 - period = module.fastlylogs.period
222 + period = local.fastlylogs["period"]
223 message_type = "blank"
224 - s3_iam_role = module.fastlylogs.iam_role_arn
224 + s3_iam_role = local.fastlylogs["iam_role_arn"]
225 }
226 }
227
terraform/terraform.tf
+10 -4
@@ -23,7 +23,13 @@ terraform {
23 }
24 }
25
26 -module "fastlylogs" {
27 - source = "./fastlylog"
28 - fastly_customer_id = local.fastly_customer_id
29 -}
\ No newline at end of file
26 +data "terraform_remote_state" "terraform-iam" {
27 + backend = "s3"
28 + config = {
29 + bucket = "nixos-terraform-state"
30 + encrypt = true
31 + key = "targets/terraform-iam"
32 + region = "eu-west-1"
33 + profile = "nixos-prod"
34 + }
35 +}