@swovohq/fuel 0.2.2-alpha.9 → 0.2.2-alpha.91

package/dist/infra-templates/modules/elastic-container-registry/variables.tf

@@ -0,0 +1,25 @@
+variable "project_name" {
+  description = "Repository name will be created based on project name"
+  default     = ""
+}
+
+variable "apps" {
+  description = "An array of apps from config.json"
+  type = set(object({
+    app_name     = string
+    technology = string
+    dockerfile = string
+    build_env = string
+  }))
+}
+
+variable "workers" {
+  description = "An array of workers from config.json"
+  type = set(object({
+    app_name     = string
+    technology = string
+    dockerfile = string
+    worker_name = string
+    build_env = string
+  }))
+}

package/dist/infra-templates/modules/github-oidc-role/main.tf

@@ -0,0 +1,46 @@
+locals {
+  oidc_provider_arn = "arn:aws:iam::${var.aws_account_id}:oidc-provider/token.actions.githubusercontent.com"
+}
+
+moved {
+  from = aws_iam_openid_connect_provider.github[0]
+  to   = aws_iam_openid_connect_provider.github
+}
+
+resource "aws_iam_openid_connect_provider" "github" {
+  url             = "https://token.actions.githubusercontent.com"
+  client_id_list  = ["sts.amazonaws.com"]
+  thumbprint_list = ["6938fd4d98bab03faadb97b34396831e3780aea1"]
+}
+
+resource "aws_iam_role" "github_actions_role" {
+  name = "${var.project_name}-github-actions-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Principal = {
+          Federated = local.oidc_provider_arn
+        }
+        Action = "sts:AssumeRoleWithWebIdentity"
+        Condition = {
+          StringLike = {
+            "token.actions.githubusercontent.com:sub" = "repo:${var.github_organization}/*"
+          }
+        }
+      }
+    ]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "ecr_image_builder_policy" {
+  role       = aws_iam_role.github_actions_role.name
+  policy_arn = "arn:aws:iam::aws:policy/EC2InstanceProfileForImageBuilderECRContainerBuilds"
+}
+
+resource "aws_iam_role_policy_attachment" "ecs_full_access" {
+  role       = aws_iam_role.github_actions_role.name
+  policy_arn = "arn:aws:iam::aws:policy/AmazonECS_FullAccess"
+}

package/dist/infra-templates/modules/github-oidc-role/outputs.tf

@@ -0,0 +1,4 @@
+output "role_arn" {
+  value       = aws_iam_role.github_actions_role.arn
+  description = "ARN of the GitHub Actions OIDC IAM role"
+}

package/dist/infra-templates/modules/github-oidc-role/variables.tf

@@ -0,0 +1,11 @@
+variable "project_name" {
+  description = "Project name used as prefix for resource names"
+}
+
+variable "github_organization" {
+  description = "GitHub organization name for OIDC trust policy"
+}
+
+variable "aws_account_id" {
+  description = "AWS account ID for constructing OIDC provider ARN"
+}

package/dist/infra-templates/modules/guardduty/main.tf

@@ -0,0 +1,8 @@
+moved {
+  from = aws_guardduty_detector.main[0]
+  to   = aws_guardduty_detector.main
+}
+
+resource "aws_guardduty_detector" "main" {
+  enable = true
+}

package/dist/infra-templates/modules/iam/main.tf

@@ -0,0 +1,205 @@
+resource "aws_iam_policy" "this" {
+  name        = "${var.project_name}AWSLoadBalancerControllerIAMPolicy"
+  description = "IAM policy for Load Balancer"
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "iam:CreateServiceLinkedRole"
+        ]
+        Resource = "*"
+        Condition = {
+          StringEquals = {
+            "iam:AWSServiceName" : "elasticloadbalancing.amazonaws.com"
+          }
+        }
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "ec2:DescribeAccountAttributes",
+          "ec2:DescribeAddresses",
+          "ec2:DescribeAvailabilityZones",
+          "ec2:DescribeInternetGateways",
+          "ec2:DescribeVpcs",
+          "ec2:DescribeVpcPeeringConnections",
+          "ec2:DescribeSubnets",
+          "ec2:DescribeSecurityGroups",
+          "ec2:DescribeInstances",
+          "ec2:DescribeNetworkInterfaces",
+          "ec2:DescribeTags",
+          "ec2:GetCoipPoolUsage",
+          "ec2:DescribeCoipPools",
+          "elasticloadbalancing:DescribeLoadBalancers",
+          "elasticloadbalancing:DescribeLoadBalancerAttributes",
+          "elasticloadbalancing:DescribeListeners",
+          "elasticloadbalancing:DescribeListenerCertificates",
+          "elasticloadbalancing:DescribeSSLPolicies",
+          "elasticloadbalancing:DescribeRules",
+          "elasticloadbalancing:DescribeTargetGroups",
+          "elasticloadbalancing:DescribeTargetGroupAttributes",
+          "elasticloadbalancing:DescribeTargetHealth",
+          "elasticloadbalancing:DescribeTags"
+        ]
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "cognito-idp:DescribeUserPoolClient",
+          "acm:ListCertificates",
+          "acm:DescribeCertificate",
+          "iam:ListServerCertificates",
+          "iam:GetServerCertificate",
+          "waf-regional:GetWebACL",
+          "waf-regional:GetWebACLForResource",
+          "waf-regional:AssociateWebACL",
+          "waf-regional:DisassociateWebACL",
+          "wafv2:GetWebACL",
+          "wafv2:GetWebACLForResource",
+          "wafv2:AssociateWebACL",
+          "wafv2:DisassociateWebACL",
+          "shield:GetSubscriptionState",
+          "shield:DescribeProtection",
+          "shield:CreateProtection",
+          "shield:DeleteProtection"
+        ]
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "ec2:AuthorizeSecurityGroupIngress",
+          "ec2:RevokeSecurityGroupIngress"
+        ]
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "ec2:CreateSecurityGroup"
+        ]
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "ec2:CreateTags"
+        ]
+        Resource = "arn:aws:ec2:*:*:security-group/*"
+        Condition = {
+          StringEquals = {
+            "ec2:CreateAction" : "CreateSecurityGroup"
+          }
+        }
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "ec2:AuthorizeSecurityGroupIngress",
+          "ec2:RevokeSecurityGroupIngress",
+          "ec2:DeleteSecurityGroup"
+        ]
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "elasticloadbalancing:CreateLoadBalancer",
+          "elasticloadbalancing:CreateTargetGroup"
+        ]
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "elasticloadbalancing:CreateListener",
+          "elasticloadbalancing:DeleteListener",
+          "elasticloadbalancing:CreateRule",
+          "elasticloadbalancing:DeleteRule"
+        ]
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "elasticloadbalancing:AddTags",
+          "elasticloadbalancing:RemoveTags"
+        ]
+        Resource = [
+          "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
+          "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
+          "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
+        ]
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "elasticloadbalancing:AddTags",
+          "elasticloadbalancing:RemoveTags"
+        ]
+        Resource = [
+          "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*",
+          "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*",
+          "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
+          "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*"
+        ]
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "elasticloadbalancing:ModifyLoadBalancerAttributes",
+          "elasticloadbalancing:SetIpAddressType",
+          "elasticloadbalancing:SetSecurityGroups",
+          "elasticloadbalancing:SetSubnets",
+          "elasticloadbalancing:DeleteLoadBalancer",
+          "elasticloadbalancing:ModifyTargetGroup",
+          "elasticloadbalancing:ModifyTargetGroupAttributes",
+          "elasticloadbalancing:DeleteTargetGroup"
+        ]
+        Resource = "*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "elasticloadbalancing:AddTags"
+        ]
+        Resource = [
+          "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
+          "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
+          "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
+        ]
+        Condition = {
+          StringEquals = {
+            "elasticloadbalancing:CreateAction" : [
+              "CreateTargetGroup",
+              "CreateLoadBalancer"
+            ]
+          }
+        }
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "elasticloadbalancing:RegisterTargets",
+          "elasticloadbalancing:DeregisterTargets"
+        ]
+        Resource = "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "elasticloadbalancing:SetWebAcl",
+          "elasticloadbalancing:ModifyListener",
+          "elasticloadbalancing:AddListenerCertificates",
+          "elasticloadbalancing:RemoveListenerCertificates",
+          "elasticloadbalancing:ModifyRule"
+        ]
+        Resource = "*"
+      }
+    ]
+  })
+}
+

package/dist/infra-templates/modules/iam/outputs.tf

@@ -0,0 +1,3 @@
+output "policy_arn" {
+  value = aws_iam_policy.this.arn
+}

package/dist/infra-templates/modules/iam/variables.tf

@@ -0,0 +1,4 @@
+variable "project_name" {
+  description = "A unique name for your project. This will be used as part of resource names."
+  default     = ""
+}

package/dist/infra-templates/modules/random-key/main.tf

@@ -0,0 +1,11 @@
+resource "random_string" "this" {
+  length  = var.length
+  upper   = true
+  lower   = true
+  numeric = true
+  special = false
+
+  keepers = {
+    constant = var.name
+  }
+}

package/dist/infra-templates/modules/random-key/outputs.tf

@@ -0,0 +1,4 @@
+output "value" {
+  value     = random_string.this.result
+  sensitive = true
+}

package/dist/infra-templates/modules/random-key/variables.tf

@@ -0,0 +1,10 @@
+variable "name" {
+  type        = string
+  description = "Keeper value — disambiguates this instance so unrelated random-key module calls don't collide or force each other to regenerate."
+}
+
+variable "length" {
+  type        = number
+  description = "Length of the generated random string."
+  default     = 32
+}

package/dist/infra-templates/modules/redis/main.tf

@@ -0,0 +1,47 @@
+resource "aws_security_group" "staging" {
+  name        = "${var.app_name}-redis-sg"
+  description = "Allow Redis traffic"
+  vpc_id      = var.vpc_id
+
+  ingress {
+    from_port   = 6379
+    to_port     = 6379
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+resource "aws_elasticache_subnet_group" "staging" {
+  name       = "${var.app_name}-ecsg"
+  subnet_ids = var.subnet_ids
+}
+
+resource "aws_elasticache_cluster" "staging" {
+  cluster_id           = var.app_name
+  engine               = "redis"
+  node_type            = var.node_type
+  num_cache_nodes      = 1
+  parameter_group_name = aws_elasticache_parameter_group.staging.name
+  engine_version       = "7.1"
+  port                 = 6379
+  subnet_group_name    = aws_elasticache_subnet_group.staging.name
+  security_group_ids   = [aws_security_group.staging.id]
+}
+
+resource "aws_elasticache_parameter_group" "staging" {
+  name        = "${var.app_name}-ec-param-group"
+  family      = "redis7"
+  description = "Custom parameter group for Redis cluster"
+
+  parameter {
+    name  = "maxmemory-policy"
+    value = "noeviction"
+  }
+}

package/dist/infra-templates/modules/redis/outputs.tf

@@ -0,0 +1,8 @@
+output "elasticache_cluster_hostname" {
+  value       = aws_elasticache_cluster.staging.cache_nodes[0].address
+  description = "The hostname of the ElastiCache cluster node"
+}
+
+output "app_name" {
+  value = var.app_name
+}

package/dist/infra-templates/modules/redis/variables.tf

@@ -0,0 +1,20 @@
+variable "vpc_id" {
+  description = "The id of environment VPC"
+  default     = ""
+}
+
+variable "subnet_ids" {
+  type        = list(string)
+  description = "List of private subnet IDs"
+  default     = []
+}
+
+variable "app_name" {
+  description = "Cognito user pool name"
+  default     = ""
+}
+
+variable "node_type" {
+  description = "ElastiCache node type"
+  default     = "cache.t3.small"
+}

package/dist/infra-templates/modules/relational-database-service/main.tf

@@ -0,0 +1,44 @@
+resource "random_password" "db" {
+  length  = 32
+  special = false
+
+  keepers = {
+    app_name = var.app_name
+  }
+}
+
+locals {
+  effective_db_password = coalesce(var.db_password, random_password.db.result)
+}
+
+module "db" {
+  source = "terraform-aws-modules/rds/aws"
+  version = "6.13.1"
+
+  identifier = var.app_name
+
+  engine            = "postgres"
+  engine_version    = "14.22"
+  instance_class    = var.db_instance_type
+  allocated_storage = var.db_allocated_storage
+
+  db_name  = var.db_name
+  username = var.db_username
+  password = local.effective_db_password
+
+  iam_database_authentication_enabled = false
+  manage_master_user_password         = false
+  publicly_accessible                 = true
+
+  vpc_security_group_ids = [aws_security_group.this.id, var.vpc_security_group_default]
+
+  maintenance_window = "Mon:00:00-Mon:03:00"
+  backup_window      = "03:00-06:00"
+
+  create_db_subnet_group = true
+  subnet_ids             = var.subnet_ids
+
+  family               = "postgres14"
+  major_engine_version = "14"
+  deletion_protection  = false
+}

package/dist/infra-templates/modules/relational-database-service/outputs.tf

@@ -0,0 +1,13 @@
+output "db_hostname" {
+  value       =  module.db.db_instance_endpoint
+  description = "The database hostname (endpoint) for staging. Will be 'N/A' if not created."
+}
+
+output "db_password" {
+  value     = local.effective_db_password
+  sensitive = true
+}
+
+output "app_name" {
+  value = var.app_name
+}

package/dist/infra-templates/modules/relational-database-service/security-group.tf

@@ -0,0 +1,15 @@
+resource "aws_security_group" "this" {
+  name        = "${var.app_name}-rds-security-group"
+  description = "Security group for RDS instance"
+  vpc_id      = var.vpc_id
+}
+
+resource "aws_security_group_rule" "ingress" {
+  count             = var.allowed_ip_list != "" ? 1 : 0
+  type              = "ingress"
+  from_port         = 5432
+  to_port           = 5432
+  protocol          = "tcp"
+  cidr_blocks       = split(",", var.allowed_ip_list)
+  security_group_id = aws_security_group.this.id
+}

package/dist/infra-templates/modules/relational-database-service/variables.tf

@@ -0,0 +1,50 @@
+variable "app_name" {
+  description = "A unique name for your project. This will be used as part of resource names."
+  default     = ""
+}
+
+variable "allowed_ip_list" {
+  description = "The list of IP which can get access into database"
+  default     = ""
+}
+
+variable "vpc_id" {
+  description = "The id of environment VPC"
+  default     = ""
+}
+
+variable "subnet_ids" {
+  description = "Public subnet IDs"
+  default     = ""
+}
+
+variable "vpc_security_group_default" {
+  description = "The id of VPC where create security group for RDS access"
+  default     = ""
+}
+
+variable "db_password" {
+  description = "Master database password. Leave empty to auto-generate."
+  default     = ""
+  sensitive   = true
+}
+
+variable "db_username" {
+  description = "Username for db"
+  default     = ""
+}
+
+variable "db_name" {
+  description = "Name of db"
+  default     = ""
+}
+
+variable "db_instance_type" {
+  description = "Database instance type"
+  default     = "db.t3.small"
+}
+
+variable "db_allocated_storage" {
+  description = "Database allocated storage"
+  default     = 30
+}

package/dist/infra-templates/modules/secret/main.tf

@@ -0,0 +1,14 @@
+resource "random_id" "secret_suffix" {
+  byte_length = 4
+}
+
+resource "aws_secretsmanager_secret" "app" {
+  name                    = "${var.name}-${random_id.secret_suffix.hex}"
+  description             = "This is a ${var.name} secret"
+  recovery_window_in_days = 0
+}
+
+resource "aws_secretsmanager_secret_version" "app" {
+  secret_id     = aws_secretsmanager_secret.app.id
+  secret_string = jsonencode(var.env_vars)
+}

package/dist/infra-templates/modules/secret/outputs.tf

@@ -0,0 +1,3 @@
+output "secret_arn" {
+  value = aws_secretsmanager_secret.app.arn
+}

package/dist/infra-templates/modules/secret/variables.tf

@@ -0,0 +1,8 @@
+variable "name" {
+  description = "Secret Name"
+}
+
+variable "env_vars" {
+  type    = map(string)
+  default = {}
+}

package/dist/infra-templates/modules/simple-storage-service/main.tf

@@ -0,0 +1,28 @@
+resource "random_id" "bucket_suffix" {
+  byte_length = 4
+}
+
+module "s3_bucket" {
+  source  = "terraform-aws-modules/s3-bucket/aws"
+  version = "5.9.1"
+
+  bucket = "${var.project_name}-${random_id.bucket_suffix.hex}"
+  acl    = "private"
+
+  control_object_ownership = true
+  object_ownership         = "ObjectWriter"
+
+  versioning = {
+    enabled = true
+  }
+
+  cors_rule = [
+    {
+      allowed_headers = ["Content-Type"]
+      allowed_methods = ["PUT", "POST", "GET"]
+      allowed_origins = ["*"]
+      expose_headers  = ["ETag"]
+      max_age_seconds = 3000
+    }
+  ]
+}

package/dist/infra-templates/modules/simple-storage-service/variables.tf

@@ -0,0 +1,4 @@
+variable "project_name" {
+  description = "A unique name for your project. This will be used as part of resource names."
+  default     = ""
+}

package/dist/infra-templates/modules/vpc/data.tf

@@ -0,0 +1,2 @@
+data "aws_availability_zones" "available" {
+}