├── .checkov.yaml
├── .docs
    ├── CI4Terraform.drawio
    └── CI4Terraform.png
├── .gitignore
├── CODE_OF_CONDUCT.md
├── CONTRIBUTING.md
├── LICENSE
├── README.md
└── terraform
    ├── examples
        └── cicd_account
        │   ├── inventories
        │       └── variables.tfvars
        │   ├── main.tf
        │   ├── outputs.tf
        │   ├── run_terraform.sh
        │   └── variables.tf
    └── modules
        ├── buildspec.yaml
        ├── cicd
            ├── README.md
            ├── codebuild.tf
            ├── codebuild_roles_policies.tf
            ├── codepipeline-role-policy.tf
            ├── codepipeline.tf
            ├── data.tf
            ├── kms.tf
            ├── locals.tf
            ├── outputs.tf
            ├── providers.tf
            ├── s3.tf
            ├── templates
            │   ├── cb_cross_account_dep_policy.json.tpl
            │   ├── codebuild-role-policy.json.tpl
            │   ├── codepipeline-role-policy.json.tpl
            │   └── key-policy.json.tpl
            ├── test
            │   ├── cicd_test.go
            │   ├── go.mod
            │   └── test.sh
            └── variables.tf
        ├── install.sh
        ├── prebuild.sh
        └── test.sh


/.checkov.yaml:
--------------------------------------------------------------------------------
 1 | branch: master
 2 | download-external-modules: false
 3 | evaluate-variables: true
 4 | external-modules-download-path: .external_modules
 5 | framework: terraform
 6 | # skip-path:
 7 | output: cli
 8 | skip-check:
 9 |   - CKV_AWS_144 # Ensure S3 bucket has cross-region replication enabled
10 |   - CKV_AWS_18 # "Ensure the S3 bucket has access logging enabled"
11 | 


--------------------------------------------------------------------------------
/.docs/CI4Terraform.drawio:
--------------------------------------------------------------------------------
1 | <mxfile host="Electron" modified="2020-10-22T15:41:59.726Z" agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) draw.io/12.6.5 Chrome/80.0.3987.86 Electron/8.0.0 Safari/537.36" etag="-P8Q_7gIS2xIs7hlUEVQ" version="12.6.5" type="device"><diagram id="ecrqPypMviK6-0V9xu27" name="Page-1">7Vxbd9o4EP41PIYjyTf8yCXsdpvttk3Otn3KEVjY3hqLChOgv34lW8YXiUsbjEmbJG3QWNZlZr7RzHicjjGcb/5geBH8TT0SdRDwNh1j1EEIQmDzX4KylRQAjIzis9CTtIJwH34neUdJXYUeWVY6JpRGSbioEqc0jsk0qdAwY3Rd7TajUXXWBfaJQrif4kilfgq9JMioPeQU9D9J6Af5zNB2sytznHeWO1kG2KPrEsm47RhDRmmSfZpvhiQS3Mv5kt033nN1tzBG4uSUG/ruX9+89fotC1axc/ch/PD2C7rJ2fyEo5Xc8QNZJpzSn07pio+crT3Z5gxZ0DBOUqZaA/7D7x+CjsWvDEWri6waod52qgSotsQYVUK97VQJsD48rM0P6wssEZRWZXhQmx+UFsh/jAFdJVEYk+FO/QAn+gx7IRfLkEaUcVpMY869QZDMI96C/OM6CBNyv8BTwdU1xw6nzWicSABAlLcl48WoXIEW4vN84wuwdfF6aXZ9RleLdMo3HALaq4/84+M0oivvEUeJGChh9CvJF9dBBv8eC6UZzMIoqi36ibAk5HjoR6Evxk+omA7LVkRm6Yh8J2Hs36WtkQHk6nVTeHgZEE9uSSofn4Js9qo13IGFmxlC5yRhW95F3mDZUoWlhTFcV8hcUNYFYE2IukCSgxJeUU/ejaWd8HcTFFDiHySafgRZroKs/qd7TvhIlnTFptyo1aFV5j5n2e14DMaGIi8plwof9UKqK5BOJKPzSMEBsJtbdikI0zEUMUADqDLYEc8uA0sRwfDNq2l7NW0vxLRB4HRdqwoqAC5r24LH0b+P76Jv9N2bD+PP/8CH8df+jW0qwFLApNWefZzbo1U1gzgYQsOyf8gg3uEJid7TZZiEqQpNaJLQ+VHZT/laCKvq9TEdxstFttFZuBHrGKTmhLDbJ5JZFbhP0SnzcRx+x2KNy0csrVOuQoq+aLRqrwqZPXBcfzQ22URdaDekPY59XHuIx71w2aQsCahPYxzdFtQBh3/s7eRd9LmjQpIps/8jSbKVIsOrhO6VJ4KHuJ0d14fg0JOBCWY+SQ51lD6B2N1B6TEScW14qsYg54dxTz0feQT3PlwQAd3zQppfM0cOSh2a/NooZHygDJmxEKGKef5lDlydZZ+lX9cIfC3ImXT7srNswJu6U23K+b/I+X8WC4ByKecWAOr8Y6en2oCcdn7X2GgD75yFbPtZ3p82vogGZ4Zsjjbli6Nt5SCvQfYnDYWrGooDYXlrdkENXYRdGKzCyHs1Cu0YhUnK/LNYBMOt+gQWABe0CHqXQI3UXrZL4IBTXYLeuV2C9NY+Y3hb6iBD22Lk94JQCjVct3pKWG5NqNmIhYh3S3uG1NXko7AzQzqfh2p0/mpoLmJophn3z2JpYC03Z+Za1pqdeQ1cX0jg6hpmF1aUR5/YNYoUSSV+bSr10VNjJqioEB8nXCzJnmRYSTQqeFMFyZ805dIa43kYCTY84IDOcZGVGkitGJkF7aPkAtKZLS/91inMOeAOao6F5SjyQppkA2pKWK56wGj8iusX1hlkg4xaGGjYLcsGKrLRhIW/hWzM+pMTW7VzTclGG362Ep9r/eCj3rc+fFadb20/9ExX+3lZkFZckV33X8wVWS1Lp9iznrqgXtepP3QpsuElSFoaSFpNQdJ84ZBEKiQPxIRtYRK9YvKMmJxGISnFA2dGpQWNbv4g8ggqTX4zasqMqwGBojOHMg7PTWtYwOrZhqpU8BbZSFWqXzV14ZOYMBydR9kc5NSrWSwAFVW76EMT8wR/IauY2Ld/WSKJJ3l38KN8MQHogmpU7vTUB8qc2s0LJCv+quE2ZbdV5vTTu1hRbMVXmJImRPCCEZxwnatzsDgy95WyKMfjEU07IEyVzxUm2l2AVCbaTXkYuT7VSkHrnFsQNqNsfn28k8PcwLQOqqSiPV3eaJ+ONsfeE1KP1+HSHTQ/xx29k4OvVqOvPNlQfvaQ24RyiWZF9z0iDtPt9eo+6NoIlL+qxho6av798nbmOp71NQ8ETchzQBXbAoJ5QszTvF9R9Sk0RWrI0aupARrL9KtVEB1kp1WmAazwx/62Ei9xpP7tzTJVuD7vYPQWm+Ii/+TL31He+edH+UTZ13FE1/lofIfZgNVJOFmstUpctL34fJQJ06x3zzYWDexCO39pohoKuN4nVRuijdc1hcYyocwJVtF6SA3VDQJ7DgzKoTaL0jeGgtDzSKxYvXq5wgnPdA6bgJMz1rYKUOjqq5Abe8HCVB/uNGC4DjBM5c62uuUTzFdzOXykVtmOyBOJKHfgxR5XPPYX/g3m/2KyFuwIcOwLNyeM+X/lSgwwYTieBq15PXtygvkbQLoI9NJOjaO6k5VSWhAKZics9H3CUicTx17KTcySqhxKtXZgoq25uy6+S613r0EM+ormGjcBW8XL9IB4CXyF2gzLpRmrOkO/UtnDOaW4e9NZkZr2RYvGnuGqfr0mzrp+iTUooLYl1HIZfFH5/qVTLnz/6TL4g27a8Xj51OJ4o9XEkaHm8V5w3UoTuNI4ApfFldsGrhrHR27Qj+PDbBMf5m/wcs9B3/N4vq+hl/54s/hrIlmNfvFHWYzb/wE=</diagram></mxfile>


--------------------------------------------------------------------------------
/.docs/CI4Terraform.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/aws-samples/ci-4-terraform-aws-developer-tools-terratest/e7181b643fcdca25292e06b935cf01ef11821b4a/.docs/CI4Terraform.png


--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | .DS_Store
2 | .idea
3 | .terraform
4 | *.tfstate*
5 | plan.out
6 | .terraform.lock.hcl
7 | 


--------------------------------------------------------------------------------
/CODE_OF_CONDUCT.md:
--------------------------------------------------------------------------------
1 | ## Code of Conduct
2 | This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct).
3 | For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact
4 | opensource-codeofconduct@amazon.com with any additional questions or comments.
5 | 


--------------------------------------------------------------------------------
/CONTRIBUTING.md:
--------------------------------------------------------------------------------
 1 | # Contributing Guidelines
 2 | 
 3 | Thank you for your interest in contributing to our project. Whether it's a bug report, new feature, correction, or additional
 4 | documentation, we greatly value feedback and contributions from our community.
 5 | 
 6 | Please read through this document before submitting any issues or pull requests to ensure we have all the necessary
 7 | information to effectively respond to your bug report or contribution.
 8 | 
 9 | 
10 | ## Reporting Bugs/Feature Requests
11 | 
12 | We welcome you to use the GitHub issue tracker to report bugs or suggest features.
13 | 
14 | When filing an issue, please check existing open, or recently closed, issues to make sure somebody else hasn't already
15 | reported the issue. Please try to include as much information as you can. Details like these are incredibly useful:
16 | 
17 | * A reproducible test case or series of steps
18 | * The version of our code being used
19 | * Any modifications you've made relevant to the bug
20 | * Anything unusual about your environment or deployment
21 | 
22 | 
23 | ## Contributing via Pull Requests
24 | Contributions via pull requests are much appreciated. Before sending us a pull request, please ensure that:
25 | 
26 | 1. You are working against the latest source on the *main* branch.
27 | 2. You check existing open, and recently merged, pull requests to make sure someone else hasn't addressed the problem already.
28 | 3. You open an issue to discuss any significant work - we would hate for your time to be wasted.
29 | 
30 | To send us a pull request, please:
31 | 
32 | 1. Fork the repository.
33 | 2. Modify the source; please focus on the specific change you are contributing. If you also reformat all the code, it will be hard for us to focus on your change.
34 | 3. Ensure local tests pass.
35 | 4. Commit to your fork using clear commit messages.
36 | 5. Send us a pull request, answering any default questions in the pull request interface.
37 | 6. Pay attention to any automated CI failures reported in the pull request, and stay involved in the conversation.
38 | 
39 | GitHub provides additional document on [forking a repository](https://help.github.com/articles/fork-a-repo/) and
40 | [creating a pull request](https://help.github.com/articles/creating-a-pull-request/).
41 | 
42 | 
43 | ## Finding contributions to work on
44 | Looking at the existing issues is a great way to find something to contribute on. As our projects, by default, use the default GitHub issue labels (enhancement/bug/duplicate/help wanted/invalid/question/wontfix), looking at any 'help wanted' issues is a great place to start.
45 | 
46 | 
47 | ## Code of Conduct
48 | This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct).
49 | For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact
50 | opensource-codeofconduct@amazon.com with any additional questions or comments.
51 | 
52 | 
53 | ## Security issue notifications
54 | If you discover a potential security issue in this project we ask that you notify AWS/Amazon Security via our [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/). Please do **not** create a public github issue.
55 | 
56 | 
57 | ## Licensing
58 | 
59 | See the [LICENSE](LICENSE) file for our project's licensing. We will ask you to confirm the licensing of your contribution.
60 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
 1 | Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 2 | 
 3 | Permission is hereby granted, free of charge, to any person obtaining a copy of
 4 | this software and associated documentation files (the "Software"), to deal in
 5 | the Software without restriction, including without limitation the rights to
 6 | use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
 7 | the Software, and to permit persons to whom the Software is furnished to do so.
 8 | 
 9 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
10 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
11 | FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
12 | COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
13 | IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
14 | CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
15 | 
16 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
  1 | ## ci-4-terraform-aws-developer-tools-terratest
  2 | 
  3 | # Table of Contents
  4 | - [Table of Contents](#table-of-contents)
  5 | - [Introduction](#introduction)
  6 |   - [Scope of the artifact:](#scope-of-the-artifact)
  7 |   - [Target Audience](#target-audience)
  8 |   - [UseCase](#usecase)
  9 |   - [Architecture](#architecture)
 10 | - [Repository Structure](#repository-structure)
 11 |   - [`/terraform`](#terraform)
 12 |     - [`/terraform/examples`](#terraformexamples)
 13 |     - [`/terraform/modules`](#terraformmodules)
 14 | - [Guide](#guide)
 15 |   - [Prerequisites](#prerequisites)
 16 |   - [1. Deploy CI Pipeline.](#1-deploy-ci-pipeline)
 17 |   - [2. Review and tune the test code](#2-review-and-tune-the-test-code)
 18 |   - [3. Push the code inside your new CodeCommit repository.](#3-push-the-code-inside-your-new-codecommit-repository)
 19 |   - [4. Clean Up](#4-clean-up)
 20 |   - [Troubleshooting](#troubleshooting)
 21 |     - [Error deleting S3 Bucket (BucketNotEmpty)](#error-deleting-s3-bucket-bucketnotempty)
 22 |   - [Security](#security)
 23 |   - [License](#license)
 24 | 
 25 | # Introduction
 26 | 
 27 | [Terraform](https://www.terraform.io/) is widely used among customers to provision and manage infrastructure and services on AWS. <br>
 28 | A Terraform module is a container for multiple resources that are used together. Modules can, and should be used to create lightweight
 29 | abstractions, so that you can describe your infrastructure in terms of its architecture, rather than directly in terms of
 30 | physical objects. <br>
 31 | 
 32 | 
 33 | ## Scope of the artifact:
 34 | 
 35 | In order to provide high quality and reliable modules each of these modules should be tested.
 36 | 
 37 | Due to the nature of the Infrastructure as Code automated tests on the described resources have been always complicated often forcing the developers to perform manual tests on their solutions after the deployment.
 38 | 
 39 | The module presented in this repository contains code to deploy Continuous Integration (CI) solution based on CodePipeline, CodeBuild and [Terratest](https://terratest.gruntwork.io/) library, offering the ability to run E2E tests on Terraform modules in an automated way.
 40 | 
 41 | ## Target Audience
 42 | 
 43 | The main target audience for this artifact are Infrastructure as Code developers with experience with Terraform.
 44 | 
 45 | For simple basic tests no experience with `golang` is required.
 46 | 
 47 | ## UseCase
 48 | 
 49 | This artifact is build out of our experience in many projects when Terraform is used as main IaC tool.
 50 | 
 51 | We observed on the customer side an increment of the demand of re-usable modules across teams and projects.
 52 | 
 53 | As a consequence the customers are requiring high quality and reliable Terraform code.
 54 | Moreover in such scenarios those modules are continuously developed.
 55 | 
 56 | Automated E2E tests becomes then necessary to ensure the delivery of new feature, ensure the stability of the system and enforce high standards.
 57 | 
 58 | ## Architecture
 59 | 
 60 | The following architecture diagram simplifies the proposed solution. Note that an independent account is used to run the mentioned E2E
 61 | tests based on the provided Terraform modules.
 62 | 
 63 | ![pic1](./.docs/CI4Terraform.png)
 64 | 
 65 | 
 66 | # Repository Structure
 67 | 
 68 | ```bash
 69 | .
 70 | |-- README.md
 71 | `-- terraform
 72 |     |-- examples
 73 |     `-- modules
 74 | 
 75 | ```
 76 | 
 77 | ## `/terraform`
 78 | 
 79 | This directory contains:
 80 | - `./examples`: reusable examples for the modules.
 81 | - `./modules`: Terraform modules for the CI pipeline, including the `CodeBuild` build scripts.
 82 | 
 83 | The content of the repository is structured providing reusable Terraform modules.
 84 | These modules and their content can be extracted and reused.
 85 | 
 86 | ### `/terraform/examples`
 87 | 
 88 | It is a good practice when releasing modules to provide also working examples.
 89 | 
 90 | Those examples can be stored in a dedicated directory at the same level of the modules directory.
 91 | 
 92 | In this repository the example [`cicd_account`](./terraform/examples/cicd_account/main.tf)  is provided. It uses the module located in `/terraform/modules/cicd`
 93 | . This example will deliver a CI based on `CodePipeline`, `CodeBuild` and `CodeCommit` and uses this same repository as source.
 94 | 
 95 | The proposed behavior can be changed and adapted to the specific needs.
 96 | 
 97 | ### `/terraform/modules`
 98 | 
 99 | This directory contains the *Terraform* modules, the tests and the code run by `CodeBuild`.
100 | 
101 | Information about `CodeBuild` and how to interpret the `buildspec.yaml` file can be found
102 | [here](https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html).
103 | It is not in the scope of this document to explain it.
104 | 
105 | CodeBuild workflow:
106 | 
107 | 1. Runs the tests described in `modules/cicd/test`
108 | 2. For each run the test reports can be accessed via AWS CodeBuild Console under `Reports` tab.
109 | 
110 | # Guide
111 | 
112 | ## Prerequisites
113 | 
114 | The following prerequisites are necessary in order to run the example.
115 | 
116 | - [Terraform version >= 1.3.0](https://learn.hashicorp.com/tutorials/terraform/install-cli)
117 | - [aws cli v2](https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html)
118 | - [python >= 3.9](https://www.python.org/downloads/)
119 | - [go >= 1.16](https://golang.org/doc/install)
120 | - [terratest >= 0.41.11](https://terratest.gruntwork.io/)
121 | 
122 | ## 1. Deploy CI Pipeline.
123 | 
124 | Using the provided code example the CI pipeline can be deployed. One has the choice of deploying the cross account setup,
125 | where the CI runs on one AWS account and the tests are performed on another AWS account.  For the sake of simplicity this
126 | guide walks you through setting up the solution within a single AWS account.
127 | 
128 | To deploy the CI follow the these steps:
129 | 1. Modify the [terraform/examples/cicd_account/inventories/variables.tfvars](./terraform/examples/cicd_account/inventories/variables.tfvars)
130 |   accordingly with your needs. A list of all the available variables with a short description of their scope can be found [terraform/examples/cicd_account/variables.tf](./terraform/examples/cicd_account/variables.tf)
131 | 2. Configure your AWS CLI, [here](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html) for more information
132 | 3. Deploy the resources:
133 | 
134 |     ```sh
135 |     cd terraform/examples/cicd_account
136 |     ./run_terraform.sh
137 |     ```
138 | 
139 |     and follow the instructions provided.
140 | 
141 | In case of errors look at the [Troubleshooting](#troubleshooting) section.
142 | 
143 | The [README.md](./terraform/modules/cicd/README.md) inside the module provides information about the resources provisioned
144 | 
145 | ## 2. Review and tune the test code
146 | 
147 | A test example called [cicd_test.go](./terraform/modules/cicd/test/cicd_test.go) is found inside the module directory. It
148 | can be tuned to meet the desired requirements.
149 | 
150 | A complete guide can be found in the [README.md](./terraform/modules/cicd/README.md) of the module.
151 | 
152 | ## 3. Push the code inside your new CodeCommit repository.
153 | 
154 | For this test you can push the same code you are using right now.
155 | 
156 | 1. This first step is optional, but it is recommended: create a `.gitignore` file in the root level of the repository
157 |     to avoid git tracking Terraform state files.
158 | 
159 |     ```sh
160 |     echo "*.tfstate*
161 |     .terraform
162 |     plan.out" >> .gitignore
163 |     ```
164 | 
165 | 2. Retrieve repository remote address:
166 |     1. on the AWS console got in `CodeCommit`
167 |     2. click on your repository name
168 |     3. Click on `Clone URL` and select your preferred way (I would suggest `HTTPS (GRC)`).
169 |        Documentation about how to set up it can be found by clicking on `connection steps`.
170 | 
171 | 3. Setup your git repo:
172 | 
173 |     ```sh
174 |     git remote add origin <THE_URL_YOU_GOT_ON_STEP2>
175 |     ## By default the CodePipeline monitors the dev branch
176 |     git checkout -b dev
177 |    ## Add files and commit. Finally push to repository using the command:
178 |     git push --set-upstream origin dev
179 |     ```
180 | 
181 | 4. Push the repo against the **dev** branch this will trigger the start of the Pipeline
182 | 5. Follow the Pipeline Run connecting to the `CodePipeline` console.
183 | 
184 | ## 4. Clean Up
185 | 
186 | When you finished, in order to do not incur in extra costs, you should clean up your environment.
187 | 
188 | You can do that by running:
189 | 
190 | ```sh
191 | cd terraform/examples/cicd_account
192 | ./run_terraform.sh -d
193 | ```
194 | 
195 | The procedure will stop asking for confirming to have removed every object from the S3 bucket.
196 | 
197 | The names of the buckets are showned as output from the previous command.
198 | 
199 | ```sh
200 | # e.g.
201 | CodeBuild_S3_bucket = "artifact-cicd-test-12345678910-codebuild"
202 | CodePipeline_S3_bucket = "artifact-cicd-test-12345678910-codepipeline"
203 | Confirm that you have empty the S3 bucket...
204 | ```
205 | 
206 | This procedure needs to be done manually, in order to do that:
207 | 1. Access to AWS Console and go to S3
208 | 2. Select the buckets and click on `Empty`
209 | 
210 | ## Troubleshooting
211 | 
212 | ### Error deleting S3 Bucket (BucketNotEmpty)
213 | 
214 | Terraform can exit with this error when you are cleaning or update a deployment.
215 | 
216 | The reason resides to the fact that Terraform is not able to remove a non-empty S3 bucket.
217 | 
218 | To fix the issue you need to manually remove the object in the bucket:
219 | 1. Access to AWS Console and go to S3
220 | 2. Select the failing bucket and click on `Empty`
221 | 
222 | ## Security
223 | 
224 | See [CONTRIBUTING](CONTRIBUTING.md#security-issue-notifications) for more information.
225 | 
226 | ## License
227 | 
228 | This library is licensed under the MIT-0 License. See the LICENSE file.
229 | 


--------------------------------------------------------------------------------
/terraform/examples/cicd_account/inventories/variables.tfvars:
--------------------------------------------------------------------------------
1 | git_repository_name = "artifact-cicd-test"
2 | 
3 | 


--------------------------------------------------------------------------------
/terraform/examples/cicd_account/main.tf:
--------------------------------------------------------------------------------
 1 | terraform {
 2 |   required_providers {
 3 |       aws = {
 4 |           version = "~> 4.2.0"
 5 |       } 
 6 |   }
 7 | }
 8 | 
 9 | provider "aws" {
10 |   region = "eu-west-1"
11 | }
12 | 
13 | data "aws_caller_identity" "current" {}
14 | data "aws_region" "current" {}
15 | 
16 | 
17 | module "setup_cicd_account" {
18 |   source = "../../modules/cicd"
19 | 
20 |   custom_tags                     = var.custom_tags
21 |   account_type                    = "Demo"
22 |   pipeline_deployment_bucket_name = "${var.git_repository_name}-${data.aws_caller_identity.current.account_id}"
23 |   account_id                      = data.aws_caller_identity.current.account_id
24 |   region                          = data.aws_region.current.name
25 |   roles                           = var.cross_account_roles
26 |   code_pipeline_build_stages      = var.code_pipeline_build_stages
27 |   git_repository_name             = var.git_repository_name
28 | }
29 | 


--------------------------------------------------------------------------------
/terraform/examples/cicd_account/outputs.tf:
--------------------------------------------------------------------------------
 1 | output "CodePipeline_S3_bucket" {
 2 |   description = "S3 bucket storing CodePipeline artefacts"
 3 |   value       = module.setup_cicd_account.codepipeline_s3_bucket
 4 | }
 5 | 
 6 | output "CodeBuild_S3_bucket" {
 7 |   description = "S3 bucket storing CodeBuild artefacts"
 8 |   value       = module.setup_cicd_account.codebuild_s3_bucket
 9 | }
10 | 
11 | output "CodePipeline_Name" {
12 |   description = "Name of the CodePipeline"
13 |   value       = module.setup_cicd_account.codepipeline_name[0]
14 | }
15 | 
16 | output "CodeCommit_Repository_Name" {
17 |   description = "CodeCommit Repository Name"
18 |   value       = module.setup_cicd_account.codecommit_repo_name
19 | }


--------------------------------------------------------------------------------
/terraform/examples/cicd_account/run_terraform.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | CLEAN_UP="No"
 4 | 
 5 | while getopts ":dh" opt; do
 6 |   case ${opt} in
 7 |     h )
 8 |         echo "Usage:"
 9 |         echo "    ./run_terraform             Deploy Terraform resources."
10 |         echo "    ./run_terraform -d          Destroy deployed resources."
11 |         exit 0
12 |         ;; 
13 |     d ) # process option t
14 |         echo "Destroy the current deployed resources"
15 |         CLEAN_UP="Yes"
16 |       ;;
17 |     \? ) echo "Usage: ./run_terraform [-h] [-d]"
18 |       ;;
19 |   esac
20 | done
21 | 
22 | 
23 | 
24 | if ( [[ -z ${AWS_ACCESS_KEY_ID} ]] || [[ -z ${AWS_SECRET_ACCESS_KEY} ]] ) && [[ -z ${AWS_PROFILE} ]]; then
25 |     echo "[ERROR] Missing AWS credentials variables"
26 |     exit 1
27 | fi
28 | 
29 | TFVARS_FILE="inventories/variables.tfvars"
30 | # To use the env var AWS_PROFILE
31 | export AWS_SDK_LOAD_CONFIG="true"
32 | 
33 | terraform init -input=false
34 | terraform validate
35 | retcode=$?
36 | if [[  $retcode != 0 ]]; then 
37 |     exit $retcode
38 | fi
39 | 
40 | if [[ ${CLEAN_UP} == "Yes" ]]; then
41 |     terraform output | grep -i S3_bucket
42 |     read -p "Confirm that you have empty the S3 bucket"
43 |     echo "[INFO] destroy all"
44 |     terraform destroy -var-file ${TFVARS_FILE}
45 |     exit 0
46 | fi
47 | 
48 | echo "terraform plan -var-file ${TFVARS_FILE} -out plan.out"
49 | terraform plan -var-file ${TFVARS_FILE} -out plan.out
50 | retcode=$?
51 | if [[  $retcode != 0 ]]; then 
52 |     exit $retcode
53 | fi
54 | 
55 | read -p "Do you want to apply? Yes/No: " answer
56 | 
57 | if [[ $answer == "Yes" ]]; then
58 |     terraform apply plan.out
59 | else
60 |     echo "Exiting..."
61 |     exit 0
62 | fi
63 | 


--------------------------------------------------------------------------------
/terraform/examples/cicd_account/variables.tf:
--------------------------------------------------------------------------------
 1 | variable "custom_tags" {
 2 |   description = "Resources tags"
 3 |   type = object({
 4 |     Environment    = string
 5 |     TargetAccounts = string
 6 |     DeploymentType = string
 7 |   })
 8 |   default = {
 9 |     Environment    = "Deployment"
10 |     TargetAccounts = "Demo"
11 |     DeploymentType = "Terraform"
12 |   }
13 | }
14 | 
15 | variable "cross_account_roles" {
16 |   description = "ARN of the roles to be assumed by CodeBuild in case of Cross Account Deployment"
17 |   type        = list(any)
18 |   default     = []
19 | }
20 | 
21 | variable "git_repository_name" {
22 |   description = "Name of the remote git repository to be created"
23 |   type        = string
24 | }
25 | 
26 | variable "code_pipeline_build_stages" {
27 |   description = "maps of build type stages configured in CodePipeline"
28 |   default = {
29 |     "build" = "terraform/modules/buildspec.yaml"
30 |   }
31 | }


--------------------------------------------------------------------------------
/terraform/modules/buildspec.yaml:
--------------------------------------------------------------------------------
 1 | version: 0.2
 2 | 
 3 | env:
 4 |   variables:
 5 |     ENVIRONMENT: dev
 6 |     TF_IN_AUTOMATION: 1
 7 |     TERRAFORM_VERSION: 1.3.0
 8 |     TERRATEST_VERSION: v0.41.11
 9 |     BASE_PATH: terraform/modules
10 |     #TEST_ACCOUNT_ASSUMED_ROLE: "" In case of cross deployment this is the role in the target account.
11 | 
12 | phases:
13 |   install:
14 |     runtime-versions:
15 |       golang: 1.16
16 |       python: 3.9
17 |     commands:
18 |       - ./${BASE_PATH}/install.sh
19 |   pre_build:
20 |     commands:
21 |       - echo Starting pre-build...
22 |       - ./${BASE_PATH}/prebuild.sh
23 |   build:
24 |     commands:
25 |       - ./${BASE_PATH}/test.sh
26 |   post_build:
27 |     commands:
28 |       - echo Test Performed completed on `date`
29 | reports:
30 |   cicd-reports:
31 |     files:
32 |       - "**/*.xml"
33 |       - "**/*.log"
34 |     base-directory: "terraform/modules/cicd/test/reports"
35 |     discard-paths: no
36 | artifacts:
37 |   files:
38 |     - "**/*.log"
39 |     - "**/*.xml"
40 |   name: reports
41 |   discard-paths: no
42 |   base-directory: "terraform/modules/cicd/test/reports"


--------------------------------------------------------------------------------
/terraform/modules/cicd/README.md:
--------------------------------------------------------------------------------
 1 | # Table of Contents
 2 | 
 3 | - [Table of Contents](#table-of-contents)
 4 | - [Introduction](#introduction)
 5 |   - [Main features:](#main-features)
 6 |   - [Required Variables:](#required-variables)
 7 | - [Tests](#tests)
 8 | 
 9 | # Introduction
10 | 
11 | This module will deploy CI pipeline based on `CodePipeline`, `CodeBuild` and `CodeCommit`.
12 | 
13 | Documentation, about how to deploy it, is provided as an example [here](../../examples/cicd_account/main.tf).
14 | 
15 | The optional and required parameters to be passed are documented directly in the [variables.tf](./variables.tf) file.
16 | 
17 | ## Main features:
18 | 
19 | - `CodeBuild` can be deployed in Public and Private Subnet (this needs to be provided apart)
20 |   Private Subnet can be useful in case of connectivity with on-prem resources.
21 | - Support cross account deployments. As a pre-requisite a role thrusting the account where the CI is provided 
22 |   and with the right permissions should be provided.
23 |   
24 | ## Required Variables:
25 | 
26 | - `custom_tags`: tags to be attached to the deployed resources
27 | - `account_type`: Human readable name for the target account. 
28 |   The target account can be either the same account where `CodeBuild` is running or a remote account.
29 |   This value will be exposed as environment variable inside `CodeBuild`.
30 | - `pipeline_deployment_bucket_name`: Bucket name for storing the artifacts, this will be created during 
31 |   `Terraform` run
32 | - `git_repository_name`: The `CodeCommit` repository name that you want to create and will be monitored by `CodePipeline`
33 |  
34 | # Tests
35 | 
36 | A basic Terraform test is provided for educational purpose using golang `Terratest` library 
37 | and automatically performed by `CodeBuild`.
38 | 
39 | The test will:
40 |  
41 | 1. Try to deploy the all the resources described in the module
42 | 2. Check and compare CodePipeline and CodeBuild names
43 | 3. Destroy all the resources either is the test failed or exited successfully.
44 | 4. Save report and logs locally in order to be retrieved by the CI.
45 | 
46 | 
47 | 
48 | 
49 |   
50 | 
51 | 
52 | 
53 | 


--------------------------------------------------------------------------------
/terraform/modules/cicd/codebuild.tf:
--------------------------------------------------------------------------------
 1 | resource "aws_codebuild_project" "codebuild_deployment" {
 2 |   for_each      = var.code_pipeline_build_stages
 3 |   name          = "${var.git_repository_name}-${each.key}"
 4 |   description   = "Code build project for ${var.git_repository_name} ${each.key} stage"
 5 |   build_timeout = "120"
 6 |   service_role  = aws_iam_role.codebuild_role.arn
 7 |   encryption_key = aws_kms_key.codebuild-key.key_id
 8 | 
 9 |   artifacts {
10 |     type = "CODEPIPELINE"
11 |   }
12 | 
13 |   cache {
14 |     type  = "LOCAL"
15 |     modes = ["LOCAL_DOCKER_LAYER_CACHE"]
16 |   }
17 | 
18 |   environment {
19 |     image                       = var.codebuild_image
20 |     type                        = "LINUX_CONTAINER"
21 |     image_pull_credentials_type = "CODEBUILD"
22 |     privileged_mode             = var.cb_priviledged_mode
23 |     compute_type                = var.codebuild_node_size
24 | 
25 |     # Generate block if variable is set
26 |     dynamic "environment_variable" {
27 |       for_each = var.proxy_config["HTTP_PROXY"] != "" ? var.proxy_config : {}
28 |       content {
29 |         name  = environment_variable.key
30 |         value = environment_variable.value
31 |       }
32 |     }
33 |   }
34 | 
35 |   # Generate block if variable is set, this is a workaround to have a dynamic block set
36 |   # At the moment is necessary to keep split to have a same type in the object
37 |   # otherwise dynamic block cannot work
38 |   dynamic "vpc_config" {
39 |     for_each = var.priv_vpc_config["vpc_id"] != "" ? [var.priv_vpc_config["vpc_id"]] : []
40 |     content {
41 |       vpc_id             = var.priv_vpc_config["vpc_id"]
42 |       subnets            = split(",", var.priv_vpc_config["subnet_ids"])
43 |       security_group_ids = split(",", var.priv_vpc_config["security_group_ids"])
44 |     }
45 |   }
46 | 
47 |   logs_config {
48 |     cloudwatch_logs {
49 |       group_name  = "log-group"
50 |       stream_name = "log-stream"
51 |     }
52 | 
53 |     s3_logs {
54 |       status   = "ENABLED"
55 |       location = "${aws_s3_bucket.codebuild_bucket.id}/${each.key}/build_logs"
56 |     }
57 |   }
58 | 
59 |   source {
60 |     type      = "CODEPIPELINE"
61 |     buildspec = each.value
62 |   }
63 | 
64 |   tags = var.custom_tags
65 | }
66 | 
67 | 


--------------------------------------------------------------------------------
/terraform/modules/cicd/codebuild_roles_policies.tf:
--------------------------------------------------------------------------------
 1 | resource "aws_iam_role" "codebuild_role" {
 2 |   name = "${var.git_repository_name}_codebuild_deploy_role"
 3 | 
 4 |   assume_role_policy = <<EOF
 5 | {
 6 |   "Version": "2012-10-17",
 7 |   "Statement": [
 8 |     {
 9 |       "Effect": "Allow",
10 |       "Principal": {
11 |         "Service": "codebuild.amazonaws.com"
12 |       },
13 |       "Action": "sts:AssumeRole"
14 |     }
15 |   ]
16 | }
17 | EOF
18 | }
19 | 
20 | resource "aws_iam_role_policy" "codebuild_policy" {
21 |   name = "${var.git_repository_name}_codebuild_cross_account_deployment_policy"
22 |   role = aws_iam_role.codebuild_role.name
23 | 
24 |   policy = templatefile("${path.module}/templates/cb_cross_account_dep_policy.json.tpl",
25 |     {
26 |       roles                        = var.roles
27 |       codepipeline_artifact_bucket = aws_s3_bucket.codepipeline_bucket.arn
28 |       priv_vpc_id                  = var.priv_vpc_config["vpc_id"]
29 |       account_id                   = var.account_id
30 |       codebuild_kms_key            = aws_kms_key.codebuild-key.arn
31 |   })
32 | }
33 | 
34 | resource "aws_iam_role_policy_attachment" "codebuild_codecommit" {
35 |   role       = aws_iam_role.codebuild_role.name
36 |   policy_arn = "arn:aws:iam::aws:policy/AWSCodeCommitReadOnly"
37 | }
38 | 
39 | resource "aws_iam_role_policy_attachment" "codebuild_deploy" {
40 |   count      = var.roles == tolist([]) ? 1 : 0
41 |   role       = aws_iam_role.codebuild_role.name
42 |   policy_arn = "arn:aws:iam::aws:policy/AWSCodePipeline_FullAccess"
43 | }
44 | 
45 | resource "aws_iam_role_policy" "codebuild_deploy_policy" {
46 |   name = "${var.git_repository_name}_codebuild_deployment_policy"
47 |   role = aws_iam_role.codebuild_role.name
48 | 
49 |   policy = templatefile("${path.module}/templates/codebuild-role-policy.json.tpl",
50 |     {
51 |       account_id                   = var.account_id
52 |       region                       = var.region
53 |     })
54 | }


--------------------------------------------------------------------------------
/terraform/modules/cicd/codepipeline-role-policy.tf:
--------------------------------------------------------------------------------
 1 | resource "aws_iam_role" "codepipeline_role" {
 2 |   name = local.codepipeline_role_name
 3 | 
 4 |   assume_role_policy = <<EOF
 5 | {
 6 |   "Version": "2012-10-17",
 7 |   "Statement": [
 8 |     {
 9 |       "Effect": "Allow",
10 |       "Principal": {
11 |         "Service": "codepipeline.amazonaws.com"
12 |       },
13 |       "Action": "sts:AssumeRole"
14 |     }
15 |   ]
16 | }
17 | EOF
18 |   tags               = var.custom_tags
19 | }
20 | 
21 | resource "aws_iam_role_policy" "codepipeline_policy" {
22 |   name = local.codepipeline_policy_name
23 |   role = aws_iam_role.codepipeline_role.id
24 | 
25 |   policy = templatefile("${path.module}/templates/codepipeline-role-policy.json.tpl", {
26 |     codepipeline_bucket_arn = aws_s3_bucket.codepipeline_bucket.arn
27 |     kms_key_arn = aws_kms_key.codebuild-key.arn
28 |   })
29 | 
30 | }
31 | 
32 | resource "aws_iam_role_policy_attachment" "codepipeline_codecommit" {
33 |   role       = aws_iam_role.codepipeline_role.name
34 |   policy_arn = "arn:aws:iam::aws:policy/AWSCodeCommitFullAccess"
35 | }


--------------------------------------------------------------------------------
/terraform/modules/cicd/codepipeline.tf:
--------------------------------------------------------------------------------
 1 | resource "aws_codecommit_approval_rule_template" "code_repo_approval_rule_template" {
 2 |   name        = "CICDApprovalRuleTemplate"
 3 |   description = "This is an approval rule template"
 4 | 
 5 |   content = <<EOF
 6 | {
 7 |     "Version": "2018-11-08",
 8 |     "DestinationReferences": ["refs/heads/master"],
 9 |     "Statements": [{
10 |         "Type": "Approvers",
11 |         "NumberOfApprovalsNeeded": 2,
12 |         "ApprovalPoolMembers": ["arn:aws:sts::${var.account_id}:assumed-role/CodeCommitReview/*"]
13 |     }]
14 | }
15 | EOF
16 | }
17 | 
18 | resource "aws_codecommit_repository" "code_repo" {
19 |   repository_name = var.git_repository_name
20 |   description     = "Code Repository"
21 | 
22 |   tags = var.custom_tags
23 | }
24 | 
25 | resource "aws_codecommit_approval_rule_template_association" "example" {
26 |   approval_rule_template_name = aws_codecommit_approval_rule_template.code_repo_approval_rule_template.name
27 |   repository_name             = aws_codecommit_repository.code_repo.repository_name
28 | }
29 | 
30 | resource "aws_codepipeline" "codepipeline" {
31 |   for_each = toset(var.branches)
32 |   name     = "${var.git_repository_name}-${each.value}"
33 |   role_arn = aws_iam_role.codepipeline_role.arn
34 | 
35 |   artifact_store {
36 |     location = aws_s3_bucket.codepipeline_bucket.bucket
37 |     type     = "S3"
38 | 
39 |     encryption_key {
40 |       id   = aws_kms_key.codebuild-key.arn
41 |       type = "KMS"
42 |     }
43 |   }
44 | 
45 | 
46 | 
47 |   stage {
48 |     name = "Source"
49 | 
50 |     action {
51 |       name             = "Source-${var.git_repository_name}"
52 |       category         = "Source"
53 |       owner            = "AWS"
54 |       provider         = "CodeCommit"
55 |       version          = "1"
56 |       output_artifacts = ["source_output"]
57 | 
58 |       configuration = {
59 |         RepositoryName = var.git_repository_name
60 |         BranchName     = each.value
61 |       }
62 |     }
63 |   }
64 | 
65 |   stage {
66 |     name = "Build"
67 | 
68 |     action {
69 |       name             = "Build-${aws_codebuild_project.codebuild_deployment["build"].name}"
70 |       category         = "Build"
71 |       owner            = "AWS"
72 |       provider         = "CodeBuild"
73 |       version          = "1"
74 |       run_order        = 1
75 |       input_artifacts  = ["source_output"]
76 |       output_artifacts = ["build_output"]
77 | 
78 |       configuration = {
79 |         ProjectName = aws_codebuild_project.codebuild_deployment["build"].name
80 |         EnvironmentVariables = jsonencode([{
81 |           name  = "ENVIRONMENT"
82 |           value = each.value
83 |           },
84 |           {
85 |             name  = "PROJECT_NAME"
86 |             value = var.account_type
87 |         }])
88 |       }
89 |     }
90 |   }
91 |   tags = var.custom_tags
92 | }
93 | 


--------------------------------------------------------------------------------
/terraform/modules/cicd/data.tf:
--------------------------------------------------------------------------------
1 | data "aws_caller_identity" "current" {}
2 | data "aws_region" "current" {}


--------------------------------------------------------------------------------
/terraform/modules/cicd/kms.tf:
--------------------------------------------------------------------------------
 1 | resource "aws_kms_key" "codebuild-key" {
 2 |   description             = "Key to be used by CodeBuild to encrypt data"
 3 |   deletion_window_in_days = 30
 4 |   enable_key_rotation     = true
 5 | }
 6 | 
 7 | resource "aws_kms_alias" "codebuild-key" {
 8 |   name          = "alias/codebuild-${var.git_repository_name}-key"
 9 |   target_key_id = aws_kms_key.codebuild-key.key_id
10 | }
11 | 


--------------------------------------------------------------------------------
/terraform/modules/cicd/locals.tf:
--------------------------------------------------------------------------------
 1 | locals {
 2 |   buckets_to_lock = {
 3 |     codepipeline = aws_s3_bucket.codepipeline_bucket.id
 4 |     codebuild    = aws_s3_bucket.codebuild_bucket.id
 5 |   }
 6 |   codepipeline_role_name   = "codepipeline-${var.git_repository_name}"
 7 |   codepipeline_policy_name = "codepipeline-policy-${var.git_repository_name}"
 8 |   region                   = var.region != "" ? var.region : data.aws_region.current.name
 9 |   account_id               = var.account_id != "" ? var.account_id : data.aws_caller_identity.current.account_id
10 | }
11 | 


--------------------------------------------------------------------------------
/terraform/modules/cicd/outputs.tf:
--------------------------------------------------------------------------------
 1 | output "codepipeline_name" {
 2 |   value = values(aws_codepipeline.codepipeline)[*].id
 3 | }
 4 | 
 5 | output "codebuild_name" {
 6 |   value = values(aws_codebuild_project.codebuild_deployment)[*].name
 7 | }
 8 | 
 9 | output "codepipeline_s3_bucket" {
10 |   value = aws_s3_bucket.codepipeline_bucket.bucket
11 | }
12 | 
13 | output "codebuild_s3_bucket" {
14 |   value = aws_s3_bucket.codebuild_bucket.bucket
15 | }
16 | 
17 | output "codecommit_repo_name" {
18 |   value = aws_codecommit_repository.code_repo.repository_id
19 | }


--------------------------------------------------------------------------------
/terraform/modules/cicd/providers.tf:
--------------------------------------------------------------------------------
1 | terraform {
2 |   required_providers {
3 |     aws = {
4 |       version = "~> 4.2.0"
5 |     } 
6 |   }
7 | }


--------------------------------------------------------------------------------
/terraform/modules/cicd/s3.tf:
--------------------------------------------------------------------------------
 1 | resource "aws_s3_bucket" "codebuild_bucket" {
 2 |   #checkov:skip=CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled"
 3 |   #checkov:skip=CKV2_AWS_6: "Ensure that S3 bucket has a Public Access block"
 4 |   #for_each loop not recognised by checkov
 5 |   bucket = "${var.pipeline_deployment_bucket_name}-codebuild"
 6 | 
 7 |   tags = var.custom_tags
 8 | }
 9 | 
10 | resource "aws_s3_bucket" "codepipeline_bucket" {
11 |   #checkov:skip=CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled"
12 |   #checkov:skip=CKV2_AWS_6: "Ensure that S3 bucket has a Public Access block"
13 |   #for_each loop not recognised by checkov
14 |   bucket = "${var.pipeline_deployment_bucket_name}-codepipeline"
15 | 
16 |   tags = var.custom_tags
17 | }
18 | 
19 | resource "aws_s3_bucket_server_side_encryption_configuration" "pipeline_buckets" {
20 |   for_each = local.buckets_to_lock
21 |   bucket = each.value
22 | 
23 |   rule {
24 |     apply_server_side_encryption_by_default {
25 |       sse_algorithm     = "aws:kms"
26 |     }
27 |   }
28 | }
29 | 
30 | resource "aws_s3_bucket_acl" "pipeline_buckets" {
31 |   for_each = local.buckets_to_lock
32 |   bucket = each.value
33 |   acl    = "private"
34 | }
35 | 
36 | resource "aws_s3_bucket_versioning" "pipeline_buckets" {
37 |   for_each = local.buckets_to_lock
38 |   bucket = each.value
39 |   versioning_configuration {
40 |     status = "Enabled"
41 |   }
42 | }
43 | 
44 | resource "aws_s3_bucket_public_access_block" "pipeline_buckets" {
45 |   for_each                = local.buckets_to_lock
46 |   bucket                  = each.value
47 |   block_public_acls       = true
48 |   block_public_policy     = true
49 |   ignore_public_acls      = true
50 |   restrict_public_buckets = true
51 | 
52 | }
53 | 


--------------------------------------------------------------------------------
/terraform/modules/cicd/templates/cb_cross_account_dep_policy.json.tpl:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [
 4 | %{ for v in roles }
 5 |     {
 6 |       "Effect": "Allow",
 7 |       "Action": "sts:AssumeRole",
 8 |       "Resource": "${v}"
 9 |     },
10 | %{ endfor }
11 |     {
12 |       "Effect": "Allow",
13 |       "Resource": [
14 |         "*"
15 |       ],
16 |       "Action": [
17 |         "logs:CreateLogGroup",
18 |         "logs:CreateLogStream",
19 |         "logs:PutLogEvents"
20 |       ]
21 |     },
22 |     {
23 |       "Effect": "Allow",
24 |       "Resource": [
25 |         "arn:aws:codebuild:eu-west-1:${account_id}:report-group/*"
26 |       ],
27 |       "Action": [
28 |         "codebuild:CreateReportGroup",
29 |         "codebuild:CreateReport",
30 |         "codebuild:BatchPutTestCases",
31 |         "codebuild:UpdateReport"
32 |       ]
33 |     },
34 | %{ if priv_vpc_id != "" }
35 |     {
36 |       "Effect": "Allow", 
37 |       "Action": [
38 |         "ec2:*"
39 |       ],
40 |       "Resource": "*" 
41 |     },
42 | %{ endif }
43 |     {
44 |       "Effect": "Allow",
45 |       "Resource": [
46 |         "${codepipeline_artifact_bucket}",
47 |         "${codepipeline_artifact_bucket}/*"
48 |       ],
49 |       "Action": [
50 |         "s3:*"
51 |       ]
52 |     },
53 |     {
54 |       "Effect": "Allow",
55 |       "Resource": "${codebuild_kms_key}",
56 |       "Action": [
57 |         "kms:Decrypt",
58 |         "kms:DescribeKey",
59 |         "kms:Encrypt",
60 |         "kms:GenerateDataKey*",
61 |         "kms:ReEncrypt*"
62 |       ]
63 |     }
64 |   ]
65 | }


--------------------------------------------------------------------------------
/terraform/modules/cicd/templates/codebuild-role-policy.json.tpl:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [
 4 |     {
 5 |       "Effect": "Allow",
 6 |       "Action": [
 7 |         "iam:CreateRole",
 8 |         "iam:GetRole",
 9 |         "iam:GetRolePolicy",
10 |         "iam:TagRole",
11 |         "iam:List*",
12 |         "iam:AttachRolePolicy",
13 |         "iam:DetachRolePolicy",
14 |         "iam:DeleteRole",
15 |         "iam:DeleteRolePolicy",
16 |         "iam:PassRole",
17 |         "iam:PutRolePolicy"
18 |       ],
19 |       "Resource": "arn:aws:iam::${account_id}:role/*"
20 |     },
21 |     {
22 |       "Effect": "Allow",
23 |       "Action": [
24 |         "codecommit:CreateRepository",
25 |         "codecommit:TagResource",
26 |         "codecommit:DeleteRepository"
27 |       ],
28 |       "Resource": "arn:aws:codecommit:${region}:${account_id}:*"
29 |     },
30 |     {
31 |       "Effect": "Allow",
32 |       "Action": [
33 |         "codecommit:CreateApprovalRuleTemplate",
34 |         "codecommit:AssociateApprovalRuleTemplateWithRepository",
35 |         "codecommit:DeleteApprovalRuleTemplate",
36 |         "codecommit:DisassociateApprovalRuleTemplateFromRepository"
37 |       ],
38 |       "Resource": "*"
39 |     },
40 |     {
41 |       "Effect": "Allow",
42 |       "Action": [
43 |         "codebuild:DeleteProject"
44 |       ],
45 |       "Resource": "arn:aws:codebuild:${region}:${account_id}:project/*"
46 |     },
47 |     {
48 |       "Effect": "Allow",
49 |       "Action": [
50 |         "kms:CreateKey",
51 |         "kms:CreateAlias",
52 |         "kms:DescribeKey",
53 |         "kms:EnableKeyRotation",
54 |         "kms:Get*",
55 |         "kms:List*",
56 |         "kms:DeleteAlias",
57 |         "kms:ScheduleKeyDeletion"
58 |       ],
59 |       "Resource": "*"
60 |     },
61 |     {
62 |       "Effect": "Allow",
63 |       "Action": [
64 |         "s3:CreateBucket",
65 |         "s3:List*",
66 |         "s3:Get*",
67 |         "s3:Put*",
68 |         "s3:DeleteBucket"
69 |       ],
70 |       "Resource": "*"
71 |     }
72 |   ]
73 | }


--------------------------------------------------------------------------------
/terraform/modules/cicd/templates/codepipeline-role-policy.json.tpl:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [
 4 |     {
 5 |       "Effect":"Allow",
 6 |       "Action": [
 7 |         "s3:Get*",
 8 |         "s3:Put*",
 9 |         "s3:List*"
10 |       ],
11 |       "Resource": [
12 |         "${codepipeline_bucket_arn}",
13 |         "${codepipeline_bucket_arn}/*"
14 |       ]
15 |     },
16 |     {
17 |       "Effect":"Allow",
18 |       "Action": [
19 |         "kms:ReEncrypt*",
20 |         "kms:GenerateDataKey*",
21 |         "kms:DescribeKey",
22 |         "kms:Decrypt",
23 |         "kms:Encrypt"
24 |       ],
25 |       "Resource": [
26 |         "${kms_key_arn}"
27 |       ]
28 |     },
29 |     {
30 |       "Effect": "Allow",
31 |       "Action": [
32 |         "codebuild:BatchGetBuilds",
33 |         "codebuild:StartBuild"
34 |       ],
35 |       "Resource": "*"
36 |     }
37 |   ]
38 | }


--------------------------------------------------------------------------------
/terraform/modules/cicd/templates/key-policy.json.tpl:
--------------------------------------------------------------------------------
 1 | {
 2 |     "Id": "key-consolepolicy-3",
 3 |     "Version": "2012-10-17",
 4 |     "Statement": [
 5 |         {
 6 |             "Sid": "Enable IAM User Permissions",
 7 |             "Effect": "Allow",
 8 |             "Principal": {
 9 |                 "AWS": "arn:aws:iam::${account_id}:root"
10 |             },
11 |             "Action": "kms:*",
12 |             "Resource": "*"
13 |         },
14 |         {
15 |             "Sid": "Allow use of the key",
16 |             "Effect": "Allow",
17 |             "Principal": {
18 |                 "AWS": [
19 |                     "${code_pipeline_execution_role}",
20 |                     "${code_build_execution_role}",
21 |                     "arn:aws:iam::${account_id}:root"
22 |                 ]
23 |             },
24 |             "Action": [
25 |                 "kms:Encrypt",
26 |                 "kms:Decrypt",
27 |                 "kms:ReEncrypt*",
28 |                 "kms:GenerateDataKey*",
29 |                 "kms:DescribeKey"
30 |             ],
31 |             "Resource": "*"
32 |         }
33 |     ]
34 | }


--------------------------------------------------------------------------------
/terraform/modules/cicd/test/cicd_test.go:
--------------------------------------------------------------------------------
 1 | package test
 2 | 
 3 | import (
 4 | 	"fmt"
 5 | 	"github.com/gruntwork-io/terratest/modules/aws"
 6 | 	"github.com/gruntwork-io/terratest/modules/random"
 7 | 	"github.com/gruntwork-io/terratest/modules/terraform"
 8 | 	"github.com/stretchr/testify/assert"
 9 | 	"strings"
10 | 	"testing"
11 | )
12 | 
13 | func TestBitBucketIntegration(t *testing.T) {
14 | 
15 | 	uniqueId := strings.ToLower(random.UniqueId())
16 | 	awsRegion := aws.GetRandomStableRegion(t, nil, nil)
17 | 	awsAccountID := aws.GetAccountId(t)
18 | 
19 | 	terraformOptions := &terraform.Options{
20 | 		// Set the path to the Terraform code that will be tested.
21 | 		TerraformDir: "../",
22 | 
23 | 		// Here provide the values for the terraform variables
24 | 		Vars: map[string]interface{}{
25 | 			"custom_tags": map[string]string{
26 | 				"Environment":    "Terratest",
27 | 				"TargetAccounts": "Same",
28 | 				"DeploymentType": "Terratest",
29 | 			},
30 | 			"pipeline_deployment_bucket_name": fmt.Sprintf("testing-%s", uniqueId),
31 | 			"roles":                           []string{},
32 | 			"account_id":                      awsAccountID,
33 | 			"region":                          awsRegion,
34 | 			"git_repository_name":             "mocked",
35 | 			"account_type":                    "Terratest",
36 | 			"branches":                        []string{"dev"},
37 | 		},
38 | 	}
39 | 
40 | 	// Clean up resources with "terraform destroy" at the end of the test.
41 | 	defer terraform.Destroy(t, terraformOptions)
42 | 
43 | 	// Run "terraform init" and "terraform apply". Fail the test if there are any errors.
44 | 	terraform.InitAndApply(t, terraformOptions)
45 | 
46 | 	outputCodePipelineName := terraform.Output(t, terraformOptions, "codepipeline_name")
47 | 	outputCodeBuildProjectName := terraform.Output(t, terraformOptions, "codebuild_name")
48 | 
49 | 	// // Run `terraform output` to get the values of output variables and check they have the expected values.
50 | 
51 | 	assert.Equal(t, "[mocked-dev]", outputCodePipelineName)
52 | 	assert.Equal(t, "[mocked-build]", outputCodeBuildProjectName)
53 | }
54 | 


--------------------------------------------------------------------------------
/terraform/modules/cicd/test/go.mod:
--------------------------------------------------------------------------------
1 | module test
2 | 
3 | go 1.16
4 | 
5 | require (
6 | 	github.com/gruntwork-io/terratest v0.41.11
7 | 	github.com/stretchr/testify v1.7.0
8 | )
9 | 


--------------------------------------------------------------------------------
/terraform/modules/cicd/test/test.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | set -e
 3 | 
 4 | cd ${BASE_PATH}/cicd/test
 5 | # Run terratest
 6 | echo "Running Terratest"
 7 | go get "github.com/gruntwork-io/terratest/modules/terraform" \
 8 |    "github.com/stretchr/testify/assert" \
 9 |    "strings" \
10 |    "testing" \
11 |    "fmt" \
12 |    "github.com/gruntwork-io/terratest/modules/random" \
13 |    "github.com/gruntwork-io/terratest/modules/aws"
14 | 
15 | mkdir reports
16 | go test cicd_test.go -timeout 10m -v | tee reports/test_output.log
17 | retcode=${PIPESTATUS[0]}
18 | 
19 | echo "Creating Logs"
20 | terratest_log_parser -testlog reports/test_output.log -outputdir reports
21 | 
22 | exit ${retcode}


--------------------------------------------------------------------------------
/terraform/modules/cicd/variables.tf:
--------------------------------------------------------------------------------
  1 | ## Required Vars
  2 | variable "custom_tags" {
  3 |   type = object({
  4 |     Environment    = string
  5 |     TargetAccounts = string
  6 |     DeploymentType = string
  7 |   })
  8 | }
  9 | 
 10 | variable "account_type" {
 11 |   description = "Human readable name of the targets accounts"
 12 |   type        = string
 13 | }
 14 | 
 15 | variable "pipeline_deployment_bucket_name" {
 16 |   description = "Bucket used by codepipeline and codebuild to store artifacts regarding the deployment"
 17 |   type        = string
 18 | }
 19 | 
 20 | variable "git_repository_name" {
 21 |   description = "Name of the remote source repository"
 22 |   type        = string
 23 | }
 24 | 
 25 | ## Optional Variables
 26 | variable "account_id" {
 27 |   description = "Account ID where resources will be deployed"
 28 |   type        = string
 29 |   default     = ""
 30 | }
 31 | 
 32 | variable "region" {
 33 |   description = "AWS region where the resources will be deployed"
 34 |   default     = ""
 35 | }
 36 | 
 37 | variable "cb_priviledged_mode" {
 38 |   description = "Enable codebuild to use docker to build images"
 39 |   type        = string
 40 |   default     = "true"
 41 | }
 42 | 
 43 | variable "roles" {
 44 |   description = "Roles ARN used to deploy, in case of cross account deployments these roles should thrust the CIDE account"
 45 |   type        = list(any)
 46 |   default     = []
 47 | }
 48 | 
 49 | variable "branches" {
 50 |   description = "Branches to be built"
 51 |   type        = list(string)
 52 |   default     = ["dev"]
 53 | }
 54 | 
 55 | variable "code_pipeline_build_stages" {
 56 |   description = "maps of build type stages configured in CodePipeline"
 57 |   default = {
 58 |     "build" = "./build/buildspec.yaml"
 59 |   }
 60 | }
 61 | 
 62 | variable "codebuild_node_size" {
 63 |   default = "BUILD_GENERAL1_SMALL"
 64 | }
 65 | 
 66 | variable "proxy_config" {
 67 |   description = "Proxies used by CodeBuild"
 68 |   type = object({
 69 |     HTTP_PROXY  = string
 70 |     HTTPS_PROXY = string
 71 |     NO_PROXY    = string
 72 |     no_proxy    = string
 73 |     https_proxy = string
 74 |     http_proxy  = string
 75 |   })
 76 |   default = {
 77 |     HTTP_PROXY  = ""
 78 |     HTTPS_PROXY = ""
 79 |     no_proxy    = ""
 80 |     https_proxy = ""
 81 |     http_proxy  = ""
 82 |     NO_PROXY    = ""
 83 |   }
 84 | }
 85 | 
 86 | variable "priv_vpc_config" {
 87 |   description = "Map of values for private VPC, subnet_ids and security_group_ids are comma separated lists"
 88 |   type = object({
 89 |     vpc_id             = string
 90 |     subnet_ids         = string
 91 |     security_group_ids = string
 92 |   })
 93 |   default = {
 94 |     vpc_id             = ""
 95 |     subnet_ids         = ""
 96 |     security_group_ids = ""
 97 |   }
 98 | }
 99 | 
100 | variable "codebuild_image" {
101 |   description = "CodeBuild image"
102 |   type = string
103 |   default = "aws/codebuild/standard:5.0"
104 | }
105 | 


--------------------------------------------------------------------------------
/terraform/modules/install.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | set -e
 4 | 
 5 | eval $(ssh-agent)
 6 | echo "SSH_AUTH_SOCK ${SSH_AUTH_SOCK}"
 7 | git config --global credential.helper '!aws codecommit credential-helper $@'
 8 | git config --global credential.UseHttpPath true
 9 | cd /tmp
10 | echo "Installing Terraform"
11 | curl -o terraform_${TERRAFORM_VERSION}_linux_amd64.zip https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip
12 | unzip -o terraform_${TERRAFORM_VERSION}_linux_amd64.zip && mv terraform /usr/bin
13 | terraform --version
14 | echo "Installing Terratest Log Parser"
15 | curl --location --silent --fail --show-error -o terratest_log_parser https://github.com/gruntwork-io/terratest/releases/download/${TERRATEST_VERSION}/terratest_log_parser_linux_amd64
16 | chmod +x terratest_log_parser
17 | mv terratest_log_parser /usr/local/bin
18 | terratest_log_parser --version
19 | cd -


--------------------------------------------------------------------------------
/terraform/modules/prebuild.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | set -e
 3 | 
 4 | if [[ -z  ${TEST_ACCOUNT_ASSUMED_ROLE} ]]; then
 5 |   echo "[INFO] Local Deployment"
 6 |   exit 0
 7 | fi
 8 | 
 9 | echo "Assume Role in Test Account"
10 | aws sts assume-role --role-arn ${TEST_ACCOUNT_ASSUMED_ROLE} --role-session-name "deployment" > /tmp/role
11 | export AWS_ACCESS_KEY_ID=$(cat /tmp/role|jq -r '.Credentials.AccessKeyId')
12 | export AWS_SECRET_ACCESS_KEY=$(cat /tmp/role|jq -r '.Credentials.SecretAccessKey')
13 | export AWS_SESSION_TOKEN=$(cat /tmp/role|jq -r '.Credentials.SessionToken')


--------------------------------------------------------------------------------
/terraform/modules/test.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | set -e
 4 | 
 5 | export AWS_SDK_LOAD_CONFIG="true"
 6 | export AWS_REGION="eu-west-1"
 7 | 
 8 | # Run terratest
 9 | for dir in $(find ${BASE_PATH} -maxdepth 1 -mindepth 1 -type d -printf '%f\n'); do
10 |   if [[ -f "${BASE_PATH}/${dir}/test/test.sh" ]]; then
11 |     ./${BASE_PATH}/${dir}/test/test.sh
12 |   fi
13 | done


--------------------------------------------------------------------------------