grada-run 0.0.2 → 0.32.0

package/templates/terraform/oidc.tf

@@ -0,0 +1,64 @@
+# Fetch GitHub's OIDC certificate thumbprint
+data "tls_certificate" "github" {
+  url = "https://token.actions.githubusercontent.com"
+}
+
+variable "create_oidc_provider" {
+  description = "Set to false if you already have OIDC provider in your AWS account"
+  type        = bool
+  default     = true
+}
+
+# Register GitHub as an Identity Provider in AWS (Production Only)
+resource "aws_iam_openid_connect_provider" "github" {
+  count           = (var.create_oidc_provider && terraform.workspace == "default") ? 1 : 0
+  url             = "https://token.actions.githubusercontent.com"
+  client_id_list  = ["sts.amazonaws.com"]
+  thumbprint_list = [data.tls_certificate.github.certificates[0].sha1_fingerprint]
+}
+
+# Reference the Provider (whether newly created or already existing)
+data "aws_iam_openid_connect_provider" "github_existing" {
+  count = (var.create_oidc_provider && terraform.workspace == "default") ? 0 : 1
+  url   = "https://token.actions.githubusercontent.com"
+}
+
+# Dynamically pick the ARN of the provider based on the variable
+locals {
+  github_provider_arn = (var.create_oidc_provider && terraform.workspace == "default") ? aws_iam_openid_connect_provider.github[0].arn : data.aws_iam_openid_connect_provider.github_existing[0].arn
+}
+
+# Create the IAM Role that GitHub Actions will assume
+resource "aws_iam_role" "github_actions" {
+  count = terraform.workspace == "default" ? 1 : 0
+  name  = "{{PROJECT_NAME}}-github-actions-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = "sts:AssumeRoleWithWebIdentity"
+        Effect = "Allow"
+        Principal = {
+          Federated = local.github_provider_arn
+        }
+        Condition = {
+          StringLike = {
+            # ⚠️ SECURITY: Update "repo:*" to "repo:your-github-username/your-repo-name:*" in production
+            "token.actions.githubusercontent.com:sub" : "repo:*"
+          }
+          StringEquals = {
+            "token.actions.githubusercontent.com:aud" : "sts.amazonaws.com"
+          }
+        }
+      }
+    ]
+  })
+}
+
+# Grant the CI/CD pipeline permissions to provision infrastructure
+resource "aws_iam_role_policy_attachment" "github_actions_admin" {
+  count      = terraform.workspace == "default" ? 1 : 0
+  role       = aws_iam_role.github_actions[0].name
+  policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
+}

package/templates/terraform/secrets.tf

@@ -0,0 +1,31 @@
+# --- Shared AWS Secrets Manager ---
+
+# 1. Only create the Secret Vault in the default (production) workspace
+resource "aws_secretsmanager_secret" "app_secrets" {
+  count                   = terraform.workspace == "default" ? 1 : 0
+  name                    = "{{PROJECT_NAME}}-secrets"
+  description             = "Environment variables for {{PROJECT_NAME}}"
+  recovery_window_in_days = 0 # Allows instant deletion for dev/POC environments
+}
+
+# 2. Fetch the existing Secret Vault when running in a PR workspace
+data "aws_secretsmanager_secret" "existing_secrets" {
+  count = terraform.workspace != "default" ? 1 : 0
+  name  = "{{PROJECT_NAME}}-secrets"
+}
+
+# 3. Export a single local variable that works in both environments
+locals {
+  secret_arn = terraform.workspace == "default" ? aws_secretsmanager_secret.app_secrets[0].arn : data.aws_secretsmanager_secret.existing_secrets[0].arn
+}
+
+# Initial placeholder secret so the ECS task doesn't fail on first boot
+resource "aws_secretsmanager_secret_version" "app_secrets_initial" {
+  count         = terraform.workspace == "default" ? 1 : 0
+  secret_id     = aws_secretsmanager_secret.app_secrets[0].id
+  secret_string = jsonencode({{INITIAL_SECRET_MAP}})
+
+  lifecycle {
+    ignore_changes = [secret_string]
+  }
+}

package/templates/terraform/worker.tf

@@ -0,0 +1,69 @@
+# --- Worker ECS Task Definition ---
+resource "aws_ecs_task_definition" "worker" {
+  family                   = "${local.app_name}-worker-task"
+  network_mode             = "awsvpc"
+  requires_compatibilities = ["FARGATE"]
+  cpu                      = "{{CPU}}"
+  memory                   = "{{MEMORY}}"
+  execution_role_arn       = aws_iam_role.execution_role.arn
+  task_role_arn            = aws_iam_role.task_role.arn
+
+  container_definitions = jsonencode([
+    {
+      name      = "${local.app_name}-worker-container"
+      image     = "${local.ecr_url}:${terraform.workspace == "default" ? "latest" : terraform.workspace}"
+      essential = true
+
+      environment = [
+        { "name": "NODE_ENV", "value": "production" },
+        {{DB_ENV_VARS}}
+      ]
+
+      secrets = concat(
+        [
+          for key in local.secret_keys : {
+            name      = key
+            valueFrom = "${local.secret_arn}:${key}::"
+          }
+        ],
+        [
+          {{TASK_SECRETS}}
+        ]
+      )
+
+      {{WORKER_COMMAND}}
+
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          "awslogs-group"         = aws_cloudwatch_log_group.app_logs.name
+          "awslogs-region"        = "{{REGION}}"
+          "awslogs-stream-prefix" = "worker" # Isolates worker logs from web logs
+        }
+      }
+    }
+  ])
+}
+
+# --- Worker ECS Service ---
+# Notice there is NO load_balancer block. This service is strictly private.
+resource "aws_ecs_service" "worker" {
+  name                   = "${local.app_name}-worker-service"
+  cluster                = aws_ecs_cluster.main.id
+  task_definition        = aws_ecs_task_definition.worker.arn
+  launch_type            = "FARGATE"
+  desired_count          = 1
+  enable_execute_command = true
+
+  network_configuration {
+    subnets          = aws_subnet.public[*].id
+    security_groups  = [aws_security_group.ecs_tasks.id]
+    assign_public_ip = true
+  }
+
+  # Queue-depth auto-scaling (see `grada add queue:sqs`) manages
+  # desired_count outside Terraform; ignore it to avoid apply-time drift.
+  lifecycle {
+    ignore_changes = [desired_count]
+  }
+}