├── .editorconfig
├── .gitignore
├── .markdownlint.yml
├── .spelling
├── CODEOWNERS
├── CODE_OF_CONDUCT.md
├── CONTRIBUTING.md
├── LICENSE
├── README.md
├── assets
└── images
│ └── logo.png
├── config
├── _default
│ ├── config.toml
│ ├── markup.toml
│ ├── menu.toml
│ ├── minify.toml
│ ├── module.toml
│ ├── params.toml
│ └── privacy.toml
└── production
│ ├── config.toml
│ └── minify.toml
├── content
├── _index.en.md
├── administrative
│ └── _index.en.md
└── faq
│ └── _index.en.md
├── docs
├── .nojekyll
├── 404.html
├── administrative
│ ├── index.html
│ └── index.xml
├── categories
│ ├── index.html
│ └── index.xml
├── css
│ ├── atom-one-dark-reasonable.css
│ ├── auto-complete.css
│ ├── featherlight.min.css
│ ├── fontawesome-all.min.css
│ ├── hugo-theme.css
│ ├── hybrid.css
│ ├── nucleus.css
│ ├── perfect-scrollbar.min.css
│ ├── tags.css
│ ├── theme-aws.css
│ ├── theme-blue.css
│ ├── theme-green.css
│ ├── theme-red.css
│ └── theme.css
├── faq
│ ├── index.html
│ └── index.xml
├── fonts
│ ├── Inconsolata.eot
│ ├── Inconsolata.svg
│ ├── Inconsolata.ttf
│ ├── Inconsolata.woff
│ ├── Novecentosanswide-Normal-webfont.eot
│ ├── Novecentosanswide-Normal-webfont.svg
│ ├── Novecentosanswide-Normal-webfont.ttf
│ ├── Novecentosanswide-Normal-webfont.woff
│ ├── Novecentosanswide-Normal-webfont.woff2
│ ├── Novecentosanswide-UltraLight-webfont.eot
│ ├── Novecentosanswide-UltraLight-webfont.svg
│ ├── Novecentosanswide-UltraLight-webfont.ttf
│ ├── Novecentosanswide-UltraLight-webfont.woff
│ ├── Novecentosanswide-UltraLight-webfont.woff2
│ ├── Work_Sans_200.eot
│ ├── Work_Sans_200.svg
│ ├── Work_Sans_200.ttf
│ ├── Work_Sans_200.woff
│ ├── Work_Sans_200.woff2
│ ├── Work_Sans_300.eot
│ ├── Work_Sans_300.svg
│ ├── Work_Sans_300.ttf
│ ├── Work_Sans_300.woff
│ ├── Work_Sans_300.woff2
│ ├── Work_Sans_500.eot
│ ├── Work_Sans_500.svg
│ ├── Work_Sans_500.ttf
│ ├── Work_Sans_500.woff
│ └── Work_Sans_500.woff2
├── images
│ ├── clippy.svg
│ └── logo.png
├── index.html
├── index.xml
├── js
│ ├── auto-complete.js
│ ├── clipboard.min.js
│ ├── featherlight.min.js
│ ├── highlight.pack.js
│ ├── html5shiv-printshiv.min.js
│ ├── hugo-learn.js
│ ├── jquery-3.3.1.min.js
│ ├── jquery-3.5.1.min.js
│ ├── jquery.sticky.js
│ ├── learn.js
│ ├── lunr.min.js
│ ├── modernizr.custom-3.6.0.js
│ ├── perfect-scrollbar.jquery.min.js
│ ├── perfect-scrollbar.min.js
│ └── search.js
├── mermaid
│ ├── mermaid.css
│ ├── mermaid.dark.css
│ ├── mermaid.forest.css
│ └── mermaid.js
├── robots.txt
├── sitemap.xml
└── tags
│ ├── index.html
│ └── index.xml
├── layouts
├── _default
│ └── _markup
│ │ └── render-link.html
├── partials
│ ├── favicon.html
│ ├── logo.html
│ └── menu.html
└── robots.txt
├── static
└── .nojekyll
└── themes
└── learn
├── .editorconfig
├── .gitignore
├── .grenrc.yml
├── LICENSE.md
├── README.md
├── archetypes
├── chapter.md
└── default.md
├── i18n
├── ar.toml
├── de.toml
├── en.toml
├── es.toml
├── fr.toml
├── hi.toml
├── id.toml
├── ja.toml
├── nl.toml
├── pt.toml
├── ru.toml
├── tr.toml
└── zh-cn.toml
├── images
├── screenshot.png
└── tn.png
├── layouts
├── 404.html
├── _default
│ ├── list.html
│ └── single.html
├── index.html
├── index.json
├── partials
│ ├── custom-comments.html
│ ├── custom-footer.html
│ ├── custom-header.html
│ ├── favicon.html
│ ├── footer.html
│ ├── header.html
│ ├── logo.html
│ ├── menu-footer.html
│ ├── menu.html
│ ├── meta.html
│ ├── search.html
│ ├── tags.html
│ └── toc.html
└── shortcodes
│ ├── attachments.html
│ ├── button.html
│ ├── children.html
│ ├── expand.html
│ ├── img.html
│ ├── mermaid.html
│ ├── notice.html
│ ├── ref.html
│ ├── relref.html
│ ├── siteparam.html
│ └── siteurl.html
├── static
├── css
│ ├── atom-one-dark-reasonable.css
│ ├── auto-complete.css
│ ├── featherlight.min.css
│ ├── fontawesome-all.min.css
│ ├── hugo-theme.css
│ ├── hybrid.css
│ ├── nucleus.css
│ ├── perfect-scrollbar.min.css
│ ├── tags.css
│ ├── theme-aws.css
│ ├── theme-blue.css
│ ├── theme-green.css
│ ├── theme-red.css
│ └── theme.css
├── fonts
│ ├── Inconsolata.eot
│ ├── Inconsolata.svg
│ ├── Inconsolata.ttf
│ ├── Inconsolata.woff
│ ├── Novecentosanswide-Normal-webfont.eot
│ ├── Novecentosanswide-Normal-webfont.svg
│ ├── Novecentosanswide-Normal-webfont.ttf
│ ├── Novecentosanswide-Normal-webfont.woff
│ ├── Novecentosanswide-Normal-webfont.woff2
│ ├── Novecentosanswide-UltraLight-webfont.eot
│ ├── Novecentosanswide-UltraLight-webfont.svg
│ ├── Novecentosanswide-UltraLight-webfont.ttf
│ ├── Novecentosanswide-UltraLight-webfont.woff
│ ├── Novecentosanswide-UltraLight-webfont.woff2
│ ├── Work_Sans_200.eot
│ ├── Work_Sans_200.svg
│ ├── Work_Sans_200.ttf
│ ├── Work_Sans_200.woff
│ ├── Work_Sans_200.woff2
│ ├── Work_Sans_300.eot
│ ├── Work_Sans_300.svg
│ ├── Work_Sans_300.ttf
│ ├── Work_Sans_300.woff
│ ├── Work_Sans_300.woff2
│ ├── Work_Sans_500.eot
│ ├── Work_Sans_500.svg
│ ├── Work_Sans_500.ttf
│ ├── Work_Sans_500.woff
│ └── Work_Sans_500.woff2
├── images
│ ├── clippy.svg
│ └── logo.png
├── js
│ ├── auto-complete.js
│ ├── clipboard.min.js
│ ├── featherlight.min.js
│ ├── highlight.pack.js
│ ├── html5shiv-printshiv.min.js
│ ├── hugo-learn.js
│ ├── jquery-3.3.1.min.js
│ ├── jquery-3.5.1.min.js
│ ├── jquery.sticky.js
│ ├── learn.js
│ ├── lunr.min.js
│ ├── modernizr.custom-3.6.0.js
│ ├── perfect-scrollbar.jquery.min.js
│ ├── perfect-scrollbar.min.js
│ └── search.js
└── mermaid
│ ├── mermaid.css
│ ├── mermaid.dark.css
│ ├── mermaid.forest.css
│ └── mermaid.js
└── theme.toml
/.editorconfig:
--------------------------------------------------------------------------------
1 | # https://editorconfig.org
2 |
3 | # top-most EditorConfig file
4 | root = true
5 |
6 | [**]
7 | charset = utf-8
8 | end_of_line = lf
9 | indent_size = 2
10 | indent_style = space
11 | insert_final_newline = true
12 | trim_trailing_whitespace = true
13 |
14 | [*.js]
15 | insert_final_newline = true
16 |
--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | # Local .terraform directories
2 | **/.terraform/*
3 |
4 | # .tfstate files
5 | *.tfstate
6 | *.tfstate.*
7 |
8 | # Crash log files
9 | crash.log
10 |
11 | # Ignore any .tfvars files that are generated automatically for each Terraform run. Most
12 | # .tfvars files are managed as part of configuration and so should be included in
13 | # version control.
14 | #
15 | # example.tfvars
16 |
17 | # Ignore override files as they are usually used to override resources locally and so
18 | # are not checked in
19 | override.tf
20 | override.tf.json
21 | *_override.tf
22 | *_override.tf.json
23 |
24 | # Include override files you do wish to add to version control using negated pattern
25 | #
26 | # !example_override.tf
27 |
28 | # Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
29 | # example: *tfplan*
30 |
31 | # Hugo
32 | /.hugo_build.lock
33 | public/
34 |
35 | # macOS
36 | .DS_Store
37 |
--------------------------------------------------------------------------------
/.markdownlint.yml:
--------------------------------------------------------------------------------
1 | MD013: false
2 | MD014: false
3 |
--------------------------------------------------------------------------------
/.spelling:
--------------------------------------------------------------------------------
1 | # Format - lines beginning # are comments
2 | # global dictionary is at the start, file overrides afterwards
3 | # markdown-spellcheck spelling configuration file
4 | # one word per line, to define a file override use ' - filename'
5 | # where filename is relative to this configuration file
6 | apis
7 | aws-ia
8 | cfn
9 | changelog
10 | changelog.md
11 | cidr
12 | cloud_workspace
13 | cloudcontrol
14 | CloudFormation
15 | cloudtrail
16 | codecommit
17 | codepipeline
18 | config
19 | customizable
20 | docdock
21 | dynamodb
22 | for_each
23 | gantt
24 | grav
25 | gren
26 | HashiCorp
27 | iac
28 | iam.tf.
29 | ipsum
30 | kics
31 | lifecycle
32 | linkTitle
33 | lorem
34 | magento
35 | main.tf
36 | main.tf.
37 | MRs
38 | notice.txt
39 | pre
40 | prev
41 | readmes
42 | repo
43 | repos
44 | reuseable
45 | searchable
46 | sublicense
47 | subnet
48 | subnets
49 | terraform-aws-label
50 | terratest
51 | tflint
52 | tfsec
53 | v0.11.x
54 | v0.12.x
55 | v2
56 | valere
57 | versioning
58 | vjeantet
59 |
--------------------------------------------------------------------------------
/CODEOWNERS:
--------------------------------------------------------------------------------
1 | * @aws-ia/aws-ia
2 |
--------------------------------------------------------------------------------
/CODE_OF_CONDUCT.md:
--------------------------------------------------------------------------------
1 | ## Code of Conduct
2 | This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct).
3 | For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact
4 | opensource-codeofconduct@amazon.com with any additional questions or comments.
5 |
--------------------------------------------------------------------------------
/CONTRIBUTING.md:
--------------------------------------------------------------------------------
1 | ## Joining Alpha program
2 | This program is currently in alpha stage and is limited access. If you are interested in joining please reach out to aws-ia-eng@amazon.com
3 |
4 | # Contributing Guidelines
5 |
6 | Thank you for your interest in contributing to our project. Whether it's a bug report, new feature, correction, or additional
7 | documentation, we greatly value feedback and contributions from our community.
8 |
9 | Please read through this document before submitting any issues or pull requests to ensure we have all the necessary
10 | information to effectively respond to your bug report or contribution.
11 |
12 | ## Reporting Bugs/Feature Requests
13 |
14 | We welcome you to use the GitHub issue tracker to report bugs or suggest features.
15 |
16 | When filing an issue, please check existing open, or recently closed, issues to make sure somebody else hasn't already
17 | reported the issue. Please try to include as much information as you can. Details like these are incredibly useful:
18 |
19 | * A reproducible test case or series of steps
20 | * The version of our code being used
21 | * Any modifications you've made relevant to the bug
22 | * Anything unusual about your environment or deployment
23 |
24 |
25 | ## Contributing via Pull Requests
26 | Contributions via pull requests are much appreciated. Before sending us a pull request, please ensure that:
27 |
28 | 1. You are working against the latest source on the *main* branch.
29 | 2. You check existing open, and recently merged, pull requests to make sure someone else hasn't addressed the problem already.
30 | 3. You open an issue to discuss any significant work - we would hate for your time to be wasted.
31 |
32 | To send us a pull request, please:
33 |
34 | 1. Fork the repository.
35 | 2. Modify the source; please focus on the specific change you are contributing. If you also reformat all the code, it will be hard for us to focus on your change.
36 | 3. Ensure local tests pass.
37 | 4. Commit to your fork using clear commit messages.
38 | 5. Send us a pull request, answering any default questions in the pull request interface.
39 | 6. Pay attention to any automated CI failures reported in the pull request, and stay involved in the conversation.
40 |
41 | GitHub provides additional document on [forking a repository](https://help.github.com/articles/fork-a-repo/) and
42 | [creating a pull request](https://help.github.com/articles/creating-a-pull-request/).
43 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # aws-ia standards for Terraform
2 |
3 | > Note: This module is in alpha state and is likely to contain bugs and updates may introduce breaking changes.
4 | > It is not recommended for production use at this time.
5 |
--------------------------------------------------------------------------------
/assets/images/logo.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/aws-ia/standards-terraform/200785420637f315497cc6864f5ca0c26aafbeca/assets/images/logo.png
--------------------------------------------------------------------------------
/config/_default/markup.toml:
--------------------------------------------------------------------------------
1 | # https://gohugo.io/getting-started/configuration-markup#goldmark
2 |
3 | [goldmark.renderer]
4 |
5 | # By default, Goldmark does not render raw HTMLs and potentially dangerous links. If you have lots of inline HTML
6 | # and/or JavaScript, you may need to turn this on.
7 | unsafe = true
8 |
--------------------------------------------------------------------------------
/config/_default/menu.toml:
--------------------------------------------------------------------------------
1 | [[shortcuts]]
2 | name = " GitHub"
3 | identifier = "github"
4 | url = 'https://github.com/aws-ia'
5 | weight = 10
6 |
7 | [[shortcuts]]
8 | name = " Catalog"
9 | identifier = "catlog"
10 | url = 'https://aws.amazon.com/quickstart/architecture/terraform-modules-on-aws/'
11 | weight = 20
12 |
13 | [[shortcuts]]
14 | name = "Registry"
15 | identifier = "tf-registry"
16 | url = 'https://aws.amazon.com/quickstart/architecture/terraform-modules-on-aws/'
17 | weight = 30
18 |
--------------------------------------------------------------------------------
/config/_default/minify.toml:
--------------------------------------------------------------------------------
1 | # https://gohugo.io/getting-started/configuration/?search-input=languageCode#configure-minify
2 |
3 | disableCSS = false
4 | disableHTML = false
5 | disableJS = false
6 | disableJSON = false
7 | disableSVG = false
8 | disableXML = false
9 | minifyOutput = false
10 |
11 | [tdewolff]
12 |
13 | [tdewolff.css]
14 | keepCSS2 = true
15 | precision = 0
16 |
17 | [tdewolff.html]
18 | keepComments = false
19 | keepConditionalComments = true
20 | keepDefaultAttrVals = true
21 | keepDocumentTags = true
22 | keepEndTags = true
23 | keepQuotes = false
24 | keepWhitespace = false
25 |
26 | [tdewolff.js]
27 | keepVarNames = false
28 | precision = 0
29 |
30 | [tdewolff.json]
31 | keepNumbers = false
32 | precision = 0
33 |
34 | [tdewolff.svg]
35 | precision = 0
36 |
37 | [tdewolff.xml]
38 | keepWhitespace = false
39 |
--------------------------------------------------------------------------------
/config/_default/module.toml:
--------------------------------------------------------------------------------
1 | # https://gohugo.io/hugo-modules/configuration/
2 |
3 | # A optional Glob pattern matching module paths to skip when vendoring, e.g. “github.com/**”
4 | # noVendor = ''
5 |
6 | # When enabled, we will pick the vendored module closest to the module using it. The default behaviour is to pick the
7 | # first. Note that there can still be only one dependency of a given module path, so once it is in use it cannot be
8 | # redefined.
9 | # vendorClosest = false
10 |
11 | # Defines the proxy server to use to download remote modules. Default is direct, which means “git clone” and similar.
12 | # proxy = 'direct'
13 |
14 | # Comma separated glob list matching paths that should not use the proxy configured above.
15 | # noProxy = 'none'
16 |
17 | # Comma separated glob list matching paths that should be treated as private.
18 | # private = '*.*'
19 |
20 | # A comma separated (or a slice) list of module path to directory replacement mapping,
21 | # e.g. "github.com/bep/myprettytheme -> ../..,github.com/bep/shortcodes -> /some/path". This is mostly useful for
22 | # temporary locally development of a module, and then it makes sense to set it as an OS environment variable,
23 | # e.g: env HUGO_MODULE_REPLACEMENTS="github.com/bep/myprettytheme -> ../..". Any relative path relates to themesDir,
24 | # and absolute paths are allowed.
25 | # replacements = ''
26 |
27 | [hugoVersion]
28 | # Whether the extended version of Hugo is required.
29 | extended = true
30 |
31 | # The maximum Hugo version supported
32 | # max = ''
33 |
34 | # The minimum Hugo version supported.
35 | min = '0.60.0'
36 |
37 | # [[imports]]
38 | # Set to true to disable the module while keeping any version info in the go.* files.
39 | # disable = false
40 |
41 | # If enabled, any module configuration file, e.g. config.toml, will not be loaded. Note that this will also stop the
42 | # loading of any transitive module dependencies.
43 | # ignoreConfig = false
44 |
45 | # If enabled, module imports will not be followed.
46 | # ignoreImports = false
47 |
48 | # Do not mount any folder in this import.
49 | # noMounts = false
50 |
51 | # Can be either a valid Go Module module path, e.g. github.com/gohugoio/myShortcodes, or the directory name for the
52 | # module as stored in your themes folder.
53 | # path = 'github.com/theNewDynamic/gohugo-theme-ananke'
54 |
--------------------------------------------------------------------------------
/config/_default/params.toml:
--------------------------------------------------------------------------------
1 | themeVariant = 'aws'
2 | logoPath = '/images/logo.png'
3 |
4 | # Prefix URL to edit current page. Will display an "Edit this page" button on top right hand corner of every page.
5 | # Useful to give opportunity to people to create merge request for your doc.
6 | # See the config.toml file from this documentation site to have an example.
7 | editURL = ""
8 |
9 | # Author of the site, will be used in meta information
10 | author = 'The AWS Integration & Automation team'
11 |
12 | # Description of the site, will be used in meta information
13 | description = "The AWS Integration & Automation team's best practices for Terraform"
14 |
15 | # Shows a checkmark for visited pages on the menu
16 | showVisitedLinks = false
17 |
18 | # Disable search function. It will hide search bar
19 | disableSearch = false
20 |
21 | # Javascript and CSS cache are automatically busted when new version of site is generated.
22 | # Set this to true to disable this behavior (some proxies don't handle well this optimization)
23 | disableAssetsBusting = false
24 |
25 | # Set this to true to disable copy-to-clipboard button for inline code.
26 | disableInlineCopyToClipBoard = true
27 |
28 | # A title for shortcuts in menu is set by default. Set this to true to disable it.
29 | disableShortcutsTitle = false
30 |
31 | # When using mulitlingual website, disable the switch language button.
32 | disableLanguageSwitchingButton = false
33 |
34 | # Hide breadcrumbs in the header and only show the current page title
35 | disableBreadcrumb = true
36 |
37 | # Hide Next and Previous page buttons normally displayed full height beside content
38 | disableNextPrev = true
39 |
40 | # Order sections in menu by "weight" or "title". Default to "weight"
41 | ordersectionsby = 'weight'
42 |
--------------------------------------------------------------------------------
/config/_default/privacy.toml:
--------------------------------------------------------------------------------
1 | # https://gohugo.io/about/hugo-and-gdpr/
2 |
3 | [disqus]
4 | disable = true
5 |
6 | [googleAnalytics]
7 | disable = true
8 |
9 | # Enabling this will make it so the users' IP addresses are anonymized within Google Analytics.
10 | anonymizeIP = true
11 |
12 | # Enabling this will make the GA templates respect the “Do Not Track” HTTP header.
13 | respectDoNotTrack = true
14 |
15 | # Enabling this will disable the use of Cookies and use Session Storage to Store the GA Client ID.
16 | useSessionStorage = true
17 |
18 | [instagram]
19 | disable = true
20 |
21 | # If simple mode is enabled, a static and no-JS version of the Instagram image card will be built. Note that this only
22 | # supports image cards and the image itself will be fetched from Instagram’s servers.
23 | simple = true
24 |
25 | # If you use the simple mode for Instagram and a site styled with Bootstrap 4, you may want to disable the inline
26 | # styles provided by Hugo.
27 | disableInlineCSS = true
28 |
29 | [twitter]
30 | disable = false
31 |
32 | # Enabling this for the twitter/tweet shortcode, the tweet and its embedded page on your site are not used for purposes
33 | # that include personalized suggestions and personalized ads.
34 | enableDNT = true
35 |
36 | # If simple mode is enabled, a static and no-JS version of a tweet will be built.
37 | simple = true
38 |
39 | # If you use the simple mode for Twitter, you may want to disable the inlines styles provided by Hugo.
40 | disableInlineCSS = true
41 |
42 | [vimeo]
43 | disable = true
44 |
45 | # Enabling this for the vimeo shortcode, the Vimeo player will be blocked from tracking any session data, including all
46 | # cookies and stats.
47 | enableDNT = false
48 |
49 | # If simple mode is enabled, the video thumbnail is fetched from Vimeo’s servers and it is overlayed with a play
50 | # button. If the user clicks to play the video, it will open in a new tab directly on Vimeo’s website.
51 | simple = false
52 |
53 | [youtube]
54 | disable = false
55 |
56 | # When you turn on privacy-enhanced mode, YouTube won’t store information about visitors on your website unless the
57 | # user plays the embedded video.
58 | privacyEnhanced = true
59 |
--------------------------------------------------------------------------------
/config/production/config.toml:
--------------------------------------------------------------------------------
1 | buildDrafts = false
2 | buildExpired = false
3 | buildFuture = false
4 |
--------------------------------------------------------------------------------
/config/production/minify.toml:
--------------------------------------------------------------------------------
1 | minifyOutput = true
2 |
--------------------------------------------------------------------------------
/content/administrative/_index.en.md:
--------------------------------------------------------------------------------
1 | +++
2 | title = 'Administrative'
3 | chapter = true
4 | weight = 999
5 | date = '2022-01-12'
6 | +++
7 | #### Guide Stage: `Alpha`
8 |
9 | {{% notice note %}}
10 | The aws-ia Terraform standards are updated often. Please be sure to refer to this document often to keep updated!
11 | {{% /notice %}}
12 |
13 | ## License
14 |
15 | * Licensed under Apache 2.0
16 | * Include Amazon NOTICE.txt
17 |
18 | ## Taxonomy
19 |
20 | **Root module**: Every Terraform configuration has at least one module, typically known as its root module. In the case of aws-ia modules, the root module is always meant to be made up of reuseable modules or build blocks.
21 |
22 | **Child modules**: A module that has been called by another module is often referred to as a child module.
23 |
24 | Types of reuseable aws-ia Modules:
25 |
26 | * aws-ia Service Modules: A container that provides a sensible default for deploying an AWS service based on aws-ia standards (Example: VPC/Aurora/SQS)
27 | * aws-ia Partner Modules: A container that leverages one or more AWS Service Modules to build the infrastructure needed to instantiate an AWS partner product (Example: Magento)
28 |
29 | ## Module Structure
30 |
31 | ```text
32 | ../terraform-partnername-productname
33 | ├── LICENSE
34 | ├── NOTICE.txt
35 | ├── deploy
36 | │ └── main.tf
37 | ├── main.tf
38 | └── setup_workspace
39 | ├── variables.tf
40 | └── workspace.tf
41 | ```
42 |
43 | **File**: `deploy/main.tf`
44 |
45 | ```hcl
46 | # Example deployment using Terraform Cloud
47 |
48 | # Defaults to TFC for remote backend
49 | terraform {
50 | backend "remote" {}
51 | required_version = ">= 1.0.5"
52 | }
53 |
54 | # Use baseline VPC from aws-ia registery
55 |
56 |
57 | # Deploys example workload instance via root module
58 | module "workload" {
59 | source = "../"
60 | # interface to be defined
61 | #
62 | }
63 | ```
64 |
65 | **File**: `/main.tf`
66 |
67 | ```hcl
68 | # Root Module
69 | # No backends should be defined by default in Root Module
70 | # This module is intended to be called by one or more other modules and must not contain any provider blocks
71 | ```
72 |
73 | **File**: `/setup_workspace/`
74 |
75 | Creates the Terraform workspace in TFC. See the [registry](https://registry.terraform.io/modules/aws-ia/cloud_workspace/hashicorp/latest) for more information.
76 |
77 | ## Deployment Types
78 |
79 | **Local**: Write Terraform state and configuration to local working directory.
80 |
81 | **Terraform Cloud (TFC)**: Writes Terraform state and configuration to remote TFC workspace and stream it locally
82 |
83 | {{% notice note %}}
84 | For more into in how to setup TFC Workspace refer to the cloud_workspace module
85 | {{% /notice %}}
86 |
87 | ## Development standards
88 |
89 | ### Minimum Terraform version
90 |
91 | **Binary version**: `>= 1.0.5`
92 |
93 | **Provider Version**: `~> v3.58.0`
94 |
95 | ### aws-ia module standards
96 |
97 | Module `/main.tf` must not contain provider block definitions.
98 |
99 | Deploy example `/deploy/main.tf` - When creating an example Terraform Cloud deployment for the module are creating refer to the source directly.
100 |
101 | ```hcl
102 | module "self_deployment_example" {
103 | source = "../"
104 | }
105 | ```
106 |
107 | * If the example terraform cloud deployment requires a VPC or any other AWS service, use the Terraform registry path.
108 | * Lock the version of any dependencies to the latest version at the time of release.
109 |
110 | ```hcl
111 | module "vpc" {
112 | source = "aws-ia/vpc/aws"
113 | version = "0.0.2"
114 | }
115 | ```
116 |
--------------------------------------------------------------------------------
/content/faq/_index.en.md:
--------------------------------------------------------------------------------
1 | +++
2 | title = 'Frequently asked questions (FAQ)'
3 | linkTitle = 'FAQ'
4 | description = 'Frequently asked questions of the AWS Integration & Automation team about Terraform standards'
5 | date = '2022-01-12'
6 | weight = 998
7 | chapter = true
8 | +++
9 | ## AWS providers and associated modules demystified
10 |
11 | Terraform leverages providers to interact with infrastructure resources. In the case of AWS, there are two official providers available that can be used; the AWS Provider for Terraform, and the Terraform AWS Cloud Control Provider (AWSCC) provider. The AWS Provider for Terraform has been in existence for over 14 years, and is hand coded (with some code generated). The AWSCC Provider is the newest provider and is automatically generated from the CloudFormation Registry which means new features and services can be supported in Terraform right away.
12 |
13 | Our partners at HashiCorp have a detailed [blog post](https://www.hashicorp.com/blog/announcing-terraform-aws-cloud-control-provider-tech-preview) on this topic, and we encourage you to read it.
14 |
15 | The AWS Integration & Automation (AWS I&A) team authors and publishes Terraform modules that have validated provenance. Modules use specific providers in their implementation, and for convenience we have decided on a naming convention that will allow you to know what provider is being used by the module you are leveraging. This naming convention is `terraform--`.
16 |
17 | For example, you will see a module named `terraform-aws-rds-aurora` which informs you that this module is leveraging the AWS Provider for Terraform. You would also see another module named `terraform-awscc-waf` which informs you that it is leveraging the AWSCC Provider. [You can use both providers side by side](https://www.hashicorp.com/blog/announcing-terraform-aws-cloud-control-provider-tech-preview#using-two-providers) and we often do when writing AWSCC modules. The long term goal is to build robust modules that fully utilize the AWSCC provider.
18 |
19 | We standardize on semantic versioning to provide assurance of compatibility and provide robust testing of modules to provide assurance of functionality.
20 |
21 | The AWS CloudControl API and associated AWSCC Provider for Terraform will enable our customers to leverage the newest features and services using the IaC tooling of their choice. The AWS I&A team will prefer the AWSCC Provider when authoring or updating module choice and. Provider and the CloudControl APIs we see the AWSCC Provider mature and move into GA, you will see our newest modules prefer to use the AWSCC Provider.
22 |
23 | ## What is the `user_agent`?
24 |
25 | ```terraform
26 | provider "awscc" {
27 | user_agent = [{
28 | product_name = "terraform-awscc-label"
29 | product_version = "0.0.4"
30 | comment = "V1/AWS-D69B4015/376222271"
31 | }]
32 | }
33 | ```
34 |
35 | In AWS I&A repos you will see a `user_agent` defined in the provider block. This is a [feature that was added to AWSCC](https://github.com/hashicorp/terraform-provider-awscc/pull/247) and is optional. `user-agent` data is passed to AWS Cloud Control APIs during `terraform apply`. This is useful for discovery and compliance purposes, as the user-agent for each API call is available as a CloudTrail event. Teams can use this data to identify workloads running in their account such as 3rd party products, OU's, etc. The above example defines 3 fields:
36 |
37 | - `product_name`: The user friendly name of the module / repo. GitHub repo names are fungible.
38 | - `product_version`: The tag version of the module.
39 | - `comment`:
40 | - `V1`: Version 1 of our defined meta-data payload format.
41 | - `AWS-D69B4015`: A unique, searchable identifier.
42 | - `376222271`: The GitHub repo id, should be unique to each module and non-fungible. You can find a repo ID using `gh api repos/aws-ia/terraform-awscc-label --jq .id`. Download `gh` [here](https://cli.github.com/)
43 |
44 | `user_agent` is a list with entries that are appended allowing you to define many in the same block and/or define one per module. We define a `user_agent` payload per module. This means that a Root module execution will push module meta data to your CloudTrail log.
45 |
46 | ## Recommended deployment patterns for Terraform
47 |
48 | There are many ways to deploy or execute Terraform. We recommend either via [HashiCorp Terraform Cloud](https://github.com/aws-ia/terraform-hashicorp-cloud_workspace) or via [AWS S3 with DynamoDB for state locking](https://www.terraform.io/language/settings/backends/s3).
49 |
50 | ## Are modules protected by CI Automation?
51 |
52 | Terraform Module pull requests (PRs) are subject to continuous integration (CI) automation for quality, linting, and security scanning. We currently leverage [AWS CodePipeline](https://aws.amazon.com/codepipeline/) and [AWS CodeCommit](https://aws.amazon.com/codecommit/), a process that is private to AWS employees only. It is a heavy work-in-progress and we intend to expose information about it ASAP. For this reason, [GitHub Actions](https://github.com/features/actions) has been disabled. We are open to feedback on what should be included in our CI so please use your PR to discuss.
53 |
--------------------------------------------------------------------------------
/docs/.nojekyll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/aws-ia/standards-terraform/200785420637f315497cc6864f5ca0c26aafbeca/docs/.nojekyll
--------------------------------------------------------------------------------
/docs/404.html:
--------------------------------------------------------------------------------
1 | 404 Page not found
Error
Woops. Looks like this page doesn't exist ¯\_(ツ)_/¯.
--------------------------------------------------------------------------------
/docs/administrative/index.xml:
--------------------------------------------------------------------------------
1 | Administrative on The AWS Integration & Automation team's best practices for Terraformhttps://aws-ia.github.io/standards-terraform/administrative/Recent content in Administrative on The AWS Integration & Automation team's best practices for TerraformHugo -- gohugo.ioen-us, Amazon Web Services, Inc. or its affiliates. All rights reserved.Wed, 12 Jan 2022 00:00:00 +0000
--------------------------------------------------------------------------------
/docs/categories/index.html:
--------------------------------------------------------------------------------
1 | Categories :: The AWS Integration & Automation team's best practices for Terraform