@swovohq/fuel 0.2.2-alpha.88 → 0.2.2-alpha.89

package/dist/infra-templates/modules/ecs-service/variables.tf

@@ -0,0 +1,170 @@
+########################################################################################################################
+## Service variables
+########################################################################################################################
+
+variable "app_name" {
+  description = "A Docker image-compatible name for the service"
+  type        = string
+}
+
+variable "scenario" {
+  description = "Scenario name for tags"
+  default     = "scenario-ecs-fargate"
+  type        = string
+}
+
+########################################################################################################################
+## ECS variables
+########################################################################################################################
+
+variable "ecs_task_desired_count" {
+  description = "How many ECS tasks should run in parallel"
+  type        = number
+  default = 1
+}
+
+variable "ecs_task_min_count" {
+  description = "How many ECS tasks should minimally run in parallel"
+  default     = 1
+  type        = number
+}
+
+variable "ecs_task_max_count" {
+  description = "How many ECS tasks should maximally run in parallel"
+  default     = 10
+  type        = number
+}
+
+# if you have multiple tasks running this should be 50%, but for 1 task
+# it has to be zero so ecs can drain the task to replace it (making the service unstable for a few minutes)
+variable "ecs_task_deployment_minimum_healthy_percent" {
+  description = "How many percent of a service must be running to still execute a safe deployment"
+  default     = 100
+  type        = number
+}
+
+variable "ecs_task_deployment_maximum_percent" {
+  description = "How many additional tasks are allowed to run (in percent) while a deployment is executed"
+  default     = 200
+  type        = number
+}
+
+variable "cpu_target_tracking_desired_value" {
+  description = "Target tracking for CPU usage in %"
+  default     = 70
+  type        = number
+}
+
+variable "memory_target_tracking_desired_value" {
+  description = "Target tracking for memory usage in %"
+  default     = 80
+  type        = number
+}
+
+variable "target_capacity" {
+  description = "Amount of resources of container instances that should be used for task placement in %"
+  default     = 100
+  type        = number
+}
+
+variable "container_port" {
+  description = "Port of the container"
+  type        = number
+  default     = 3000
+}
+
+variable "cpu_units" {
+  description = "Amount of CPU units for a single ECS task"
+  default     = 1024
+  type        = number
+}
+
+variable "memory" {
+  description = "Amount of memory in MB for a single ECS task"
+  default     = 2048
+  type        = number
+}
+
+variable "aws_region" {
+  description = "AWS Region"
+  type = string
+}
+
+variable "repository_url" {
+  description = "Image URL"
+  type = string
+}
+
+variable "default_security_group_id" {
+  description = "VPC Security Group"
+  type = string
+}
+
+variable "ecs_task_execution_role_arn" {
+  description = "ARN for the task execution role"
+  type = string
+}
+
+variable "ecs_task_role_arn" {
+  description = "ARN for the task role"
+  type = string
+}
+
+variable "ecs_log_group_name" {
+  description = "Log group name for ECS"
+  type = string
+}
+
+variable "ecs_cluster_id" {
+  description = "ECS cluster id to attach services to"
+}
+
+variable "ecs_cluster_name" {
+  description = "ECS cluster name"
+}
+
+variable "aws_alb_target_group_arn" {
+  description = "AWS ALB target group ARN"
+  type = string
+}
+
+variable "ecs_container_security_group_id" {
+  description = "ECS Container Security Group ID"
+  type = string
+}
+
+variable "private_subnets" {
+  description = "Private subnets for the ECS cluster"
+  default     = ""
+}
+
+variable "ecs_secret_arn" {
+  description = "ARN for secrets"
+  type = string
+}
+
+variable "connect_to_alb" {
+  description = "Is this a public service?"
+  type = bool
+}
+
+variable "secret_name" {
+  description = "Name of the secret to use"
+  type = string
+}
+
+variable "env_vars" {
+  type    = map(string)
+  default = {}
+}
+variable "ecs_circuit_breaker" {
+  description = "Enable Circuit Breaker"
+  type = bool
+  default = true
+}
+
+variable "ecs_rollback" {
+  description = "Automatically rollback if failure occurs"
+  type = bool
+  default = true
+}

package/dist/infra-templates/modules/elastic-container-registry/main.tf

@@ -0,0 +1,32 @@
+locals {
+  all_apps = merge(
+    { for app in var.apps : app.app_name => app },
+    { for worker in var.workers : worker.worker_name => worker }
+  )
+}
+
+module "ecr" {
+  source  = "terraform-aws-modules/ecr/aws"
+  version = "2.2.0"
+
+  repository_name         = "${var.project_name}-application"
+  repository_force_delete = true
+  repository_image_tag_mutability = "MUTABLE"
+  repository_lifecycle_policy = jsonencode({
+    rules = [
+      for idx, app_key in zipmap(range(length(keys(local.all_apps))), keys(local.all_apps)) : {
+        rulePriority = idx + 1
+        description  = "Keep 5 most recent images with prefix '${app_key}'"
+        selection = {
+          tagStatus     = "tagged"
+          tagPrefixList = [app_key]
+          countType     = "imageCountMoreThan"
+          countNumber   = 5
+        }
+        action = {
+          type = "expire"
+        }
+      }
+    ]
+  })
+}

package/dist/infra-templates/modules/elastic-container-registry/outputs.tf

@@ -0,0 +1,9 @@
+output "repository_url" {
+  description = "The URL of the repository."
+  value = module.ecr.repository_url
+}
+
+output "registry_id" {
+  description = "The registry ID"
+  value = module.ecr.repository_registry_id
+}

package/dist/infra-templates/modules/elastic-container-registry/variables.tf

@@ -0,0 +1,25 @@
+variable "project_name" {
+  description = "Repository name will be created based on project name"
+  default     = ""
+}
+
+variable "apps" {
+  description = "An array of apps from config.json"
+  type = set(object({
+    app_name     = string
+    technology = string
+    dockerfile = string
+    build_env = string
+  }))
+}
+
+variable "workers" {
+  description = "An array of workers from config.json"
+  type = set(object({
+    app_name     = string
+    technology = string
+    dockerfile = string
+    worker_name = string
+    build_env = string
+  }))
+}

package/dist/infra-templates/modules/github-oidc-role/main.tf

@@ -0,0 +1,46 @@
+locals {
+  oidc_provider_arn = "arn:aws:iam::${var.aws_account_id}:oidc-provider/token.actions.githubusercontent.com"
+}
+
+moved {
+  from = aws_iam_openid_connect_provider.github[0]
+  to   = aws_iam_openid_connect_provider.github
+}
+
+resource "aws_iam_openid_connect_provider" "github" {
+  url             = "https://token.actions.githubusercontent.com"
+  client_id_list  = ["sts.amazonaws.com"]
+  thumbprint_list = ["6938fd4d98bab03faadb97b34396831e3780aea1"]
+}
+
+resource "aws_iam_role" "github_actions_role" {
+  name = "${var.project_name}-github-actions-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Principal = {
+          Federated = local.oidc_provider_arn
+        }
+        Action = "sts:AssumeRoleWithWebIdentity"
+        Condition = {
+          StringLike = {
+            "token.actions.githubusercontent.com:sub" = "repo:${var.github_organization}/*"
+          }
+        }
+      }
+    ]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "ecr_image_builder_policy" {
+  role       = aws_iam_role.github_actions_role.name
+  policy_arn = "arn:aws:iam::aws:policy/EC2InstanceProfileForImageBuilderECRContainerBuilds"
+}
+
+resource "aws_iam_role_policy_attachment" "ecs_full_access" {
+  role       = aws_iam_role.github_actions_role.name
+  policy_arn = "arn:aws:iam::aws:policy/AmazonECS_FullAccess"
+}

package/dist/infra-templates/modules/github-oidc-role/outputs.tf

@@ -0,0 +1,4 @@
+output "role_arn" {
+  value       = aws_iam_role.github_actions_role.arn
+  description = "ARN of the GitHub Actions OIDC IAM role"
+}

package/dist/infra-templates/modules/github-oidc-role/variables.tf

@@ -0,0 +1,11 @@
+variable "project_name" {
+  description = "Project name used as prefix for resource names"
+}
+
+variable "github_organization" {
+  description = "GitHub organization name for OIDC trust policy"
+}
+
+variable "aws_account_id" {
+  description = "AWS account ID for constructing OIDC provider ARN"
+}

package/dist/infra-templates/modules/guardduty/main.tf

@@ -0,0 +1,8 @@
+moved {
+  from = aws_guardduty_detector.main[0]
+  to   = aws_guardduty_detector.main
+}
+
+resource "aws_guardduty_detector" "main" {
+  enable = true
+}

package/dist/infra-templates/modules/iam/main.tf

@@ -0,0 +1,205 @@
+resource "aws_iam_policy" "this" {
+  name        = "${var.project_name}AWSLoadBalancerControllerIAMPolicy"
+  description = "IAM policy for Load Balancer"
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "iam:CreateServiceLinkedRole"
+        ]
+        Resource = "*"
+        Condition = {
+          StringEquals = {
+            "iam:AWSServiceName" : "elasticloadbalancing.amazonaws.com"
+          }
+        }
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "ec2:DescribeAccountAttributes",
+          "ec2:DescribeAddresses",
+          "ec2:DescribeAvailabilityZones",
+          "ec2:DescribeInternetGateways",
+          "ec2:DescribeVpcs",
+          "ec2:DescribeVpcPeeringConnections",
+          "ec2:DescribeSubnets",
+          "ec2:DescribeSecurityGroups",
+          "ec2:DescribeInstances",
+          "ec2:DescribeNetworkInterfaces",
+          "ec2:DescribeTags",
+          "ec2:GetCoipPoolUsage",
+          "ec2:DescribeCoipPools",
+          "elasticloadbalancing:DescribeLoadBalancers",
+          "elasticloadbalancing:DescribeLoadBalancerAttributes",
+          "elasticloadbalancing:DescribeListeners",
+          "elasticloadbalancing:DescribeListenerCertificates",
+          "elasticloadbalancing:DescribeSSLPolicies",
+          "elasticloadbalancing:DescribeRules",
+          "elasticloadbalancing:DescribeTargetGroups",
+          "elasticloadbalancing:DescribeTargetGroupAttributes",
+          "elasticloadbalancing:DescribeTargetHealth",
+          "elasticloadbalancing:DescribeTags"
+        ]
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "cognito-idp:DescribeUserPoolClient",
+          "acm:ListCertificates",
+          "acm:DescribeCertificate",
+          "iam:ListServerCertificates",
+          "iam:GetServerCertificate",
+          "waf-regional:GetWebACL",
+          "waf-regional:GetWebACLForResource",
+          "waf-regional:AssociateWebACL",
+          "waf-regional:DisassociateWebACL",
+          "wafv2:GetWebACL",
+          "wafv2:GetWebACLForResource",
+          "wafv2:AssociateWebACL",
+          "wafv2:DisassociateWebACL",
+          "shield:GetSubscriptionState",
+          "shield:DescribeProtection",
+          "shield:CreateProtection",
+          "shield:DeleteProtection"
+        ]
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "ec2:AuthorizeSecurityGroupIngress",
+          "ec2:RevokeSecurityGroupIngress"
+        ]
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "ec2:CreateSecurityGroup"
+        ]
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "ec2:CreateTags"
+        ]
+        Resource = "arn:aws:ec2:*:*:security-group/*"
+        Condition = {
+          StringEquals = {
+            "ec2:CreateAction" : "CreateSecurityGroup"
+          }
+        }
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "ec2:AuthorizeSecurityGroupIngress",
+          "ec2:RevokeSecurityGroupIngress",
+          "ec2:DeleteSecurityGroup"
+        ]
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "elasticloadbalancing:CreateLoadBalancer",
+          "elasticloadbalancing:CreateTargetGroup"
+        ]
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "elasticloadbalancing:CreateListener",
+          "elasticloadbalancing:DeleteListener",
+          "elasticloadbalancing:CreateRule",
+          "elasticloadbalancing:DeleteRule"
+        ]
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "elasticloadbalancing:AddTags",
+          "elasticloadbalancing:RemoveTags"
+        ]
+        Resource = [
+          "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
+          "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
+          "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
+        ]
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "elasticloadbalancing:AddTags",
+          "elasticloadbalancing:RemoveTags"
+        ]
+        Resource = [
+          "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*",
+          "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*",
+          "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
+          "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*"
+        ]
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "elasticloadbalancing:ModifyLoadBalancerAttributes",
+          "elasticloadbalancing:SetIpAddressType",
+          "elasticloadbalancing:SetSecurityGroups",
+          "elasticloadbalancing:SetSubnets",
+          "elasticloadbalancing:DeleteLoadBalancer",
+          "elasticloadbalancing:ModifyTargetGroup",
+          "elasticloadbalancing:ModifyTargetGroupAttributes",
+          "elasticloadbalancing:DeleteTargetGroup"
+        ]
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "elasticloadbalancing:AddTags"
+        ]
+        Resource = [
+          "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
+          "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
+          "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
+        ]
+        Condition = {
+          StringEquals = {
+            "elasticloadbalancing:CreateAction" : [
+              "CreateTargetGroup",
+              "CreateLoadBalancer"
+            ]
+          }
+        }
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "elasticloadbalancing:RegisterTargets",
+          "elasticloadbalancing:DeregisterTargets"
+        ]
+        Resource = "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "elasticloadbalancing:SetWebAcl",
+          "elasticloadbalancing:ModifyListener",
+          "elasticloadbalancing:AddListenerCertificates",
+          "elasticloadbalancing:RemoveListenerCertificates",
+          "elasticloadbalancing:ModifyRule"
+        ]
+        Resource = "*"
+      }
+    ]
+  })
+}
+

package/dist/infra-templates/modules/iam/outputs.tf

@@ -0,0 +1,3 @@
+output "policy_arn" {
+  value = aws_iam_policy.this.arn
+}

package/dist/infra-templates/modules/iam/variables.tf

@@ -0,0 +1,4 @@
+variable "project_name" {
+  description = "A unique name for your project. This will be used as part of resource names."
+  default     = ""
+}

package/dist/infra-templates/modules/random-key/main.tf

@@ -0,0 +1,11 @@
+resource "random_string" "this" {
+  length  = var.length
+  upper   = true
+  lower   = true
+  numeric = true
+  special = false
+
+  keepers = {
+    constant = var.name
+  }
+}

package/dist/infra-templates/modules/random-key/outputs.tf

@@ -0,0 +1,4 @@
+output "value" {
+  value     = random_string.this.result
+  sensitive = true
+}

package/dist/infra-templates/modules/random-key/variables.tf

@@ -0,0 +1,10 @@
+variable "name" {
+  type        = string
+  description = "Keeper value — disambiguates this instance so unrelated random-key module calls don't collide or force each other to regenerate."
+}
+
+variable "length" {
+  type        = number
+  description = "Length of the generated random string."
+  default     = 32
+}

package/dist/infra-templates/modules/redis/main.tf

@@ -0,0 +1,47 @@
+resource "aws_security_group" "staging" {
+  name        = "${var.app_name}-redis-sg"
+  description = "Allow Redis traffic"
+  vpc_id      = var.vpc_id
+
+  ingress {
+    from_port   = 6379
+    to_port     = 6379
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+resource "aws_elasticache_subnet_group" "staging" {
+  name       = "${var.app_name}-ecsg"
+  subnet_ids = var.subnet_ids
+}
+
+resource "aws_elasticache_cluster" "staging" {
+  cluster_id           = var.app_name
+  engine               = "redis"
+  node_type            = var.node_type
+  num_cache_nodes      = 1
+  parameter_group_name = aws_elasticache_parameter_group.staging.name
+  engine_version       = "7.1"
+  port                 = 6379
+  subnet_group_name    = aws_elasticache_subnet_group.staging.name
+  security_group_ids   = [aws_security_group.staging.id]
+}
+
+resource "aws_elasticache_parameter_group" "staging" {
+  name        = "${var.app_name}-ec-param-group"
+  family      = "redis7"
+  description = "Custom parameter group for Redis cluster"
+
+  parameter {
+    name  = "maxmemory-policy"
+    value = "noeviction"
+  }
+}

package/dist/infra-templates/modules/redis/outputs.tf

@@ -0,0 +1,8 @@
+output "elasticache_cluster_hostname" {
+  value       = aws_elasticache_cluster.staging.cache_nodes[0].address
+  description = "The hostname of the ElastiCache cluster node"
+}
+
+output "app_name" {
+  value = var.app_name
+}

package/dist/infra-templates/modules/redis/variables.tf

@@ -0,0 +1,20 @@
+variable "vpc_id" {
+  description = "The id of environment VPC"
+  default     = ""
+}
+
+variable "subnet_ids" {
+  type        = list(string)
+  description = "List of private subnet IDs"
+  default     = []
+}
+
+variable "app_name" {
+  description = "Cognito user pool name"
+  default     = ""
+}
+
+variable "node_type" {
+  description = "ElastiCache node type"
+  default     = "cache.t3.small"
+}

package/dist/infra-templates/modules/relational-database-service/main.tf

@@ -0,0 +1,44 @@
+resource "random_password" "db" {
+  length  = 32
+  special = false
+
+  keepers = {
+    app_name = var.app_name
+  }
+}
+
+locals {
+  effective_db_password = coalesce(var.db_password, random_password.db.result)
+}
+
+module "db" {
+  source = "terraform-aws-modules/rds/aws"
+  version = "6.13.1"
+
+  identifier = var.app_name
+
+  engine            = "postgres"
+  engine_version    = "14.22"
+  instance_class    = var.db_instance_type
+  allocated_storage = var.db_allocated_storage
+
+  db_name  = var.db_name
+  username = var.db_username
+  password = local.effective_db_password
+
+  iam_database_authentication_enabled = false
+  manage_master_user_password         = false
+  publicly_accessible                 = true
+
+  vpc_security_group_ids = [aws_security_group.this.id, var.vpc_security_group_default]
+
+  maintenance_window = "Mon:00:00-Mon:03:00"
+  backup_window      = "03:00-06:00"
+
+  create_db_subnet_group = true
+  subnet_ids             = var.subnet_ids
+
+  family               = "postgres14"
+  major_engine_version = "14"
+  deletion_protection  = false
+}