terraform: split state in two
Make it possible for the infra team to take ownership of part of the infra.
zimbatm committed
Oct 20, 2023 at 13:10 UTC
9b1732fddb1d5b25a08d845247be13d49d926a5c
20 files changed
+187
-25
terraform-iam/.gitignore
new
+1
@@ -0,0 +1 @@
1
+/.envrc.local
terraform-iam/README.md
new
+40
@@ -0,0 +1,40 @@
1
+# For the bits that are not nixops-able
2
+
3
+This module is for superadmins in the team.
4
+
5
+This terraform root module manages:
6
+* IAM roles
7
+
8
+## Setup
9
+
10
+In order to use this, make sure to install direnv and Nix with flakes enabled.
11
+
12
+Then run `direnv allow` to load the environment with the runtime dependencies.
13
+
14
+Run `aws sso login` to acquire a temporary token.
15
+
16
+## Usage
17
+
18
+The first time the following command has to be run to initialize the state
19
+file and plugins:
20
+
21
+```sh
22
+terraform init
23
+```
24
+
25
+Then run the following command to diff the changes and then apply if approved:
26
+
27
+```sh
28
+terraform apply
29
+```
30
+
31
+## Terraform workflow
32
+
33
+Write the Terraform code and test the changes using `terraform validate`.
34
+
35
+Before committing run `terraform fmt`.
36
+
37
+Once the code is ready to be deployed, create a new PR with the attached
38
+output of `terraform plan`.
39
+
40
+Once the PR is merged, run `terraform apply` to apply the changes.
terraform-iam/aws-config
new
+6
@@ -0,0 +1,6 @@
1
+[profile nixos-prod]
2
+sso_start_url = https://nixos.awsapps.com/start
3
+sso_region = eu-north-1
4
+sso_account_id = 080433136561
5
+sso_role_name = AWSAdministratorAccess
6
+region = eu-north-1
terraform-iam/fastlylog.tf
new
+4
@@ -0,0 +1,4 @@
1
+module "fastlylogs" {
2
+ source = "./fastlylog"
3
+ fastly_customer_id = local.fastly_customer_id
4
+}
terraform-iam/fastlylog/main.tf
renamed
terraform-iam/fastlylog/outputs.tf
renamed
terraform-iam/fastlylog/variables.tf
renamed
terraform-iam/flake.lock
new
+26
@@ -0,0 +1,26 @@
1
+{
2
+ "nodes": {
3
+ "nixpkgs": {
4
+ "locked": {
5
+ "lastModified": 1694092552,
6
+ "narHash": "sha256-kEb8kyIFTKt1RLRfsKVVuBG+EY29zp6kWLOtdK9Bcu4=",
7
+ "owner": "NixOS",
8
+ "repo": "nixpkgs",
9
+ "rev": "319a44b173a6467859b6c8e60d96e2287526f685",
10
+ "type": "github"
11
+ },
12
+ "original": {
13
+ "id": "nixpkgs",
14
+ "ref": "master",
15
+ "type": "indirect"
16
+ }
17
+ },
18
+ "root": {
19
+ "inputs": {
20
+ "nixpkgs": "nixpkgs"
21
+ }
22
+ }
23
+ },
24
+ "root": "root",
25
+ "version": 7
26
+}
terraform-iam/flake.nix
new
+26
@@ -0,0 +1,26 @@
1
+{
2
+ inputs.nixpkgs.url = "nixpkgs/master";
3
+
4
+ outputs = flakes @ { self, nixpkgs }: {
5
+
6
+ devShell.x86_64-linux =
7
+ with import nixpkgs { system = "x86_64-linux"; };
8
+ mkShell {
9
+ packages = [
10
+ awscli2
11
+ (terraform.withPlugins (p: with p; [
12
+ aws
13
+ fastly
14
+ netlify
15
+ secret
16
+ ]))
17
+ ];
18
+
19
+ shellHook = ''
20
+ alias tf=terraform
21
+ '';
22
+ };
23
+
24
+ };
25
+
26
+}
terraform-iam/locals.tf
new
+3
@@ -0,0 +1,3 @@
1
+locals {
2
+ fastly_customer_id = "1RhOVUmKLBjCFTU4i9Cekx"
3
+}
terraform-iam/outputs.tf
new
+3
@@ -0,0 +1,3 @@
1
+output "fastlylogs" {
2
+ value = module.fastlylogs
3
+}
terraform-iam/providers.tf
new
+12
@@ -0,0 +1,12 @@
1
+provider "aws" {
2
+ region = "eu-west-1"
3
+ profile = "nixos-prod"
4
+}
5
+
6
+provider "aws" {
7
+ alias = "us"
8
+ region = "us-east-1"
9
+ profile = "nixos-prod"
10
+}
11
+
12
+provider "fastly" {}
terraform-iam/terraform.tf
new
+24
@@ -0,0 +1,24 @@
1
+terraform {
2
+ backend "s3" {
3
+ bucket = "nixos-terraform-state"
4
+ encrypt = true
5
+ key = "targets/terraform-iam"
6
+ region = "eu-west-1"
7
+ profile = "nixos-prod"
8
+ }
9
+
10
+ required_providers {
11
+ aws = {
12
+ source = "hashicorp/aws"
13
+ }
14
+ fastly = {
15
+ source = "fastly/fastly"
16
+ }
17
+ netlify = {
18
+ source = "AegirHealth/netlify"
19
+ }
20
+ secret = {
21
+ source = "numtide/secret"
22
+ }
23
+ }
24
+}
terraform/aws-config
+2
-1
@@ -2,4 +2,5 @@
2
sso_start_url = https://nixos.awsapps.com/start
3
sso_region = eu-north-1
4
sso_account_id = 080433136561
5
-sso_role_name = AWSAdministratorAccess
5
+sso_role_name = AWSPowerUserAccess
6
+region = eu-north-1
terraform/cache.tf
+5
-5
@@ -236,15 +236,15 @@ resource "fastly_service_vcl" "cache" {
236
237
logging_s3 {
238
name = "${local.cache_domain}-to-s3"
239
- bucket_name = module.fastlylogs.bucket_name
239
+ bucket_name = local.fastlylogs["bucket_name"]
240
compression_codec = "zstd"
241
- domain = module.fastlylogs.s3_domain
242
- format = module.fastlylogs.format
241
+ domain = local.fastlylogs["s3_domain"]
242
+ format = local.fastlylogs["format"]
243
format_version = 2
244
path = "${local.cache_domain}/"
245
- period = module.fastlylogs.period
245
+ period = local.fastlylogs["period"]
246
message_type = "blank"
247
- s3_iam_role = module.fastlylogs.iam_role_arn
247
+ s3_iam_role = local.fastlylogs["iam_role_arn"]
248
}
249
}
250
terraform/channels.tf
+5
-5
@@ -214,15 +214,15 @@ resource "fastly_service_vcl" "channels" {
214
215
logging_s3 {
216
name = "${local.channels_domain}-to-s3"
217
- bucket_name = module.fastlylogs.bucket_name
217
+ bucket_name = local.fastlylogs["bucket_name"]
218
compression_codec = "zstd"
219
- domain = module.fastlylogs.s3_domain
220
- format = module.fastlylogs.format
219
+ domain = local.fastlylogs["s3_domain"]
220
+ format = local.fastlylogs["format"]
221
format_version = 2
222
path = "${local.channels_domain}/"
223
- period = module.fastlylogs.period
223
+ period = local.fastlylogs["period"]
224
message_type = "blank"
225
- s3_iam_role = module.fastlylogs.iam_role_arn
225
+ s3_iam_role = local.fastlylogs["iam_role_arn"]
226
}
227
}
228
terraform/locals.tf
+10
@@ -5,4 +5,14 @@ locals {
5
fastly_tls12_sni_configuration_id = "5PXBTa6c01Xoh54ylNwmVA"
6
7
fastly_shield = "iad-va-us"
8
+
9
+ fastlylogs = data.terraform_remote_state.terraform-iam.outputs.fastlylogs
10
+
11
+ # fastlylogs = {
12
+ # bucket_name = "fastly-logs-20220622145016462800000001"
13
+ # iam_role_arn = "arn:aws:iam::080433136561:role/system/FastlyLogForwarder"
14
+ # period = 3600
15
+ # format = "{\"asn\": %%{client.as.number}V,\"elapsed_usec\": %%{json.escape(time.elapsed.usec)}V,\"fastly_is_edge\": %%{if(fastly.ff.visits_this_service == 0, \"true\", \"false\")}V,\"fastly_server\": \"%%{json.escape(server.identity)}V\",\"geo_country\": \"%%{json.escape(client.geo.country_name)}V\",\"geo_region\": \"%%{json.escape(client.geo.region.utf8)}V\",\"geo_speed\": \"%%{json.escape(client.geo.conn_speed)}V\",\"host\": \"%%{json.escape(if(req.http.Fastly-Orig-Host, req.http.Fastly-Orig-Host, req.http.Host))}V\",\"request_method\": \"%%{json.escape(req.method)}V\",\"request_protocol\": \"%%{json.escape(req.proto)}V\",\"request_referer\": \"%%{json.escape(req.http.referer)}V\",\"request_size\": %%{json.escape(req.bytes_read)}V,\"request_user_agent\": \"%%{json.escape(req.http.User-Agent)}V\",\"response_body_size\": %%{resp.body_bytes_written}V,\"response_reason\": %%{if(resp.response, \"%22\"+json.escape(resp.response)+\"%22\", \"null\")}V,\"response_state\": \"%%{json.escape(fastly_info.state)}V\",\"response_status\": \"%%{resp.status}V\",\"timestamp\": \"%%{strftime(\\{\"%Y-%m-%dT%H:%M:%S%z\"\\}, time.start)}V\",\"tls_client_cipher\": \"%%{json.escape(if(tls.client.cipher, tls.client.cipher, \"null\"))}V\",\"tls_client_protocol\": \"%%{json.escape(if(tls.client.protocol, tls.client.protocol, \"null\"))}V\",\"url\": \"%%{json.escape(req.url)}V\"}"
16
+ # s3_domain = "s3.eu-west-1.amazonaws.com"
17
+ # }
18
}
terraform/nixpkgs-tarballs.tf
+5
-5
@@ -259,15 +259,15 @@ resource "fastly_service_vcl" "nixpkgs-tarballs" {
259
260
logging_s3 {
261
name = "${local.tarballs_domain}-to-s3"
262
- bucket_name = module.fastlylogs.bucket_name
262
+ bucket_name = local.fastlylogs["bucket_name"]
263
compression_codec = "zstd"
264
- domain = module.fastlylogs.s3_domain
265
- format = module.fastlylogs.format
264
+ domain = local.fastlylogs["s3_domain"]
265
+ format = local.fastlylogs["format"]
266
format_version = 2
267
path = "${local.tarballs_domain}/"
268
- period = module.fastlylogs.period
268
+ period = local.fastlylogs["period"]
269
message_type = "blank"
270
- s3_iam_role = module.fastlylogs.iam_role_arn
270
+ s3_iam_role = local.fastlylogs["iam_role_arn"]
271
}
272
}
273
terraform/releases.tf
+5
-5
@@ -213,15 +213,15 @@ resource "fastly_service_vcl" "releases" {
213
214
logging_s3 {
215
name = "${local.releases_domain}-to-s3"
216
- bucket_name = module.fastlylogs.bucket_name
216
+ bucket_name = local.fastlylogs["bucket_name"]
217
compression_codec = "zstd"
218
- domain = module.fastlylogs.s3_domain
219
- format = module.fastlylogs.format
218
+ domain = local.fastlylogs["s3_domain"]
219
+ format = local.fastlylogs["format"]
220
format_version = 2
221
path = "${local.releases_domain}/"
222
- period = module.fastlylogs.period
222
+ period = local.fastlylogs["period"]
223
message_type = "blank"
224
- s3_iam_role = module.fastlylogs.iam_role_arn
224
+ s3_iam_role = local.fastlylogs["iam_role_arn"]
225
}
226
}
227
terraform/terraform.tf
+10
-4
@@ -23,7 +23,13 @@ terraform {
23
}
24
}
25
26
-module "fastlylogs" {
27
- source = "./fastlylog"
28
- fastly_customer_id = local.fastly_customer_id
29
-}
\ No newline at end of file
26
+data "terraform_remote_state" "terraform-iam" {
27
+ backend = "s3"
28
+ config = {
29
+ bucket = "nixos-terraform-state"
30
+ encrypt = true
31
+ key = "targets/terraform-iam"
32
+ region = "eu-west-1"
33
+ profile = "nixos-prod"
34
+ }
35
+}