fogies 0.0.0.dev7__tar.gz → 0.0.0.dev10__tar.gz

{fogies-0.0.0.dev7 → fogies-0.0.0.dev10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fogies
-Version: 0.0.0.dev7
+Version: 0.0.0.dev10
 Summary: 
 Author: James Fogarty
 Author-email: jayfo@users.noreply.github.com

{fogies-0.0.0.dev7 → fogies-0.0.0.dev10}/pyproject.toml

@@ -1,7 +1,7 @@
 [project]
 name = "fogies"
 # Version follows semantic versioning <https://semver.org/>.
-version = "0.0.0-dev.7"
+version = "0.0.0-dev.10"
 description = ""
 authors = [
     {name = "James Fogarty",email = "jayfo@users.noreply.github.com"}

{fogies-0.0.0.dev7 → fogies-0.0.0.dev10}/src/fogies/aws_access_key.py

@@ -7,14 +7,14 @@ from typing import TYPE_CHECKING
 
 from pydantic import BaseModel
 
+from fogies.boto_clients import boto_client_iam
 from fogies.tools.aws_environ import AwsProfile
-from fogies.typing import boto_client_iam
 
 if TYPE_CHECKING:
     from mypy_boto3_iam.type_defs import AccessKeyMetadataTypeDef
 
 
-class _IamAccessKeyInfo(BaseModel):
+class IamAccessKeyInfo(BaseModel):
     key_id: str
     status: str
     created: datetime.datetime | None
@@ -22,11 +22,11 @@ class _IamAccessKeyInfo(BaseModel):
 
 
 class IamAccessKeys(BaseModel):
-    current: _IamAccessKeyInfo | None  # newest key
-    previous: _IamAccessKeyInfo | None  # oldest key; only present when two keys exist
+    current: IamAccessKeyInfo | None  # newest key
+    previous: IamAccessKeyInfo | None  # oldest key; only present when two keys exist
 
 
-class _IamUserInfo(BaseModel):
+class IamUserInfo(BaseModel):
     username: str
     keys: IamAccessKeys
 
@@ -47,11 +47,11 @@ def get_keys(*, username: str) -> IamAccessKeys:
         reverse=True,
     )
 
-    def _to_info(raw_key: AccessKeyMetadataTypeDef) -> _IamAccessKeyInfo:
+    def _to_info(raw_key: AccessKeyMetadataTypeDef) -> IamAccessKeyInfo:
         key_id = raw_key.get("AccessKeyId", "")
         last_used_response = iam.get_access_key_last_used(AccessKeyId=key_id)
         last_used = last_used_response["AccessKeyLastUsed"].get("LastUsedDate")
-        return _IamAccessKeyInfo(
+        return IamAccessKeyInfo(
             key_id=key_id,
             status=raw_key.get("Status", ""),
             created=raw_key.get("CreateDate"),
@@ -64,7 +64,7 @@ def get_keys(*, username: str) -> IamAccessKeys:
     )
 
 
-def list_users() -> list[_IamUserInfo]:
+def list_users() -> list[IamUserInfo]:
     """List all IAM users (sorted by name) and their access keys."""
     iam = boto_client_iam()
     raw_users = [
@@ -73,9 +73,7 @@ def list_users() -> list[_IamUserInfo]:
         for user in page["Users"]
     ]
     users = [
-        _IamUserInfo(
-            username=user["UserName"], keys=get_keys(username=user["UserName"])
-        )
+        IamUserInfo(username=user["UserName"], keys=get_keys(username=user["UserName"]))
         for user in raw_users
     ]
     return sorted(users, key=lambda u: u.username)

fogies-0.0.0.dev7/src/fogies/typing.py → fogies-0.0.0.dev10/src/fogies/boto_clients.py

@@ -1,4 +1,4 @@
-"""Typing helpers for cleanly annotating loosely-typed third-party APIs."""
+"""Typed factories for boto3 clients."""
 
 from __future__ import annotations
 
@@ -9,6 +9,7 @@ import boto3
 if TYPE_CHECKING:
     from mypy_boto3_ec2.client import EC2Client
     from mypy_boto3_ecs.client import ECSClient
+    from mypy_boto3_elbv2.client import ElasticLoadBalancingv2Client
     from mypy_boto3_iam.client import IAMClient
     from mypy_boto3_logs.client import CloudWatchLogsClient
     from mypy_boto3_s3.client import S3Client
@@ -39,6 +40,13 @@ def boto_client_ecs(*, region: str) -> ECSClient:
     )
 
 
+def boto_client_elbv2(*, region: str) -> ElasticLoadBalancingv2Client:
+    """Obtain a boto3 Elastic Load Balancing v2 client for region."""
+    return boto3.Session().client(  # pyright: ignore[reportUnknownMemberType]
+        "elbv2", region_name=region
+    )
+
+
 def boto_client_logs(*, region: str) -> CloudWatchLogsClient:
     """Obtain a boto3 CloudWatch Logs client for region."""
     return boto3.Session().client(  # pyright: ignore[reportUnknownMemberType]

fogies-0.0.0.dev10/src/fogies/download_verified.py

@@ -0,0 +1,39 @@
+"""Download a file over HTTP, verifying its SHA-256 checksum."""
+
+import hashlib
+import urllib.request
+from http.client import HTTPResponse
+from typing import cast
+
+# Timeout for each blocking socket operation of a download, in seconds.
+DOWNLOAD_VERIFIED_TIMEOUT_SECONDS = 300.0
+
+
+def download_verified(
+    *,
+    url: str,
+    sha256: str,
+    timeout_seconds: float = DOWNLOAD_VERIFIED_TIMEOUT_SECONDS,
+) -> bytes:
+    """Download *url* and return its content, if its SHA-256 matches *sha256*.
+
+    *sha256* is the expected checksum as a hexadecimal string, taken from the
+    publisher and recorded alongside the pinned version being downloaded.
+    *timeout_seconds* applies to each blocking socket operation, not to the
+    download as a whole, so a stalled connection fails instead of hanging.
+    Raises ValueError if the checksum does not match, returning nothing.
+    """
+    response = cast(HTTPResponse, urllib.request.urlopen(url, timeout=timeout_seconds))
+    with response:
+        content: bytes = response.read()
+
+    actual_sha256 = hashlib.sha256(content).hexdigest()
+    if actual_sha256 != sha256.lower():
+        raise ValueError(
+            "SHA-256 mismatch for '{}': expected {}, got {}".format(
+                url,
+                sha256.lower(),
+                actual_sha256,
+            )
+        )
+    return content

fogies-0.0.0.dev10/src/fogies/pyfogies.py

@@ -0,0 +1,67 @@
+"""Facts about the installed pyfogies package itself."""
+
+import importlib.metadata
+import re
+from enum import StrEnum
+
+# importlib.metadata reports the PEP 440 canonical form, which is how Poetry
+# normalizes the SemVer-hyphenated version string written in pyproject.toml
+# and CHANGELOG.md (e.g. "0.0.0-dev.6" becomes "0.0.0.dev6"). These are the
+# only two shapes this project's own versions ever take.
+_FINAL_RELEASE_RE = re.compile(r"^\d+\.\d+\.\d+$")
+_DEV_RELEASE_RE = re.compile(r"^(?P<base>\d+\.\d+\.\d+)\.dev(?P<dev>\d+)$")
+
+
+class PyfogiesVersionFormat(StrEnum):
+    """The formats in which pyfogies_version() can return the installed version."""
+
+    # As importlib.metadata reports it, e.g. "0.0.0.dev6".
+    PEP440 = "pep440"
+    # As written in pyproject.toml and CHANGELOG.md, e.g. "0.0.0-dev.6".
+    SEMVER = "semver"
+    # The release tag for the version, e.g. "v0.0.0-dev.6".
+    GIT_TAG = "git_tag"
+
+
+def _pep440_version() -> str:
+    """The installed pyfogies version, as PEP 440 (e.g. "0.0.0.dev6").
+
+    Raises if the installed version doesn't match either expected shape,
+    rather than guessing at an unfamiliar one.
+    """
+    installed_version = importlib.metadata.version("fogies")
+
+    if _FINAL_RELEASE_RE.match(installed_version) or _DEV_RELEASE_RE.match(
+        installed_version
+    ):
+        return installed_version
+
+    raise ValueError(
+        "Unrecognized pyfogies version '{}'; expected 'X.Y.Z' or 'X.Y.Z.devN'".format(
+            installed_version
+        )
+    )
+
+
+def _semver_version() -> str:
+    """The installed pyfogies version, as SemVer (e.g. "0.0.0-dev.6")."""
+    pep440_version = _pep440_version()
+
+    dev_release_match = _DEV_RELEASE_RE.match(pep440_version)
+    if dev_release_match:
+        return "{}-dev.{}".format(
+            dev_release_match.group("base"), dev_release_match.group("dev")
+        )
+
+    return pep440_version
+
+
+def pyfogies_version(*, version_format: PyfogiesVersionFormat) -> str:
+    """The installed pyfogies version, in the requested *version_format*."""
+    match PyfogiesVersionFormat(version_format):
+        case PyfogiesVersionFormat.PEP440:
+            return _pep440_version()
+        case PyfogiesVersionFormat.SEMVER:
+            return _semver_version()
+        case PyfogiesVersionFormat.GIT_TAG:
+            return "v{}".format(_semver_version())

{fogies-0.0.0.dev7 → fogies-0.0.0.dev10}/src/fogies/retry.py

@@ -28,7 +28,7 @@ def _log_retry(log_path: pathlib.Path) -> Callable[[tenacity.RetryCallState], No
             type(exception).__name__,
             exception,
         )
-        with log_path.open("a", encoding="utf-8") as f:
+        with log_path.open("a", encoding="utf-8", newline="\n") as f:
             _ = f.write(line)
 
     return log_it

{fogies-0.0.0.dev7 → fogies-0.0.0.dev10}/src/fogies/tasks/access_key.py

@@ -13,11 +13,11 @@ from invoke.tasks import Task, task
 
 import fogies.aws_access_key as aws_access_key
 from fogies.tools.aws_environ import (
+    AwsEnviron,
     AwsEnvironFactory,
     AwsProfile,
     aws_environ_from_profile,
 )
-from fogies.typing import boto_client_sts
 
 
 def _prompt_admin_credentials() -> tuple[str, str]:
@@ -30,16 +30,17 @@ def _prompt_admin_credentials() -> tuple[str, str]:
 @contextlib.contextmanager
 def _resolve_admin_environ(
     *, aws_environ_factory: AwsEnvironFactory | None, prompt: bool
-) -> Generator[str]:
+) -> Generator[AwsEnviron]:
     """Enter the configured AWS environment, or prompt for admin credentials.
 
     Prompts if aws_environ_factory is None, or if prompt is True (e.g. to use
     different/elevated credentials for a single run). Prompted credentials
-    are never written anywhere. Yields the active access key ID.
+    are never written anywhere. Yields the active environment, which
+    identifies the caller's username and access key ID.
     """
     if aws_environ_factory is not None and not prompt:
         with aws_environ_factory() as env:
-            yield env.aws_access_key_id
+            yield env
         return
 
     access_key_id, secret_access_key = _prompt_admin_credentials()
@@ -54,18 +55,11 @@ def _resolve_admin_environ(
     with contextlib.ExitStack() as stack:
         try:
             env = stack.enter_context(
-                aws_environ_from_profile(profile=profile, raise_if_exists=False)
+                aws_environ_from_profile(profile=profile, raise_if_env_exists=False)
             )
         except ValueError as exc:
             raise SystemExit(str(exc)) from exc
-        yield env.aws_access_key_id
-
-
-def _caller_username() -> str:
-    """Return the IAM username that owns the active credentials, via STS."""
-    arn = boto_client_sts().get_caller_identity()["Arn"]
-    # ARN format for IAM users: arn:aws:iam::123456789012:user/username
-    return arn.split("/")[-1]
+        yield env
 
 
 def _print_toml_block(*, profile: AwsProfile) -> None:
@@ -102,14 +96,17 @@ def _print_user_key_overview(
 def get_task_create(
     *, aws_environ_factory: AwsEnvironFactory | None = None
 ) -> Task[Callable[..., None]]:
-    @task(name="create")  # pyright: ignore[reportUntypedFunctionDecorator]
+    @task(
+        name="create",
+        positional=[],
+        help={
+            "prompt": "Prompt for admin credentials.",
+            "username": "IAM username.",
+        },
+    )  # pyright: ignore[reportUntypedFunctionDecorator]
     def task_create(context: Context, *, prompt: bool = False, username: str) -> None:
         """
         Create an IAM user and an associated access key.
-
-        Flags:
-          --prompt    Prompt for admin credentials.
-          --username  IAM username.
         """
         _ = context
         with _resolve_admin_environ(
@@ -126,20 +123,22 @@ def get_task_create(
 def get_task_delete(
     *, aws_environ_factory: AwsEnvironFactory | None = None
 ) -> Task[Callable[..., None]]:
-    @task(name="delete")  # pyright: ignore[reportUntypedFunctionDecorator]
+    @task(
+        name="delete",
+        positional=[],
+        help={
+            "prompt": "Prompt for admin credentials.",
+            "username": "IAM username.",
+        },
+    )  # pyright: ignore[reportUntypedFunctionDecorator]
     def task_delete(context: Context, *, prompt: bool = False, username: str) -> None:
         """
         Delete an IAM user with no remaining access keys.
-
-        Flags:
-          --prompt    Prompt for admin credentials.
-          --username  IAM username.
         """
         _ = context
         with _resolve_admin_environ(
             aws_environ_factory=aws_environ_factory, prompt=prompt
-        ):
-            protected_username = _caller_username()
+        ) as admin:
             confirm = (
                 input("Delete IAM user '{}'? [y/N] ".format(username)).strip().lower()
             )
@@ -148,7 +147,7 @@ def get_task_delete(
                 return
             aws_access_key.delete_user(
                 username=username,
-                protected_usernames={protected_username},
+                protected_usernames={admin.username},
             )
         print("Deleted IAM user '{}'.".format(username))
 
@@ -158,21 +157,24 @@ def get_task_delete(
 def get_task_delete_key(
     *, aws_environ_factory: AwsEnvironFactory | None = None
 ) -> Task[Callable[..., None]]:
-    @task(name="delete-key")  # pyright: ignore[reportUntypedFunctionDecorator]
+    @task(
+        name="delete-key",
+        positional=[],
+        help={
+            "prompt": "Prompt for admin credentials.",
+            "username": "IAM username.",
+        },
+    )  # pyright: ignore[reportUntypedFunctionDecorator]
     def task_delete_key(
         context: Context, *, prompt: bool = False, username: str
     ) -> None:
         """
         Delete the oldest access key for an IAM user.
-
-        Flags:
-          --prompt    Prompt for admin credentials.
-          --username  IAM username.
         """
         _ = context
         with _resolve_admin_environ(
             aws_environ_factory=aws_environ_factory, prompt=prompt
-        ) as admin_key_id:
+        ) as admin:
             keys = aws_access_key.get_keys(username=username)
             target = keys.previous or keys.current
             if target is None:
@@ -192,7 +194,7 @@ def get_task_delete_key(
             aws_access_key.delete_key(
                 username=username,
                 key_id=key_id,
-                protected_key_ids={admin_key_id},
+                protected_key_ids={admin.aws_access_key_id},
             )
         print("Deleted key {}.".format(key_id))
 
@@ -202,13 +204,15 @@ def get_task_delete_key(
 def get_task_list(
     *, aws_environ_factory: AwsEnvironFactory | None = None
 ) -> Task[Callable[..., None]]:
-    @task(name="list")  # pyright: ignore[reportUntypedFunctionDecorator]
+    @task(
+        name="list",
+        help={
+            "prompt": "Prompt for admin credentials.",
+        },
+    )  # pyright: ignore[reportUntypedFunctionDecorator]
     def task_list(context: Context, *, prompt: bool = False) -> None:
         """
         List all IAM users and their access keys.
-
-        Flags:
-          --prompt  Prompt for admin credentials.
         """
         _ = context
         with _resolve_admin_environ(
@@ -229,21 +233,24 @@ def get_task_list(
 def get_task_rotate_key(
     *, aws_environ_factory: AwsEnvironFactory | None = None
 ) -> Task[Callable[..., None]]:
-    @task(name="rotate-key")  # pyright: ignore[reportUntypedFunctionDecorator]
+    @task(
+        name="rotate-key",
+        positional=[],
+        help={
+            "prompt": "Prompt for admin credentials.",
+            "username": "IAM username.",
+        },
+    )  # pyright: ignore[reportUntypedFunctionDecorator]
     def task_rotate_key(
         context: Context, *, prompt: bool = False, username: str
     ) -> None:
         """
         Add a new access key to an existing IAM user.
-
-        Flags:
-          --prompt    Prompt for admin credentials instead of using the configured AWS environment.
-          --username  IAM username to rotate a key for.
         """
         _ = context
         with _resolve_admin_environ(
             aws_environ_factory=aws_environ_factory, prompt=prompt
-        ) as admin_key_id:
+        ) as admin:
             keys = aws_access_key.get_keys(username=username)
             if keys.previous is not None:
                 _print_user_key_overview(username=username, keys=keys)
@@ -258,7 +265,7 @@ def get_task_rotate_key(
                     return
             new_profile = aws_access_key.rotate_key(
                 username=username,
-                protected_key_ids={admin_key_id},
+                protected_key_ids={admin.aws_access_key_id},
             )
         print("Created access key {}.".format(new_profile.aws_access_key_id))
         _print_toml_block(profile=new_profile)
@@ -267,10 +274,10 @@ def get_task_rotate_key(
 
 
 def get_collection(
-    *, aws_environ_factory: AwsEnvironFactory | None = None
+    *, collection_name: str, aws_environ_factory: AwsEnvironFactory | None = None
 ) -> Collection:
     """Get a collection of tasks for managing IAM users and access keys."""
-    collection = Collection("access-key")
+    collection = Collection(collection_name)
     collection.add_task(get_task_create(aws_environ_factory=aws_environ_factory))
     collection.add_task(get_task_delete(aws_environ_factory=aws_environ_factory))
     collection.add_task(get_task_delete_key(aws_environ_factory=aws_environ_factory))

{fogies-0.0.0.dev7 → fogies-0.0.0.dev10}/src/fogies/tasks/poetry.py

@@ -32,44 +32,45 @@ def get_task_build() -> Task[Callable[[Context], None]]:
     return cast(Task[Callable[[Context], None]], task_build)
 
 
-def get_task_publish(*, path_secrets_poetry: Path) -> Task[Callable[[Context], None]]:
+def get_task_publish(*, secrets_poetry_path: Path) -> Task[Callable[[Context], None]]:
     @task(name="publish")  # pyright: ignore[reportUntypedFunctionDecorator]
     def task_publish(context: Context) -> None:
         """
         Publish package to PyPI.
         """
         ensure_from_template(
-            path=path_secrets_poetry, template_factory=poetry_toml_template_factory
+            path=secrets_poetry_path, template_factory=poetry_toml_template_factory
         )
 
-        with path_secrets_poetry.open("rb") as handle:
+        with secrets_poetry_path.open("rb") as handle:
             secrets_poetry = tomllib.load(handle)
 
         api_key: str = cast(str, secrets_poetry["pypi"]["api_key"])
 
+        # Read the PyPI token from the environment,
+        # so it is not echoed to the terminal as exposed to other processes.
         _ = context.run(
             command=" ".join(
                 [
                     "poetry",
                     "publish",
-                    "--username __token__",
-                    "--password {}".format(api_key),
                 ]
             ),
             echo=True,
+            env={"POETRY_PYPI_TOKEN_PYPI": api_key},
         )
 
     return cast(Task[Callable[[Context], None]], task_publish)
 
 
-def get_collection(*, path_secrets_poetry: Path) -> Collection:
+def get_collection(*, secrets_poetry_path: Path) -> Collection:
     """
     Get a collection of tasks.
     """
     namespace = Collection("poetry")
 
     task_build = get_task_build()
-    task_publish = get_task_publish(path_secrets_poetry=path_secrets_poetry)
+    task_publish = get_task_publish(secrets_poetry_path=secrets_poetry_path)
 
     namespace.add_task(task_build)
     namespace.add_task(task_publish)

{fogies-0.0.0.dev7 → fogies-0.0.0.dev10}/src/fogies/tasks/terraform.py

@@ -4,6 +4,7 @@ import pathlib
 from contextlib import ExitStack
 from typing import Callable, cast
 
+from invoke.collection import Collection
 from invoke.context import Context
 from invoke.tasks import Task, task
 
@@ -17,7 +18,6 @@ from fogies.tools.terraform import (
     TfbackendFactory,
     TfvarsFactory,
     terraform,
-    terraform_templated,
 )
 
 
@@ -40,7 +40,15 @@ def get_task_apply(
     if (backend_status_path is None) != (backend is None):
         raise ValueError("backend_status_path and backend must be provided together")
 
-    @task(name="apply")  # pyright: ignore[reportUntypedFunctionDecorator]
+    @task(
+        name="apply",
+        help={
+            "init": "Include terraform init. Skip with --no-init.",
+            "init_upgrade": "During init, upgrade providers.",
+            "init_reconfigure": "During init, reconfigure the backend.",
+            "apply_auto_approve": "Skip interactive confirmation.",
+        },
+    )  # pyright: ignore[reportUntypedFunctionDecorator]
     def task_apply(
         context: Context,
         init: bool = default_init,
@@ -50,14 +58,6 @@ def get_task_apply(
     ) -> None:
         """
         Apply a Terraform configuration.
-
-        Flags:
-          --init                Run terraform init before apply (downloads providers, sets up backend).
-          --init-upgrade        Pass -upgrade to init; checks for newer provider versions within constraints.
-          --init-reconfigure    Pass -reconfigure to init; re-initializes backend from scratch.
-          --apply-auto-approve  Skip Terraform's interactive confirmation prompt.
-
-        --init-upgrade and --init-reconfigure require --init.
         """
         if init_upgrade and not init:
             raise ValueError("--init-upgrade requires --init")
@@ -72,14 +72,6 @@ def get_task_apply(
         )
 
         with ExitStack() as stack:
-            templated_paths = stack.enter_context(
-                terraform_templated(module_path=module_path)
-            )
-            if templated_paths:
-                print("Rendered __PYFOGIES_VERSION__ in:")
-                for templated_path in templated_paths:
-                    print("  {}".format(templated_path))
-
             if aws_environ_factory is not None:
                 _ = stack.enter_context(aws_environ_factory())
 
@@ -129,7 +121,15 @@ def get_task_destroy(
     if (backend_status_path is None) != (backend is None):
         raise ValueError("backend_status_path and backend must be provided together")
 
-    @task(name="destroy")  # pyright: ignore[reportUntypedFunctionDecorator]
+    @task(
+        name="destroy",
+        help={
+            "init": "Include terraform init. Skip with --no-init.",
+            "init_upgrade": "During init, upgrade providers.",
+            "init_reconfigure": "During init, reconfigure the backend.",
+            "destroy_auto_approve": "Skip interactive confirmation.",
+        },
+    )  # pyright: ignore[reportUntypedFunctionDecorator]
     def task_destroy(
         context: Context,
         init: bool = default_init,
@@ -139,14 +139,6 @@ def get_task_destroy(
     ) -> None:
         """
         Destroy a Terraform configuration.
-
-        Flags:
-          --init                 Run terraform init before destroy (downloads providers, sets up backend).
-          --init-upgrade         Pass -upgrade to init; checks for newer provider versions within constraints.
-          --init-reconfigure     Pass -reconfigure to init; re-initializes backend from scratch.
-          --destroy-auto-approve Skip Terraform's interactive confirmation prompt.
-
-        --init-upgrade and --init-reconfigure require --init.
         """
         if init_upgrade and not init:
             raise ValueError("--init-upgrade requires --init")
@@ -161,14 +153,6 @@ def get_task_destroy(
         )
 
         with ExitStack() as stack:
-            templated_paths = stack.enter_context(
-                terraform_templated(module_path=module_path)
-            )
-            if templated_paths:
-                print("Rendered __PYFOGIES_VERSION__ in:")
-                for templated_path in templated_paths:
-                    print("  {}".format(templated_path))
-
             if aws_environ_factory is not None:
                 _ = stack.enter_context(aws_environ_factory())
 
@@ -196,3 +180,41 @@ def get_task_destroy(
             )
 
     return cast(Task[Callable[[Context, bool, bool, bool, bool], None]], task_destroy)
+
+
+def get_collection(
+    *,
+    collection_name: str,
+    binary_cache_path: pathlib.Path,
+    module_path: pathlib.Path,
+    aws_environ_factory: AwsEnvironFactory | None = None,
+    backend: BackendConfig | None = None,
+    backend_status_path: pathlib.Path | None = None,
+    tfbackend_factory: TfbackendFactory | None = None,
+    tfvars_factory: TfvarsFactory | None = None,
+) -> Collection:
+    """Get a collection of tasks for applying and destroying a Terraform configuration."""
+    collection = Collection(collection_name)
+    collection.add_task(
+        get_task_apply(
+            binary_cache_path=binary_cache_path,
+            module_path=module_path,
+            aws_environ_factory=aws_environ_factory,
+            backend=backend,
+            backend_status_path=backend_status_path,
+            tfbackend_factory=tfbackend_factory,
+            tfvars_factory=tfvars_factory,
+        )
+    )
+    collection.add_task(
+        get_task_destroy(
+            binary_cache_path=binary_cache_path,
+            module_path=module_path,
+            aws_environ_factory=aws_environ_factory,
+            backend=backend,
+            backend_status_path=backend_status_path,
+            tfbackend_factory=tfbackend_factory,
+            tfvars_factory=tfvars_factory,
+        )
+    )
+    return collection