├── test ├── .gitignore ├── src │ ├── .gitignore │ ├── Makefile │ ├── examples_complete_test.go │ └── go.mod ├── Makefile.alpine └── Makefile ├── .github ├── ISSUE_TEMPLATE │ ├── question.md │ ├── config.yml │ ├── bug_report.md │ ├── feature_request.md │ ├── bug_report.yml │ └── feature_request.yml ├── mergify.yml ├── banner.png ├── workflows │ ├── release.yml │ ├── scheduled.yml │ ├── chatops.yml │ ├── branch.yml │ ├── auto-release.yml │ ├── validate-codeowners.yml │ ├── auto-context.yml │ └── auto-readme.yml ├── renovate.json ├── settings.yml ├── PULL_REQUEST_TEMPLATE.md └── CODEOWNERS ├── examples ├── complete │ ├── providers.tf │ ├── versions.tf │ ├── fixtures.us-east-2.tfvars │ ├── outputs.tf │ ├── main.tf │ ├── variables.tf │ └── context.tf └── minimal │ ├── providers.tf │ ├── versions.tf │ ├── fixtures.us-east-2.tfvars │ ├── variables.tf │ ├── main.tf │ ├── outputs.tf │ └── context.tf ├── versions.tf ├── .gitignore ├── atmos.yaml ├── .editorconfig ├── outputs.tf ├── security-group-variables.tf ├── README.yaml ├── variables.tf ├── main.tf ├── context.tf ├── LICENSE └── README.md /test/.gitignore: -------------------------------------------------------------------------------- 1 | .test-harness 2 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/question.md: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /.github/mergify.yml: -------------------------------------------------------------------------------- 1 | extends: .github 2 | -------------------------------------------------------------------------------- /test/src/.gitignore: -------------------------------------------------------------------------------- 1 | .gopath 2 | vendor/ 3 | -------------------------------------------------------------------------------- /examples/complete/providers.tf: -------------------------------------------------------------------------------- 1 | provider "aws" { 2 | region = var.region 3 | } -------------------------------------------------------------------------------- /examples/minimal/providers.tf: -------------------------------------------------------------------------------- 1 | provider "aws" { 2 | region = var.region 3 | } -------------------------------------------------------------------------------- /.github/banner.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cloudposse/terraform-aws-mwaa/HEAD/.github/banner.png -------------------------------------------------------------------------------- /test/Makefile.alpine: -------------------------------------------------------------------------------- 1 | ifneq (,$(wildcard /sbin/apk)) 2 | ## Install all dependencies for alpine 3 | deps:: init 4 | @apk add --update terraform-docs@cloudposse json2hcl@cloudposse 5 | endif 6 | -------------------------------------------------------------------------------- /versions.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_version = ">= 1.0" 3 | 4 | required_providers { 5 | aws = { 6 | source = "hashicorp/aws" 7 | version = ">= 4.2.0" 8 | } 9 | } 10 | } 11 | -------------------------------------------------------------------------------- /examples/minimal/versions.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_version = ">= 1.0" 3 | 4 | required_providers { 5 | aws = { 6 | source = "hashicorp/aws" 7 | version = ">= 4.2.0" 8 | } 9 | } 10 | } -------------------------------------------------------------------------------- /examples/complete/versions.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_version = ">= 1.0" 3 | 4 | required_providers { 5 | aws = { 6 | source = "hashicorp/aws" 7 | version = ">= 4.2.0" 8 | } 9 | } 10 | } 11 | -------------------------------------------------------------------------------- /examples/minimal/fixtures.us-east-2.tfvars: -------------------------------------------------------------------------------- 1 | enabled = true 2 | 3 | region = "us-east-2" 4 | 5 | namespace = "eg" 6 | 7 | environment = "ue2" 8 | 9 | stage = "test" 10 | 11 | name = "mwaa-test" 12 | 13 | availability_zones = ["us-east-2a", "us-east-2b"] 14 | -------------------------------------------------------------------------------- /examples/minimal/variables.tf: -------------------------------------------------------------------------------- 1 | variable "availability_zones" { 2 | type = list(string) 3 | description = "List of availability zones for VPC subnets" 4 | } 5 | 6 | variable "region" { 7 | type = string 8 | description = "AWS region" 9 | } 10 | -------------------------------------------------------------------------------- /.github/workflows/release.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: release 3 | on: 4 | release: 5 | types: 6 | - published 7 | 8 | permissions: 9 | id-token: write 10 | contents: write 11 | pull-requests: write 12 | 13 | jobs: 14 | terraform-module: 15 | uses: cloudposse/.github/.github/workflows/shared-release-branches.yml@main 16 | secrets: inherit 17 | -------------------------------------------------------------------------------- /.github/renovate.json: -------------------------------------------------------------------------------- 1 | { 2 | "extends": [ 3 | "config:base", 4 | ":preserveSemverRanges", 5 | ":rebaseStalePrs" 6 | ], 7 | "baseBranches": ["main"], 8 | "labels": ["auto-update"], 9 | "dependencyDashboardAutoclose": true, 10 | "enabledManagers": ["terraform"], 11 | "terraform": { 12 | "ignorePaths": ["**/context.tf"] 13 | } 14 | } 15 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | # Local .terraform directories 2 | **/.terraform/* 3 | 4 | # .tfstate files 5 | *.tfstate 6 | *.tfstate.* 7 | .terraform 8 | .terraform.tfstate.lock.info 9 | 10 | **/.idea 11 | **/*.iml 12 | 13 | # Cloud Posse Build Harness https://github.com/cloudposse/build-harness 14 | **/.build-harness 15 | **/build-harness 16 | 17 | # Crash log files 18 | crash.log 19 | test.log 20 | -------------------------------------------------------------------------------- /.github/settings.yml: -------------------------------------------------------------------------------- 1 | # Upstream changes from _extends are only recognized when modifications are made to this file in the default branch. 2 | _extends: .github 3 | repository: 4 | name: terraform-aws-mwaa 5 | description: Terraform module to provision Amazon Managed Workflows for Apache Airflow (MWAA) 6 | homepage: https://cloudposse.com/accelerate 7 | topics: "" 8 | 9 | 10 | 11 | 12 | -------------------------------------------------------------------------------- /.github/workflows/scheduled.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: scheduled 3 | on: 4 | workflow_dispatch: { } # Allows manually trigger this workflow 5 | schedule: 6 | - cron: "0 3 * * *" 7 | 8 | permissions: 9 | pull-requests: write 10 | id-token: write 11 | contents: write 12 | 13 | jobs: 14 | scheduled: 15 | uses: cloudposse/.github/.github/workflows/shared-terraform-scheduled.yml@main 16 | secrets: inherit 17 | -------------------------------------------------------------------------------- /.github/workflows/chatops.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: chatops 3 | on: 4 | issue_comment: 5 | types: [created] 6 | 7 | permissions: 8 | pull-requests: write 9 | id-token: write 10 | contents: write 11 | statuses: write 12 | 13 | jobs: 14 | test: 15 | uses: cloudposse/.github/.github/workflows/shared-terraform-chatops.yml@main 16 | if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/terratest') }} 17 | secrets: inherit 18 | -------------------------------------------------------------------------------- /atmos.yaml: -------------------------------------------------------------------------------- 1 | # Atmos Configuration — powered by https://atmos.tools 2 | # 3 | # This configuration enables centralized, DRY, and consistent project scaffolding using Atmos. 4 | # 5 | # Included features: 6 | # - Organizational custom commands: https://atmos.tools/core-concepts/custom-commands 7 | # - Automated README generation: https://atmos.tools/cli/commands/docs/generate 8 | # 9 | 10 | # Import shared configuration used by all modules 11 | import: 12 | - https://raw.githubusercontent.com/cloudposse/.github/refs/heads/main/.github/atmos/terraform-module.yaml 13 | -------------------------------------------------------------------------------- /.editorconfig: -------------------------------------------------------------------------------- 1 | # Unix-style newlines with a newline ending every file 2 | [*] 3 | charset = utf-8 4 | end_of_line = lf 5 | indent_size = 2 6 | indent_style = space 7 | insert_final_newline = true 8 | trim_trailing_whitespace = true 9 | 10 | [*.{tf,tfvars}] 11 | indent_size = 2 12 | indent_style = space 13 | 14 | [*.md] 15 | max_line_length = 0 16 | trim_trailing_whitespace = false 17 | 18 | # Override for Makefile 19 | [{Makefile, makefile, GNUmakefile, Makefile.*}] 20 | tab_width = 2 21 | indent_style = tab 22 | indent_size = 4 23 | 24 | [COMMIT_EDITMSG] 25 | max_line_length = 0 26 | -------------------------------------------------------------------------------- /.github/workflows/branch.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: Branch 3 | on: 4 | pull_request: 5 | branches: 6 | - main 7 | - release/** 8 | types: [opened, synchronize, reopened, labeled, unlabeled] 9 | push: 10 | branches: 11 | - main 12 | - release/v* 13 | paths-ignore: 14 | - '.github/**' 15 | - 'docs/**' 16 | - 'examples/**' 17 | - 'test/**' 18 | - 'README.md' 19 | 20 | permissions: {} 21 | 22 | jobs: 23 | terraform-module: 24 | uses: cloudposse/.github/.github/workflows/shared-terraform-module.yml@main 25 | secrets: inherit 26 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/config.yml: -------------------------------------------------------------------------------- 1 | blank_issues_enabled: false 2 | 3 | contact_links: 4 | 5 | - name: Community Slack Team 6 | url: https://cloudposse.com/slack/ 7 | about: |- 8 | Please ask and answer questions here. 9 | 10 | - name: Office Hours 11 | url: https://cloudposse.com/office-hours/ 12 | about: |- 13 | Join us every Wednesday for FREE Office Hours (lunch & learn). 14 | 15 | - name: DevOps Accelerator Program 16 | url: https://cloudposse.com/accelerate/ 17 | about: |- 18 | Own your infrastructure in record time. We build it. You drive it. 19 | -------------------------------------------------------------------------------- /.github/PULL_REQUEST_TEMPLATE.md: -------------------------------------------------------------------------------- 1 | ## what 2 | 3 | 7 | 8 | ## why 9 | 10 | 15 | 16 | ## references 17 | 18 | 22 | -------------------------------------------------------------------------------- /examples/minimal/main.tf: -------------------------------------------------------------------------------- 1 | module "vpc" { 2 | source = "cloudposse/vpc/aws" 3 | version = "2.1.0" 4 | 5 | ipv4_primary_cidr_block = "172.16.0.0/16" 6 | 7 | context = module.this.context 8 | } 9 | 10 | module "subnets" { 11 | source = "cloudposse/dynamic-subnets/aws" 12 | version = "2.4.1" 13 | 14 | availability_zones = var.availability_zones 15 | vpc_id = module.vpc.vpc_id 16 | igw_id = [module.vpc.igw_id] 17 | ipv4_cidr_block = [module.vpc.vpc_cidr_block] 18 | nat_gateway_enabled = true 19 | nat_instance_enabled = false 20 | 21 | context = module.this.context 22 | } 23 | 24 | module "mwaa" { 25 | source = "../.." 26 | 27 | vpc_id = module.vpc.vpc_id 28 | subnet_ids = module.subnets.private_subnet_ids 29 | 30 | context = module.this.context 31 | } 32 | -------------------------------------------------------------------------------- /.github/workflows/auto-release.yml: -------------------------------------------------------------------------------- 1 | name: auto-release 2 | 3 | on: 4 | push: 5 | branches: 6 | - main 7 | - master 8 | - production 9 | 10 | jobs: 11 | publish: 12 | runs-on: ubuntu-latest 13 | steps: 14 | # Get PR from merged commit to master 15 | - uses: actions-ecosystem/action-get-merged-pull-request@v1 16 | id: get-merged-pull-request 17 | with: 18 | github_token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }} 19 | # Drafts your next Release notes as Pull Requests are merged into "main" 20 | - uses: release-drafter/release-drafter@v5 21 | with: 22 | publish: ${{ !contains(steps.get-merged-pull-request.outputs.labels, 'no-release') }} 23 | prerelease: false 24 | config-name: auto-release.yml 25 | env: 26 | GITHUB_TOKEN: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }} 27 | -------------------------------------------------------------------------------- /examples/complete/fixtures.us-east-2.tfvars: -------------------------------------------------------------------------------- 1 | enabled = true 2 | 3 | region = "us-east-2" 4 | 5 | namespace = "eg" 6 | 7 | environment = "ue2" 8 | 9 | stage = "test" 10 | 11 | name = "mwaa-test" 12 | 13 | availability_zones = ["us-east-2a", "us-east-2b"] 14 | 15 | airflow_version = "2.8.1" 16 | 17 | dag_s3_path = "dags" 18 | 19 | environment_class = "mw1.small" 20 | 21 | min_workers = 1 22 | 23 | max_workers = 10 24 | 25 | webserver_access_mode = "PRIVATE_ONLY" 26 | 27 | dag_processing_logs_enabled = true 28 | 29 | dag_processing_logs_level = "INFO" 30 | 31 | scheduler_logs_enabled = true 32 | 33 | scheduler_logs_level = "INFO" 34 | 35 | task_logs_enabled = true 36 | 37 | task_logs_level = "INFO" 38 | 39 | webserver_logs_enabled = true 40 | 41 | webserver_logs_level = "INFO" 42 | 43 | worker_logs_enabled = true 44 | 45 | worker_logs_level = "INFO" 46 | 47 | airflow_configuration_options = { 48 | "core.default_task_retries" = 16 49 | } 50 | -------------------------------------------------------------------------------- /test/src/Makefile: -------------------------------------------------------------------------------- 1 | export TF_CLI_ARGS_init ?= -get-plugins=true 2 | export TERRAFORM_VERSION ?= $(shell curl -s https://checkpoint-api.hashicorp.com/v1/check/terraform | jq -r -M '.current_version' | cut -d. -f1) 3 | 4 | .DEFAULT_GOAL : all 5 | .PHONY: all 6 | 7 | ## Default target 8 | all: test 9 | 10 | .PHONY : init 11 | ## Initialize tests 12 | init: 13 | @exit 0 14 | 15 | .PHONY : test 16 | ## Run tests 17 | test: init 18 | go mod download 19 | go test -v -timeout 120m -run TestExamplesComplete 20 | 21 | ## Run tests in docker container 22 | docker/test: 23 | docker run --name terratest --rm -it -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_SESSION_TOKEN -e GITHUB_TOKEN \ 24 | -e PATH="/usr/local/terraform/$(TERRAFORM_VERSION)/bin:/go/bin:/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" \ 25 | -v $(CURDIR)/../../:/module/ cloudposse/test-harness:latest -C /module/test/src test 26 | 27 | .PHONY : clean 28 | ## Clean up files 29 | clean: 30 | rm -rf ../../examples/complete/*.tfstate* 31 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/bug_report.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Bug report 3 | about: Create a report to help us improve 4 | title: '' 5 | labels: 'bug' 6 | assignees: '' 7 | 8 | --- 9 | 10 | Found a bug? Maybe our [Slack Community](https://slack.cloudposse.com) can help. 11 | 12 | [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com) 13 | 14 | ## Describe the Bug 15 | A clear and concise description of what the bug is. 16 | 17 | ## Expected Behavior 18 | A clear and concise description of what you expected to happen. 19 | 20 | ## Steps to Reproduce 21 | Steps to reproduce the behavior: 22 | 1. Go to '...' 23 | 2. Run '....' 24 | 3. Enter '....' 25 | 4. See error 26 | 27 | ## Screenshots 28 | If applicable, add screenshots or logs to help explain your problem. 29 | 30 | ## Environment (please complete the following information): 31 | 32 | Anything that will help us triage the bug will help. Here are some ideas: 33 | - OS: [e.g. Linux, OSX, WSL, etc] 34 | - Version [e.g. 10.15] 35 | 36 | ## Additional Context 37 | Add any other context about the problem here. -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/feature_request.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Feature Request 3 | about: Suggest an idea for this project 4 | title: '' 5 | labels: 'feature request' 6 | assignees: '' 7 | 8 | --- 9 | 10 | Have a question? Please checkout our [Slack Community](https://slack.cloudposse.com) or visit our [Slack Archive](https://archive.sweetops.com/). 11 | 12 | [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com) 13 | 14 | ## Describe the Feature 15 | 16 | A clear and concise description of what the bug is. 17 | 18 | ## Expected Behavior 19 | 20 | A clear and concise description of what you expected to happen. 21 | 22 | ## Use Case 23 | 24 | Is your feature request related to a problem/challenge you are trying to solve? Please provide some additional context of why this feature or capability will be valuable. 25 | 26 | ## Describe Ideal Solution 27 | 28 | A clear and concise description of what you want to happen. If you don't know, that's okay. 29 | 30 | ## Alternatives Considered 31 | 32 | Explain what alternative solutions or features you've considered. 33 | 34 | ## Additional Context 35 | 36 | Add any other context or screenshots about the feature request here. 37 | -------------------------------------------------------------------------------- /.github/workflows/validate-codeowners.yml: -------------------------------------------------------------------------------- 1 | name: Validate Codeowners 2 | on: 3 | workflow_dispatch: 4 | 5 | pull_request: 6 | 7 | jobs: 8 | validate-codeowners: 9 | runs-on: ubuntu-latest 10 | steps: 11 | - name: "Checkout source code at current commit" 12 | uses: actions/checkout@v2 13 | - uses: mszostok/codeowners-validator@v0.7.1 14 | if: github.event.pull_request.head.repo.full_name == github.repository 15 | name: "Full check of CODEOWNERS" 16 | with: 17 | # For now, remove "files" check to allow CODEOWNERS to specify non-existent 18 | # files so we can use the same CODEOWNERS file for Terraform and non-Terraform repos 19 | # checks: "files,syntax,owners,duppatterns" 20 | checks: "syntax,owners,duppatterns" 21 | owner_checker_allow_unowned_patterns: "false" 22 | # GitHub access token is required only if the `owners` check is enabled 23 | github_access_token: "${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}" 24 | - uses: mszostok/codeowners-validator@v0.7.1 25 | if: github.event.pull_request.head.repo.full_name != github.repository 26 | name: "Syntax check of CODEOWNERS" 27 | with: 28 | checks: "syntax,duppatterns" 29 | owner_checker_allow_unowned_patterns: "false" 30 | -------------------------------------------------------------------------------- /.github/CODEOWNERS: -------------------------------------------------------------------------------- 1 | # Use this file to define individuals or teams that are responsible for code in a repository. 2 | # Read more: 3 | # 4 | # Order is important: the last matching pattern has the highest precedence 5 | 6 | # These owners will be the default owners for everything 7 | * @cloudposse/engineering @cloudposse/contributors 8 | 9 | # Cloud Posse must review any changes to Makefiles 10 | **/Makefile @cloudposse/engineering 11 | **/Makefile.* @cloudposse/engineering 12 | 13 | # Cloud Posse must review any changes to GitHub actions 14 | .github/* @cloudposse/engineering 15 | 16 | # Cloud Posse must review any changes to standard context definition, 17 | # but some changes can be rubber-stamped. 18 | **/*.tf @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers 19 | README.yaml @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers 20 | README.md @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers 21 | docs/*.md @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers 22 | 23 | # Cloud Posse Admins must review all changes to CODEOWNERS or the mergify configuration 24 | .github/mergify.yml @cloudposse/admins 25 | .github/CODEOWNERS @cloudposse/admins 26 | -------------------------------------------------------------------------------- /test/Makefile: -------------------------------------------------------------------------------- 1 | TEST_HARNESS ?= https://github.com/cloudposse/test-harness.git 2 | TEST_HARNESS_BRANCH ?= master 3 | TEST_HARNESS_PATH = $(realpath .test-harness) 4 | BATS_ARGS ?= --tap 5 | BATS_LOG ?= test.log 6 | 7 | # Define a macro to run the tests 8 | define RUN_TESTS 9 | @echo "Running tests in $(1)" 10 | @cd $(1) && bats $(BATS_ARGS) $(addsuffix .bats,$(addprefix $(TEST_HARNESS_PATH)/test/terraform/,$(TESTS))) 11 | endef 12 | 13 | default: all 14 | 15 | -include Makefile.* 16 | 17 | ## Provision the test-harnesss 18 | .test-harness: 19 | [ -d $@ ] || git clone --depth=1 -b $(TEST_HARNESS_BRANCH) $(TEST_HARNESS) $@ 20 | 21 | ## Initialize the tests 22 | init: .test-harness 23 | 24 | ## Install all dependencies (OS specific) 25 | deps:: 26 | @exit 0 27 | 28 | ## Clean up the test harness 29 | clean: 30 | [ "$(TEST_HARNESS_PATH)" == "/" ] || rm -rf $(TEST_HARNESS_PATH) 31 | 32 | ## Run all tests 33 | all: module examples/complete 34 | 35 | ## Run basic sanity checks against the module itself 36 | module: export TESTS ?= installed lint module-pinning provider-pinning validate terraform-docs input-descriptions output-descriptions 37 | module: deps 38 | $(call RUN_TESTS, ../) 39 | 40 | ## Run tests against example 41 | examples/complete: export TESTS ?= installed lint validate 42 | examples/complete: deps 43 | $(call RUN_TESTS, ../$@) 44 | -------------------------------------------------------------------------------- /examples/complete/outputs.tf: -------------------------------------------------------------------------------- 1 | output "s3_bucket_arn" { 2 | value = module.mwaa.s3_bucket_arn 3 | description = "ARN of S3 bucket" 4 | } 5 | 6 | output "arn" { 7 | value = module.mwaa.arn 8 | description = "ARN of MWAA environment" 9 | } 10 | 11 | output "logging_configuration" { 12 | value = module.mwaa.logging_configuration 13 | description = "The Logging Configuration of the MWAA Environment" 14 | } 15 | 16 | output "security_group_ids" { 17 | description = "ID of the MWAA Security Group(s)" 18 | value = module.mwaa.security_group_id 19 | } 20 | 21 | output "execution_role_arn" { 22 | description = "IAM Role ARN for Amazon MWAA Execution Role" 23 | value = module.mwaa.execution_role_arn 24 | } 25 | 26 | output "created_at" { 27 | description = "The Created At date of the Amazon MWAA Environment" 28 | value = module.mwaa.created_at 29 | } 30 | 31 | output "service_role_arn" { 32 | description = "The Service Role ARN of the Amazon MWAA Environment" 33 | value = module.mwaa.service_role_arn 34 | } 35 | 36 | output "status" { 37 | description = "The status of the Amazon MWAA Environment" 38 | value = module.mwaa.status 39 | } 40 | 41 | output "tags_all" { 42 | description = "A map of tags assigned to the resource, including those inherited from the provider for the Amazon MWAA Environment" 43 | value = module.mwaa.tags_all 44 | } 45 | 46 | output "webserver_url" { 47 | description = "The webserver URL of the Amazon MWAA Environment" 48 | value = module.mwaa.webserver_url 49 | } 50 | -------------------------------------------------------------------------------- /examples/minimal/outputs.tf: -------------------------------------------------------------------------------- 1 | output "s3_bucket_arn" { 2 | value = module.mwaa.s3_bucket_arn 3 | description = "ARN of S3 bucket." 4 | } 5 | 6 | output "arn" { 7 | value = module.mwaa.arn 8 | description = "ARN of MWAA environment" 9 | } 10 | 11 | output "logging_configuration" { 12 | value = module.mwaa.logging_configuration 13 | description = "The Logging Configuration of the MWAA Environment" 14 | } 15 | 16 | output "security_group_ids" { 17 | description = "ID of the MWAA Security Group(s)" 18 | value = module.mwaa.security_group_id 19 | } 20 | 21 | output "execution_role_arn" { 22 | description = "IAM Role ARN for Amazon MWAA Execution Role" 23 | value = module.mwaa.execution_role_arn 24 | } 25 | 26 | output "created_at" { 27 | description = "The Created At date of the Amazon MWAA Environment" 28 | value = module.mwaa.created_at 29 | } 30 | 31 | output "service_role_arn" { 32 | description = "The Service Role ARN of the Amazon MWAA Environment" 33 | value = module.mwaa.service_role_arn 34 | } 35 | 36 | output "status" { 37 | description = "The status of the Amazon MWAA Environment" 38 | value = module.mwaa.status 39 | } 40 | 41 | output "tags_all" { 42 | description = "A map of tags assigned to the resource, including those inherited from the provider for the Amazon MWAA Environment" 43 | value = module.mwaa.tags_all 44 | } 45 | 46 | output "webserver_url" { 47 | description = "The webserver URL of the Amazon MWAA Environment" 48 | value = module.mwaa.webserver_url 49 | } 50 | -------------------------------------------------------------------------------- /test/src/examples_complete_test.go: -------------------------------------------------------------------------------- 1 | package test 2 | 3 | import ( 4 | "github.com/gruntwork-io/terratest/modules/random" 5 | "github.com/gruntwork-io/terratest/modules/terraform" 6 | "github.com/stretchr/testify/assert" 7 | "strings" 8 | "testing" 9 | ) 10 | 11 | // Test the Terraform module in examples/complete using Terratest. 12 | func TestExamplesComplete(t *testing.T) { 13 | randID := strings.ToLower(random.UniqueId()) 14 | attributes := []string{randID} 15 | 16 | t.Parallel() 17 | 18 | terraformOptions := &terraform.Options{ 19 | // The path to where our Terraform code is located 20 | TerraformDir: "../../examples/complete", 21 | Upgrade: true, 22 | // Variables to pass to our Terraform code using -var-file options 23 | VarFiles: []string{"fixtures.us-east-2.tfvars"}, 24 | // We always include a random attribute so that parallel tests 25 | // and AWS resources do not interfere with each other 26 | Vars: map[string]interface{}{ 27 | "attributes": attributes, 28 | }, 29 | } 30 | 31 | // At the end of the test, run `terraform destroy` to clean up any resources that were created 32 | defer terraform.Destroy(t, terraformOptions) 33 | 34 | // This will run `terraform init` and `terraform apply` and fail the test if there are any errors 35 | terraform.InitAndApply(t, terraformOptions) 36 | 37 | // Run `terraform output` to get the value of an output variable 38 | mwaaEnvironmentARN := terraform.Output(t, terraformOptions, "arn") 39 | 40 | // Verify we're getting back the outputs we expect 41 | assert.Contains(t, mwaaEnvironmentARN, "eg-ue2-test-mwaa-test-"+randID) 42 | } -------------------------------------------------------------------------------- /examples/complete/main.tf: -------------------------------------------------------------------------------- 1 | module "vpc" { 2 | source = "cloudposse/vpc/aws" 3 | version = "2.1.0" 4 | 5 | ipv4_primary_cidr_block = "172.16.0.0/16" 6 | 7 | context = module.this.context 8 | } 9 | 10 | module "subnets" { 11 | source = "cloudposse/dynamic-subnets/aws" 12 | version = "2.4.1" 13 | 14 | availability_zones = var.availability_zones 15 | vpc_id = module.vpc.vpc_id 16 | igw_id = [module.vpc.igw_id] 17 | ipv4_cidr_block = [module.vpc.vpc_cidr_block] 18 | nat_gateway_enabled = true 19 | nat_instance_enabled = false 20 | 21 | context = module.this.context 22 | } 23 | 24 | module "mwaa" { 25 | source = "../.." 26 | 27 | region = var.region 28 | vpc_id = module.vpc.vpc_id 29 | subnet_ids = module.subnets.private_subnet_ids 30 | airflow_version = var.airflow_version 31 | dag_s3_path = var.dag_s3_path 32 | environment_class = var.environment_class 33 | min_workers = var.min_workers 34 | max_workers = var.max_workers 35 | webserver_access_mode = var.webserver_access_mode 36 | dag_processing_logs_enabled = var.dag_processing_logs_enabled 37 | dag_processing_logs_level = var.dag_processing_logs_level 38 | scheduler_logs_enabled = var.scheduler_logs_enabled 39 | scheduler_logs_level = var.scheduler_logs_level 40 | task_logs_enabled = var.task_logs_enabled 41 | task_logs_level = var.task_logs_level 42 | webserver_logs_enabled = var.webserver_logs_enabled 43 | webserver_logs_level = var.webserver_logs_level 44 | worker_logs_enabled = var.worker_logs_enabled 45 | worker_logs_level = var.worker_logs_level 46 | airflow_configuration_options = var.airflow_configuration_options 47 | 48 | context = module.this.context 49 | } 50 | -------------------------------------------------------------------------------- /outputs.tf: -------------------------------------------------------------------------------- 1 | output "s3_bucket_arn" { 2 | description = "ARN of the S3 bucket" 3 | value = local.s3_bucket_arn 4 | } 5 | 6 | output "execution_role_arn" { 7 | description = "IAM Role ARN for Amazon MWAA Execution Role" 8 | value = local.execution_role_arn 9 | } 10 | 11 | output "arn" { 12 | description = "The ARN of the Amazon MWAA Environment" 13 | value = join("", aws_mwaa_environment.default.*.arn) 14 | } 15 | 16 | output "created_at" { 17 | description = "The Created At date of the Amazon MWAA Environment" 18 | value = join("", aws_mwaa_environment.default.*.created_at) 19 | } 20 | 21 | output "logging_configuration" { 22 | description = "The Logging Configuration of the Amazon MWAA Environment" 23 | value = try(aws_mwaa_environment.default[0].logging_configuration, []) 24 | } 25 | 26 | output "service_role_arn" { 27 | description = "The Service Role ARN of the Amazon MWAA Environment" 28 | value = join("", aws_mwaa_environment.default.*.service_role_arn) 29 | } 30 | 31 | output "status" { 32 | description = "The status of the Amazon MWAA Environment" 33 | value = join("", aws_mwaa_environment.default.*.status) 34 | } 35 | 36 | output "tags_all" { 37 | description = "A map of tags assigned to the resource, including those inherited from the provider for the Amazon MWAA Environment" 38 | value = try(aws_mwaa_environment.default[0].tags_all, []) 39 | } 40 | 41 | output "webserver_url" { 42 | description = "The webserver URL of the Amazon MWAA Environment" 43 | value = join("", aws_mwaa_environment.default.*.webserver_url) 44 | } 45 | 46 | output "security_group_id" { 47 | value = join("", compact(module.mwaa_security_group.*.id)) 48 | description = "The ID of the created security group" 49 | } 50 | 51 | output "security_group_arn" { 52 | value = join("", compact(module.mwaa_security_group.*.arn)) 53 | description = "The ARN of the created security group" 54 | } 55 | 56 | output "security_group_name" { 57 | value = join("", compact(module.mwaa_security_group.*.name)) 58 | description = "The name of the created security group" 59 | } 60 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/bug_report.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: Bug report 3 | description: Create a report to help us improve 4 | labels: ["bug"] 5 | assignees: [""] 6 | body: 7 | - type: markdown 8 | attributes: 9 | value: | 10 | Found a bug? 11 | 12 | Please checkout our [Slack Community](https://slack.cloudposse.com) 13 | or visit our [Slack Archive](https://archive.sweetops.com/). 14 | 15 | [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com) 16 | 17 | - type: textarea 18 | id: concise-description 19 | attributes: 20 | label: Describe the Bug 21 | description: A clear and concise description of what the bug is. 22 | placeholder: What is the bug about? 23 | validations: 24 | required: true 25 | 26 | - type: textarea 27 | id: expected 28 | attributes: 29 | label: Expected Behavior 30 | description: A clear and concise description of what you expected. 31 | placeholder: What happened? 32 | validations: 33 | required: true 34 | 35 | - type: textarea 36 | id: reproduction-steps 37 | attributes: 38 | label: Steps to Reproduce 39 | description: Steps to reproduce the behavior. 40 | placeholder: How do we reproduce it? 41 | validations: 42 | required: true 43 | 44 | - type: textarea 45 | id: screenshots 46 | attributes: 47 | label: Screenshots 48 | description: If applicable, add screenshots or logs to help explain. 49 | validations: 50 | required: false 51 | 52 | - type: textarea 53 | id: environment 54 | attributes: 55 | label: Environment 56 | description: Anything that will help us triage the bug. 57 | placeholder: | 58 | - OS: [e.g. Linux, OSX, WSL, etc] 59 | - Version [e.g. 10.15] 60 | - Module version 61 | - Terraform version 62 | validations: 63 | required: false 64 | 65 | - type: textarea 66 | id: additional 67 | attributes: 68 | label: Additional Context 69 | description: | 70 | Add any other context about the problem here. 71 | validations: 72 | required: false 73 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/feature_request.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: Feature Request 3 | description: Suggest an idea for this project 4 | labels: ["feature request"] 5 | assignees: [""] 6 | body: 7 | - type: markdown 8 | attributes: 9 | value: | 10 | Have a question? 11 | 12 | Please checkout our [Slack Community](https://slack.cloudposse.com) 13 | or visit our [Slack Archive](https://archive.sweetops.com/). 14 | 15 | [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com) 16 | 17 | - type: textarea 18 | id: concise-description 19 | attributes: 20 | label: Describe the Feature 21 | description: A clear and concise description of what the feature is. 22 | placeholder: What is the feature about? 23 | validations: 24 | required: true 25 | 26 | - type: textarea 27 | id: expected 28 | attributes: 29 | label: Expected Behavior 30 | description: A clear and concise description of what you expected. 31 | placeholder: What happened? 32 | validations: 33 | required: true 34 | 35 | - type: textarea 36 | id: use-case 37 | attributes: 38 | label: Use Case 39 | description: | 40 | Is your feature request related to a problem/challenge you are trying 41 | to solve? 42 | 43 | Please provide some additional context of why this feature or 44 | capability will be valuable. 45 | validations: 46 | required: true 47 | 48 | - type: textarea 49 | id: ideal-solution 50 | attributes: 51 | label: Describe Ideal Solution 52 | description: A clear and concise description of what you want to happen. 53 | validations: 54 | required: true 55 | 56 | - type: textarea 57 | id: alternatives-considered 58 | attributes: 59 | label: Alternatives Considered 60 | description: Explain alternative solutions or features considered. 61 | validations: 62 | required: false 63 | 64 | - type: textarea 65 | id: additional 66 | attributes: 67 | label: Additional Context 68 | description: | 69 | Add any other context about the problem here. 70 | validations: 71 | required: false 72 | -------------------------------------------------------------------------------- /.github/workflows/auto-context.yml: -------------------------------------------------------------------------------- 1 | name: "auto-context" 2 | on: 3 | schedule: 4 | # Update context.tf nightly 5 | - cron: '0 3 * * *' 6 | 7 | jobs: 8 | update: 9 | if: github.event_name == 'schedule' 10 | runs-on: ubuntu-latest 11 | steps: 12 | - uses: actions/checkout@v2 13 | 14 | - name: Update context.tf 15 | shell: bash 16 | id: update 17 | env: 18 | GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" 19 | run: | 20 | if [[ -f context.tf ]]; then 21 | echo "Discovered existing context.tf! Fetching most recent version to see if there is an update." 22 | curl -o context.tf -fsSL https://raw.githubusercontent.com/cloudposse/terraform-null-label/master/exports/context.tf 23 | if git diff --no-patch --exit-code context.tf; then 24 | echo "No changes detected! Exiting the job..." 25 | else 26 | echo "context.tf file has changed. Update examples and rebuild README.md." 27 | make init 28 | make github/init/context.tf 29 | make readme/build 30 | echo "::set-output name=create_pull_request::true" 31 | fi 32 | else 33 | echo "This module has not yet been updated to support the context.tf pattern! Please update in order to support automatic updates." 34 | fi 35 | 36 | - name: Create Pull Request 37 | if: steps.update.outputs.create_pull_request == 'true' 38 | uses: cloudposse/actions/github/create-pull-request@0.30.0 39 | with: 40 | token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }} 41 | committer: 'cloudpossebot <11232728+cloudpossebot@users.noreply.github.com>' 42 | author: 'cloudpossebot <11232728+cloudpossebot@users.noreply.github.com>' 43 | commit-message: Update context.tf from origin source 44 | title: Update context.tf 45 | body: |- 46 | ## what 47 | This is an auto-generated PR that updates the `context.tf` file to the latest version from `cloudposse/terraform-null-label` 48 | 49 | ## why 50 | To support all the features of the `context` interface. 51 | 52 | branch: auto-update/context.tf 53 | base: master 54 | delete-branch: true 55 | labels: | 56 | auto-update 57 | context 58 | -------------------------------------------------------------------------------- /.github/workflows/auto-readme.yml: -------------------------------------------------------------------------------- 1 | name: "auto-readme" 2 | on: 3 | workflow_dispatch: 4 | 5 | schedule: 6 | # Example of job definition: 7 | # .---------------- minute (0 - 59) 8 | # | .------------- hour (0 - 23) 9 | # | | .---------- day of month (1 - 31) 10 | # | | | .------- month (1 - 12) OR jan,feb,mar,apr ... 11 | # | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat 12 | # | | | | | 13 | # * * * * * user-name command to be executed 14 | 15 | # Update README.md nightly at 4am UTC 16 | - cron: '0 4 * * *' 17 | 18 | jobs: 19 | update: 20 | if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' 21 | runs-on: ubuntu-latest 22 | steps: 23 | - uses: actions/checkout@v2 24 | 25 | - name: Find default branch name 26 | id: defaultBranch 27 | shell: bash 28 | env: 29 | GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" 30 | run: | 31 | default_branch=$(gh repo view --json defaultBranchRef --jq .defaultBranchRef.name) 32 | printf "::set-output name=defaultBranch::%s\n" "${default_branch}" 33 | printf "defaultBranchRef.name=%s\n" "${default_branch}" 34 | 35 | - name: Update readme 36 | shell: bash 37 | id: update 38 | env: 39 | GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" 40 | DEF: "${{ steps.defaultBranch.outputs.defaultBranch }}" 41 | run: | 42 | make init 43 | make readme/build 44 | # Ignore changes if they are only whitespace 45 | if ! git diff --quiet README.md && git diff --ignore-all-space --ignore-blank-lines --quiet README.md; then 46 | git restore README.md 47 | echo Ignoring whitespace-only changes in README 48 | fi 49 | 50 | - name: Create Pull Request 51 | # This action will not create or change a pull request if there are no changes to make. 52 | # If a PR of the auto-update/readme branch is open, this action will just update it, not create a new PR. 53 | uses: cloudposse/actions/github/create-pull-request@0.30.0 54 | with: 55 | token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }} 56 | commit-message: Update README.md and docs 57 | title: Update README.md and docs 58 | body: |- 59 | ## what 60 | This is an auto-generated PR that updates the README.md and docs 61 | 62 | ## why 63 | To have most recent changes of README.md and doc from origin templates 64 | 65 | branch: auto-update/readme 66 | base: ${{ steps.defaultBranch.outputs.defaultBranch }} 67 | delete-branch: true 68 | labels: | 69 | auto-update 70 | no-release 71 | readme 72 | -------------------------------------------------------------------------------- /test/src/go.mod: -------------------------------------------------------------------------------- 1 | module github.com/cloudposse/terraform-example-module 2 | 3 | go 1.24 4 | 5 | toolchain go1.24.0 6 | 7 | require ( 8 | github.com/gruntwork-io/terratest v0.38.5 9 | github.com/stretchr/testify v1.7.0 10 | ) 11 | 12 | require ( 13 | cloud.google.com/go v0.83.0 // indirect 14 | cloud.google.com/go/storage v1.10.0 // indirect 15 | github.com/agext/levenshtein v1.2.3 // indirect 16 | github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect 17 | github.com/aws/aws-sdk-go v1.40.56 // indirect 18 | github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect 19 | github.com/davecgh/go-spew v1.1.1 // indirect 20 | github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e // indirect 21 | github.com/golang/protobuf v1.5.2 // indirect 22 | github.com/golang/snappy v0.0.3 // indirect 23 | github.com/googleapis/gax-go/v2 v2.0.5 // indirect 24 | github.com/hashicorp/errwrap v1.0.0 // indirect 25 | github.com/hashicorp/go-cleanhttp v0.5.2 // indirect 26 | github.com/hashicorp/go-getter v1.5.9 // indirect 27 | github.com/hashicorp/go-multierror v1.1.0 // indirect 28 | github.com/hashicorp/go-safetemp v1.0.0 // indirect 29 | github.com/hashicorp/go-version v1.3.0 // indirect 30 | github.com/hashicorp/hcl/v2 v2.9.1 // indirect 31 | github.com/hashicorp/terraform-json v0.12.0 // indirect 32 | github.com/jinzhu/copier v0.0.0-20190924061706-b57f9002281a // indirect 33 | github.com/jmespath/go-jmespath v0.4.0 // indirect 34 | github.com/jstemmer/go-junit-report v0.9.1 // indirect 35 | github.com/klauspost/compress v1.13.0 // indirect 36 | github.com/mattn/go-zglob v0.0.2-0.20190814121620-e3c945676326 // indirect 37 | github.com/mitchellh/go-homedir v1.1.0 // indirect 38 | github.com/mitchellh/go-testing-interface v1.0.0 // indirect 39 | github.com/mitchellh/go-wordwrap v1.0.1 // indirect 40 | github.com/pmezard/go-difflib v1.0.0 // indirect 41 | github.com/tmccombs/hcl2json v0.3.3 // indirect 42 | github.com/ulikunitz/xz v0.5.8 // indirect 43 | github.com/zclconf/go-cty v1.8.1 // indirect 44 | go.opencensus.io v0.23.0 // indirect 45 | golang.org/x/crypto v0.0.0-20210513164829-c07d793c2f9a // indirect 46 | golang.org/x/lint v0.0.0-20210508222113-6edffad5e616 // indirect 47 | golang.org/x/mod v0.4.2 // indirect 48 | golang.org/x/net v0.0.0-20210614182718-04defd469f4e // indirect 49 | golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c // indirect 50 | golang.org/x/sys v0.0.0-20210603125802-9665404d3644 // indirect 51 | golang.org/x/text v0.3.6 // indirect 52 | golang.org/x/tools v0.1.2 // indirect 53 | golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect 54 | google.golang.org/api v0.47.0 // indirect 55 | google.golang.org/appengine v1.6.7 // indirect 56 | google.golang.org/genproto v0.0.0-20210602131652-f16073e35f0c // indirect 57 | google.golang.org/grpc v1.38.0 // indirect 58 | google.golang.org/protobuf v1.26.0 // indirect 59 | gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect 60 | ) 61 | -------------------------------------------------------------------------------- /examples/complete/variables.tf: -------------------------------------------------------------------------------- 1 | variable "availability_zones" { 2 | type = list(string) 3 | description = "List of availability zones for VPC subnets" 4 | } 5 | 6 | variable "region" { 7 | type = string 8 | description = "AWS region" 9 | } 10 | 11 | variable "webserver_access_mode" { 12 | type = string 13 | description = "Specifies whether the webserver should be accessible over the internet or via your specified VPC. Possible options: PRIVATE_ONLY (default) and PUBLIC_ONLY." 14 | } 15 | 16 | variable "airflow_configuration_options" { 17 | description = "Airflow override options" 18 | type = any 19 | } 20 | 21 | variable "airflow_version" { 22 | type = string 23 | description = "Airflow version of the MWAA environment, will be set by default to the latest version that MWAA supports." 24 | } 25 | 26 | variable "dag_s3_path" { 27 | type = string 28 | description = "The relative path to the DAG folder on your Amazon S3 storage bucket." 29 | } 30 | 31 | variable "environment_class" { 32 | type = string 33 | description = "Environment class for the cluster. Possible options are mw1.small, mw1.medium, mw1.large." 34 | } 35 | 36 | variable "dag_processing_logs_enabled" { 37 | type = bool 38 | description = "Enabling or disabling the collection of logs for processing DAGs" 39 | default = false 40 | } 41 | 42 | variable "dag_processing_logs_level" { 43 | type = string 44 | description = "DAG processing logging level. Valid values: CRITICAL, ERROR, WARNING, INFO, DEBUG" 45 | default = "INFO" 46 | } 47 | 48 | variable "scheduler_logs_enabled" { 49 | type = bool 50 | description = "Enabling or disabling the collection of logs for the schedulers" 51 | default = false 52 | } 53 | 54 | variable "scheduler_logs_level" { 55 | type = string 56 | description = "Schedulers logging level. Valid values: CRITICAL, ERROR, WARNING, INFO, DEBUG" 57 | default = "INFO" 58 | } 59 | 60 | variable "task_logs_enabled" { 61 | type = bool 62 | description = "Enabling or disabling the collection of logs for DAG tasks" 63 | default = false 64 | } 65 | 66 | variable "task_logs_level" { 67 | type = string 68 | description = "DAG tasks logging level. Valid values: CRITICAL, ERROR, WARNING, INFO, DEBUG" 69 | default = "INFO" 70 | } 71 | 72 | variable "webserver_logs_enabled" { 73 | type = bool 74 | description = "Enabling or disabling the collection of logs for the webservers" 75 | default = false 76 | } 77 | 78 | variable "webserver_logs_level" { 79 | type = string 80 | description = "Webserver logging level. Valid values: CRITICAL, ERROR, WARNING, INFO, DEBUG" 81 | default = "INFO" 82 | } 83 | 84 | variable "worker_logs_enabled" { 85 | type = bool 86 | description = "Enabling or disabling the collection of logs for the workers" 87 | default = false 88 | } 89 | 90 | variable "worker_logs_level" { 91 | type = string 92 | description = "Workers logging level. Valid values: CRITICAL, ERROR, WARNING, INFO, DEBUG" 93 | default = "INFO" 94 | } 95 | 96 | variable "max_workers" { 97 | type = number 98 | description = "The maximum number of workers that can be automatically scaled up. Value needs to be between 1 and 25" 99 | default = 10 100 | } 101 | 102 | variable "min_workers" { 103 | type = number 104 | description = "The minimum number of workers that you want to run in your environment." 105 | default = 1 106 | } 107 | -------------------------------------------------------------------------------- /security-group-variables.tf: -------------------------------------------------------------------------------- 1 | # security-group-variables Version: 2 2 | 3 | variable "create_security_group" { 4 | type = bool 5 | default = true 6 | description = "Set `true` to create and configure a new security group. If false, `associated_security_group_ids` must be provided." 7 | } 8 | 9 | variable "associated_security_group_ids" { 10 | type = list(string) 11 | default = [] 12 | description = <<-EOT 13 | A list of IDs of Security Groups to associate the created resource with, in addition to the created security group. 14 | These security groups will not be modified and, if `create_security_group` is `false`, must have rules providing the desired access. 15 | EOT 16 | } 17 | 18 | variable "allowed_security_group_ids" { 19 | type = list(string) 20 | default = [] 21 | description = <<-EOT 22 | A list of IDs of Security Groups to allow access to the security group created by this module. 23 | The length of this list must be known at "plan" time. 24 | EOT 25 | } 26 | 27 | variable "allowed_cidr_blocks" { 28 | type = list(string) 29 | default = [] 30 | description = <<-EOT 31 | A list of IPv4 CIDRs to allow access to the security group created by this module. 32 | The length of this list must be known at "plan" time. 33 | EOT 34 | } 35 | 36 | variable "security_group_name" { 37 | type = list(string) 38 | default = [] 39 | description = <<-EOT 40 | The name to assign to the created security group. Must be unique within the VPC. 41 | If not provided, will be derived from the `null-label.context` passed in. 42 | If `create_before_destroy` is true, will be used as a name prefix. 43 | EOT 44 | } 45 | 46 | variable "security_group_description" { 47 | type = string 48 | default = "Managed by Terraform" 49 | description = "Security Group for AWS MWAA" 50 | } 51 | 52 | variable "security_group_create_before_destroy" { 53 | type = bool 54 | default = true 55 | description = <<-EOT 56 | Set `true` to enable Terraform `create_before_destroy` behavior on the created security group. 57 | We only recommend setting this `false` if you are upgrading this module and need to keep 58 | the existing security group from being replaced. 59 | Note that changing this value will always cause the security group to be replaced. 60 | EOT 61 | } 62 | 63 | variable "security_group_create_timeout" { 64 | type = string 65 | default = "10m" 66 | description = "How long to wait for the security group to be created." 67 | } 68 | 69 | variable "security_group_delete_timeout" { 70 | type = string 71 | default = "15m" 72 | description = <<-EOT 73 | How long to retry on `DependencyViolation` errors during security group deletion from 74 | lingering ENIs left by certain AWS services such as Elastic Load Balancing. 75 | EOT 76 | } 77 | 78 | variable "allow_all_egress" { 79 | type = bool 80 | default = true 81 | description = <<-EOT 82 | If `true`, the created security group will allow egress on all ports and protocols to all IP addresses. 83 | If this is false and no egress rules are otherwise specified, then no egress will be allowed. 84 | EOT 85 | } 86 | 87 | variable "additional_security_group_rules" { 88 | type = list(any) 89 | default = [] 90 | description = <<-EOT 91 | A list of Security Group rule objects to add to the created security group, in addition to the ones 92 | this module normally creates. (To suppress the module's rules, set `create_security_group` to false 93 | and supply your own security group(s) via `associated_security_group_ids`.) 94 | The keys and values of the objects are fully compatible with the `aws_security_group_rule` resource, except 95 | for `security_group_id` which will be ignored, and the optional "key" which, if provided, must be unique and known at "plan" time. 96 | For more info see https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule 97 | and https://github.com/cloudposse/terraform-aws-security-group. 98 | EOT 99 | } 100 | 101 | variable "vpc_id" { 102 | type = string 103 | description = "The ID of the VPC where the Security Group will be created." 104 | } 105 | 106 | -------------------------------------------------------------------------------- /README.yaml: -------------------------------------------------------------------------------- 1 | # 2 | # This is the canonical configuration for the `README.md` 3 | # Run `make readme` to rebuild the `README.md` 4 | # 5 | 6 | # Name of this project 7 | name: terraform-aws-mwaa 8 | 9 | # Logo for this project 10 | #logo: docs/logo.png 11 | 12 | # License of this project 13 | license: "APACHE2" 14 | 15 | # Copyrights 16 | copyrights: 17 | - name: "Cloud Posse, LLC" 18 | url: "https://cloudposse.com" 19 | year: "2022" 20 | 21 | # Canonical GitHub repo 22 | github_repo: cloudposse/terraform-aws-mwaa 23 | 24 | # Badges to display 25 | badges: 26 | - name: Latest Release 27 | image: https://img.shields.io/github/release/cloudposse/terraform-aws-mwaa.svg?style=for-the-badge 28 | url: https://github.com/cloudposse/terraform-aws-mwaa/releases/latest 29 | - name: Last Updated 30 | image: https://img.shields.io/github/last-commit/cloudposse/terraform-aws-mwaa.svg?style=for-the-badge 31 | url: https://github.com/cloudposse/terraform-aws-mwaa/commits 32 | - name: Slack Community 33 | image: https://slack.cloudposse.com/for-the-badge.svg 34 | url: https://cloudposse.com/slack 35 | 36 | # List any related terraform modules that this module may be used with or that this module depends on. 37 | related: 38 | - name: "terraform-null-label" 39 | description: "Terraform module designed to generate consistent names and tags for resources. Use terraform-null-label to implement a strict naming convention." 40 | url: "https://github.com/cloudposse/terraform-null-label" 41 | 42 | # List any resources helpful for someone to get started. For example, link to the hashicorp documentation or AWS documentation. 43 | references: 44 | - name: "Terraform Standard Module Structure" 45 | description: "HashiCorp's standard module structure is a file and directory layout we recommend for reusable modules distributed in separate repositories." 46 | url: "https://www.terraform.io/docs/modules/index.html#standard-module-structure" 47 | - name: "Terraform Module Requirements" 48 | description: "HashiCorp's guidance on all the requirements for publishing a module. Meeting the requirements for publishing a module is extremely easy." 49 | url: "https://www.terraform.io/docs/registry/modules/publish.html#requirements" 50 | - name: "Terraform `random_integer` Resource" 51 | description: "The resource random_integer generates random values from a given range, described by the min and max attributes of a given resource." 52 | url: "https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/integer" 53 | - name: "Terraform Version Pinning" 54 | description: "The required_version setting can be used to constrain which versions of the Terraform CLI can be used with your configuration" 55 | url: "https://www.terraform.io/docs/configuration/terraform.html#specifying-a-required-terraform-version" 56 | 57 | # Short description of this project 58 | description: |- 59 | Terraform module to provision Amazon Managed Workflows for Apache Airflow 60 | 61 | # Introduction to the project 62 | #introduction: |- 63 | # This is an introduction. 64 | 65 | # How to use this module. Should be an easy example to copy and paste. 66 | usage: |- 67 | For a complete example, see [examples/complete](examples/complete). 68 | 69 | For automated tests of the complete example using [bats](https://github.com/bats-core/bats-core) and [Terratest](https://github.com/gruntwork-io/terratest) 70 | (which tests and deploys the example on AWS), see [test](test). 71 | 72 | ```hcl 73 | module "mwaa" { 74 | source = "cloudposse/mwaa/aws" 75 | # Cloud Posse recommends pinning every module to a specific version 76 | # version = "x.x.x" 77 | vpc_id = var.vpc_id 78 | subnet_ids = var.subnet_ids 79 | airflow_version = "2.0.2" 80 | dag_s3_path = "dags" 81 | environment_class = "mw1.small" 82 | min_workers = 1 83 | max_workers = 10 84 | webserver_access_mode = "PRIVATE_ONLY" 85 | dag_processing_logs_enabled = true 86 | dag_processing_logs_level = "INFO" 87 | name = "app" 88 | stage = "test" 89 | namespace = "eg" 90 | enabled = true 91 | } 92 | ``` 93 | 94 | # Example usage 95 | examples: |- 96 | Here is an example of using this module: 97 | - [`examples/complete`](https://github.com/cloudposse/terraform-aws-mwaa/) - complete example of using this module 98 | 99 | # How to get started quickly 100 | #quickstart: |- 101 | # Here's how to get started... 102 | 103 | # Other files to include in this README from the project folder 104 | include: [] 105 | contributors: [] 106 | -------------------------------------------------------------------------------- /variables.tf: -------------------------------------------------------------------------------- 1 | variable "region" { 2 | type = string 3 | description = "AWS region" 4 | } 5 | 6 | variable "create_s3_bucket" { 7 | type = bool 8 | description = "Enabling or disabling the creatation of an S3 bucket for AWS MWAA" 9 | default = true 10 | } 11 | 12 | variable "create_iam_role" { 13 | type = bool 14 | description = "Enabling or disabling the creatation of a default IAM Role for AWS MWAA" 15 | default = true 16 | } 17 | 18 | variable "additionals_managed_policy_arns" { 19 | type = list(any) 20 | description = "List of managed policies to attach to the MWAA IAM role" 21 | default = [] 22 | } 23 | 24 | variable "additionals_policy_documents" { 25 | type = list(any) 26 | description = "List of JSON IAM policy documents to attach to the MWAA IAM role" 27 | default = [] 28 | } 29 | 30 | variable "source_bucket_arn" { 31 | type = string 32 | description = "If `create_s3_bucket` is `false` then set this to the Amazon Resource Name (ARN) of your Amazon S3 storage bucket." 33 | default = null 34 | } 35 | 36 | variable "execution_role_arn" { 37 | type = string 38 | default = "" 39 | description = "If `create_iam_role` is `false` then set this to the target MWAA execution role" 40 | } 41 | 42 | variable "airflow_configuration_options" { 43 | description = "The Airflow override options" 44 | type = any 45 | default = null 46 | } 47 | 48 | variable "airflow_version" { 49 | type = string 50 | description = "Airflow version of the MWAA environment, will be set by default to the latest version that MWAA supports." 51 | default = "" 52 | } 53 | 54 | variable "dag_s3_path" { 55 | type = string 56 | description = "The relative path to the DAG folder on your Amazon S3 storage bucket." 57 | default = "dags" 58 | } 59 | 60 | variable "environment_class" { 61 | type = string 62 | description = "Environment class for the cluster. Possible options are mw1.small, mw1.medium, mw1.large." 63 | default = "mw1.small" 64 | } 65 | 66 | variable "kms_key" { 67 | type = string 68 | description = "The Amazon Resource Name (ARN) of your KMS key that you want to use for encryption. Will be set to the ARN of the managed KMS key aws/airflow by default." 69 | default = null 70 | } 71 | 72 | variable "max_workers" { 73 | type = number 74 | description = "The maximum number of workers that can be automatically scaled up. Value need to be between 1 and 25." 75 | default = 10 76 | } 77 | 78 | variable "min_workers" { 79 | type = number 80 | description = "The minimum number of workers that you want to run in your environment." 81 | default = 1 82 | } 83 | 84 | variable "max_webservers" { 85 | type = number 86 | description = "The maximum number of web servers that you want to run in your environment." 87 | default = 2 88 | } 89 | 90 | variable "min_webservers" { 91 | type = number 92 | description = "The minimum number of web servers that you want to run in your environment." 93 | default = 2 94 | } 95 | 96 | variable "schedulers" { 97 | type = number 98 | description = "The number of schedulers that you want to run in your environment." 99 | default = 2 100 | } 101 | 102 | variable "plugins_s3_object_version" { 103 | type = string 104 | description = "The plugins.zip file version you want to use." 105 | default = null 106 | } 107 | 108 | variable "plugins_s3_path" { 109 | type = string 110 | description = "The relative path to the plugins.zip file on your Amazon S3 storage bucket. For example, plugins.zip. If a relative path is provided in the request, then plugins_s3_object_version is required" 111 | default = null 112 | } 113 | 114 | variable "requirements_s3_object_version" { 115 | type = string 116 | description = "The requirements.txt file version you" 117 | default = null 118 | } 119 | 120 | variable "requirements_s3_path" { 121 | type = string 122 | description = "The relative path to the requirements.txt file on your Amazon S3 storage bucket. For example, requirements.txt. If a relative path is provided in the request, then requirements_s3_object_version is required" 123 | default = null 124 | } 125 | 126 | variable "webserver_access_mode" { 127 | type = string 128 | description = "Specifies whether the webserver should be accessible over the internet or via your specified VPC. Possible options: PRIVATE_ONLY (default) and PUBLIC_ONLY." 129 | default = "PRIVATE_ONLY" 130 | } 131 | 132 | variable "weekly_maintenance_window_start" { 133 | type = string 134 | description = "Specifies the start date for the weekly maintenance window." 135 | default = null 136 | } 137 | 138 | variable "dag_processing_logs_enabled" { 139 | type = bool 140 | description = "Enabling or disabling the collection of logs for processing DAGs" 141 | default = false 142 | } 143 | 144 | variable "dag_processing_logs_level" { 145 | type = string 146 | description = "DAG processing logging level. Valid values: CRITICAL, ERROR, WARNING, INFO, DEBUG" 147 | default = "INFO" 148 | } 149 | 150 | variable "scheduler_logs_enabled" { 151 | type = bool 152 | description = "Enabling or disabling the collection of logs for the schedulers" 153 | default = false 154 | } 155 | 156 | variable "scheduler_logs_level" { 157 | type = string 158 | description = "Schedulers logging level. Valid values: CRITICAL, ERROR, WARNING, INFO, DEBUG" 159 | default = "INFO" 160 | } 161 | 162 | variable "task_logs_enabled" { 163 | type = bool 164 | description = "Enabling or disabling the collection of logs for DAG tasks" 165 | default = false 166 | } 167 | 168 | variable "task_logs_level" { 169 | type = string 170 | description = "DAG tasks logging level. Valid values: CRITICAL, ERROR, WARNING, INFO, DEBUG" 171 | default = "INFO" 172 | } 173 | 174 | variable "webserver_logs_enabled" { 175 | type = bool 176 | description = "Enabling or disabling the collection of logs for the webservers" 177 | default = false 178 | } 179 | 180 | variable "webserver_logs_level" { 181 | type = string 182 | description = "Webserver logging level. Valid values: CRITICAL, ERROR, WARNING, INFO, DEBUG" 183 | default = "INFO" 184 | } 185 | 186 | variable "worker_logs_enabled" { 187 | type = bool 188 | description = "Enabling or disabling the collection of logs for the workers" 189 | default = false 190 | } 191 | 192 | variable "worker_logs_level" { 193 | type = string 194 | description = "Workers logging level. Valid values: CRITICAL, ERROR, WARNING, INFO, DEBUG" 195 | default = "INFO" 196 | } 197 | 198 | variable "subnet_ids" { 199 | type = list(string) 200 | description = "The private subnet IDs in which the environment should be created. MWAA requires two subnets" 201 | } 202 | 203 | variable "startup_script_s3_path" { 204 | type = string 205 | description = "The relative path to the script hosted in your bucket. The script runs as your environment starts before starting the Apache Airflow process." 206 | default = null 207 | } 208 | 209 | variable "startup_script_s3_object_version" { 210 | type = string 211 | description = "The version of the startup shell script you want to use. You must specify the version ID that Amazon S3 assigns to the file every time you update the script." 212 | default = null 213 | } 214 | -------------------------------------------------------------------------------- /main.tf: -------------------------------------------------------------------------------- 1 | data "aws_caller_identity" "current" {} 2 | data "aws_partition" "current" {} 3 | 4 | locals { 5 | enabled = module.this.enabled 6 | 7 | security_group_enabled = local.enabled && var.create_security_group 8 | s3_bucket_enabled = local.enabled && var.create_s3_bucket 9 | iam_role_enabled = local.enabled && var.create_iam_role 10 | account_id = data.aws_caller_identity.current.account_id 11 | partition = data.aws_partition.current.partition 12 | security_group_ids = var.create_security_group ? concat(var.associated_security_group_ids, [module.mwaa_security_group.id]) : var.associated_security_group_ids 13 | s3_bucket_arn = var.create_s3_bucket ? module.mwaa_s3_bucket.bucket_arn : var.source_bucket_arn 14 | execution_role_arn = var.create_iam_role ? module.mwaa_iam_role.arn : var.execution_role_arn 15 | iam_policy_documents = concat( 16 | var.additionals_policy_documents, 17 | [data.aws_iam_policy_document.this.json] 18 | ) 19 | } 20 | 21 | module "s3_label" { 22 | source = "cloudposse/label/null" 23 | version = "0.25.0" 24 | 25 | enabled = local.s3_bucket_enabled 26 | attributes = ["s3"] 27 | 28 | context = module.this.context 29 | } 30 | 31 | module "sg_label" { 32 | source = "cloudposse/label/null" 33 | version = "0.25.0" 34 | 35 | enabled = local.security_group_enabled 36 | attributes = ["sg"] 37 | 38 | context = module.this.context 39 | } 40 | 41 | module "iam_label" { 42 | source = "cloudposse/label/null" 43 | version = "0.25.0" 44 | 45 | enabled = local.iam_role_enabled 46 | attributes = ["iam"] 47 | 48 | context = module.this.context 49 | } 50 | 51 | data "aws_iam_policy_document" "this" { 52 | statement { 53 | actions = ["airflow:PublishMetrics"] 54 | effect = "Allow" 55 | resources = ["arn:${local.partition}:airflow:${var.region}:${local.account_id}:environment/${module.this.id}"] 56 | } 57 | 58 | statement { 59 | actions = ["s3:ListAllMyBuckets"] 60 | effect = "Deny" 61 | resources = [ 62 | local.s3_bucket_arn, 63 | "${local.s3_bucket_arn}/*" 64 | ] 65 | } 66 | 67 | statement { 68 | actions = [ 69 | "s3:GetObject*", 70 | "s3:GetBucket*", 71 | "s3:List*" 72 | ] 73 | effect = "Allow" 74 | resources = [ 75 | local.s3_bucket_arn, 76 | "${local.s3_bucket_arn}/*" 77 | ] 78 | } 79 | 80 | statement { 81 | actions = [ 82 | "logs:CreateLogStream", 83 | "logs:CreateLogGroup", 84 | "logs:PutLogEvents", 85 | "logs:GetLogEvents", 86 | "logs:GetLogRecord", 87 | "logs:GetLogGroupFields", 88 | "logs:GetQueryResults" 89 | ] 90 | effect = "Allow" 91 | resources = ["arn:${local.partition}:logs:${var.region}:${local.account_id}:log-group:airflow-${module.this.id}-*"] 92 | } 93 | 94 | statement { 95 | actions = ["logs:DescribeLogGroups"] 96 | effect = "Allow" 97 | resources = ["*"] 98 | } 99 | 100 | statement { 101 | actions = ["s3:GetAccountPublicAccessBlock"] 102 | effect = "Allow" 103 | resources = ["*"] 104 | } 105 | 106 | statement { 107 | actions = ["cloudwatch:PutMetricData"] 108 | effect = "Allow" 109 | resources = ["*"] 110 | } 111 | 112 | statement { 113 | actions = [ 114 | "sqs:ChangeMessageVisibility", 115 | "sqs:DeleteMessage", 116 | "sqs:GetQueueAttributes", 117 | "sqs:GetQueueUrl", 118 | "sqs:ReceiveMessage", 119 | "sqs:SendMessage" 120 | ] 121 | effect = "Allow" 122 | resources = ["arn:${local.partition}:sqs:${var.region}:*:airflow-celery-*"] 123 | } 124 | 125 | statement { 126 | actions = [ 127 | "kms:Decrypt", 128 | "kms:DescribeKey", 129 | "kms:GenerateDataKey*", 130 | "kms:Encrypt" 131 | ] 132 | effect = "Allow" 133 | not_resources = ["arn:${local.partition}:kms:*:${local.account_id}:key/*"] 134 | condition { 135 | test = "StringLike" 136 | variable = "kms:ViaService" 137 | values = [ 138 | "sqs.${var.region}.amazonaws.com", 139 | "s3.${var.region}.amazonaws.com" 140 | ] 141 | } 142 | } 143 | } 144 | 145 | module "mwaa_security_group" { 146 | source = "cloudposse/security-group/aws" 147 | version = "1.0.1" 148 | 149 | enabled = local.security_group_enabled 150 | security_group_name = var.security_group_name 151 | create_before_destroy = var.security_group_create_before_destroy 152 | security_group_create_timeout = var.security_group_create_timeout 153 | security_group_delete_timeout = var.security_group_delete_timeout 154 | 155 | security_group_description = var.security_group_description 156 | allow_all_egress = var.allow_all_egress 157 | rules = var.additional_security_group_rules 158 | rule_matrix = [ 159 | { 160 | source_security_group_ids = var.allowed_security_group_ids 161 | cidr_blocks = var.allowed_cidr_blocks 162 | self = true 163 | rules = [ 164 | { 165 | key = "mwaa" 166 | type = "ingress" 167 | from_port = 0 168 | to_port = 0 169 | protocol = -1 170 | self = true 171 | description = "Allow ingress Amazon MWAA traffic" 172 | }, 173 | ] 174 | } 175 | ] 176 | vpc_id = var.vpc_id 177 | 178 | context = module.sg_label.context 179 | } 180 | 181 | module "mwaa_s3_bucket" { 182 | source = "cloudposse/s3-bucket/aws" 183 | version = "4.0.0" 184 | 185 | enabled = local.s3_bucket_enabled 186 | 187 | context = module.s3_label.context 188 | } 189 | 190 | module "mwaa_iam_role" { 191 | source = "cloudposse/iam-role/aws" 192 | version = "0.20.0" 193 | 194 | enabled = local.iam_role_enabled 195 | principals = { 196 | "Service" = [ 197 | "airflow-env.amazonaws.com", 198 | "airflow.amazonaws.com" 199 | ] 200 | } 201 | 202 | use_fullname = true 203 | 204 | policy_documents = local.iam_policy_documents 205 | 206 | policy_document_count = length(local.iam_policy_documents) 207 | policy_description = "AWS MWAA IAM policy" 208 | role_description = "AWS MWAA IAM role" 209 | 210 | managed_policy_arns = var.additionals_managed_policy_arns 211 | 212 | context = module.iam_label.context 213 | } 214 | 215 | resource "aws_mwaa_environment" "default" { 216 | count = local.enabled ? 1 : 0 217 | 218 | name = module.this.id 219 | airflow_configuration_options = var.airflow_configuration_options 220 | airflow_version = var.airflow_version 221 | dag_s3_path = var.dag_s3_path 222 | environment_class = var.environment_class 223 | kms_key = var.kms_key 224 | max_workers = var.max_workers 225 | min_workers = var.min_workers 226 | min_webservers = var.environment_class == "mw1.micro" ? 1 : var.min_webservers 227 | max_webservers = var.environment_class == "mw1.micro" ? 1 : var.max_webservers 228 | schedulers = var.schedulers 229 | plugins_s3_object_version = var.plugins_s3_object_version 230 | plugins_s3_path = var.plugins_s3_path 231 | requirements_s3_object_version = var.requirements_s3_object_version 232 | requirements_s3_path = var.requirements_s3_path 233 | startup_script_s3_object_version = var.startup_script_s3_object_version 234 | startup_script_s3_path = var.startup_script_s3_path 235 | webserver_access_mode = var.webserver_access_mode 236 | weekly_maintenance_window_start = var.weekly_maintenance_window_start 237 | source_bucket_arn = local.s3_bucket_arn 238 | execution_role_arn = local.execution_role_arn 239 | 240 | logging_configuration { 241 | dag_processing_logs { 242 | enabled = var.dag_processing_logs_enabled 243 | log_level = var.dag_processing_logs_level 244 | } 245 | 246 | scheduler_logs { 247 | enabled = var.scheduler_logs_enabled 248 | log_level = var.scheduler_logs_level 249 | } 250 | 251 | task_logs { 252 | enabled = var.task_logs_enabled 253 | log_level = var.task_logs_level 254 | } 255 | 256 | webserver_logs { 257 | enabled = var.webserver_logs_enabled 258 | log_level = var.webserver_logs_level 259 | } 260 | 261 | worker_logs { 262 | enabled = var.worker_logs_enabled 263 | log_level = var.worker_logs_level 264 | } 265 | } 266 | 267 | network_configuration { 268 | security_group_ids = local.security_group_ids 269 | subnet_ids = var.subnet_ids 270 | } 271 | 272 | tags = module.this.tags 273 | } 274 | -------------------------------------------------------------------------------- /context.tf: -------------------------------------------------------------------------------- 1 | # 2 | # ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label 3 | # All other instances of this file should be a copy of that one 4 | # 5 | # 6 | # Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf 7 | # and then place it in your Terraform module to automatically get 8 | # Cloud Posse's standard configuration inputs suitable for passing 9 | # to Cloud Posse modules. 10 | # 11 | # curl -sL https://raw.githubusercontent.com/cloudposse/terraform-null-label/master/exports/context.tf -o context.tf 12 | # 13 | # Modules should access the whole context as `module.this.context` 14 | # to get the input variables with nulls for defaults, 15 | # for example `context = module.this.context`, 16 | # and access individual variables as `module.this.`, 17 | # with final values filled in. 18 | # 19 | # For example, when using defaults, `module.this.context.delimiter` 20 | # will be null, and `module.this.delimiter` will be `-` (hyphen). 21 | # 22 | 23 | module "this" { 24 | source = "cloudposse/label/null" 25 | version = "0.25.0" # requires Terraform >= 0.13.0 26 | 27 | enabled = var.enabled 28 | namespace = var.namespace 29 | tenant = var.tenant 30 | environment = var.environment 31 | stage = var.stage 32 | name = var.name 33 | delimiter = var.delimiter 34 | attributes = var.attributes 35 | tags = var.tags 36 | additional_tag_map = var.additional_tag_map 37 | label_order = var.label_order 38 | regex_replace_chars = var.regex_replace_chars 39 | id_length_limit = var.id_length_limit 40 | label_key_case = var.label_key_case 41 | label_value_case = var.label_value_case 42 | descriptor_formats = var.descriptor_formats 43 | labels_as_tags = var.labels_as_tags 44 | 45 | context = var.context 46 | } 47 | 48 | # Copy contents of cloudposse/terraform-null-label/variables.tf here 49 | 50 | variable "context" { 51 | type = any 52 | default = { 53 | enabled = true 54 | namespace = null 55 | tenant = null 56 | environment = null 57 | stage = null 58 | name = null 59 | delimiter = null 60 | attributes = [] 61 | tags = {} 62 | additional_tag_map = {} 63 | regex_replace_chars = null 64 | label_order = [] 65 | id_length_limit = null 66 | label_key_case = null 67 | label_value_case = null 68 | descriptor_formats = {} 69 | # Note: we have to use [] instead of null for unset lists due to 70 | # https://github.com/hashicorp/terraform/issues/28137 71 | # which was not fixed until Terraform 1.0.0, 72 | # but we want the default to be all the labels in `label_order` 73 | # and we want users to be able to prevent all tag generation 74 | # by setting `labels_as_tags` to `[]`, so we need 75 | # a different sentinel to indicate "default" 76 | labels_as_tags = ["unset"] 77 | } 78 | description = <<-EOT 79 | Single object for setting entire context at once. 80 | See description of individual variables for details. 81 | Leave string and numeric variables as `null` to use default value. 82 | Individual variable settings (non-null) override settings in context object, 83 | except for attributes, tags, and additional_tag_map, which are merged. 84 | EOT 85 | 86 | validation { 87 | condition = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"]) 88 | error_message = "Allowed values: `lower`, `title`, `upper`." 89 | } 90 | 91 | validation { 92 | condition = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"]) 93 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 94 | } 95 | } 96 | 97 | variable "enabled" { 98 | type = bool 99 | default = null 100 | description = "Set to false to prevent the module from creating any resources" 101 | } 102 | 103 | variable "namespace" { 104 | type = string 105 | default = null 106 | description = "ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique" 107 | } 108 | 109 | variable "tenant" { 110 | type = string 111 | default = null 112 | description = "ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for" 113 | } 114 | 115 | variable "environment" { 116 | type = string 117 | default = null 118 | description = "ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'" 119 | } 120 | 121 | variable "stage" { 122 | type = string 123 | default = null 124 | description = "ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'" 125 | } 126 | 127 | variable "name" { 128 | type = string 129 | default = null 130 | description = <<-EOT 131 | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'. 132 | This is the only ID element not also included as a `tag`. 133 | The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. 134 | EOT 135 | } 136 | 137 | variable "delimiter" { 138 | type = string 139 | default = null 140 | description = <<-EOT 141 | Delimiter to be used between ID elements. 142 | Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. 143 | EOT 144 | } 145 | 146 | variable "attributes" { 147 | type = list(string) 148 | default = [] 149 | description = <<-EOT 150 | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`, 151 | in the order they appear in the list. New attributes are appended to the 152 | end of the list. The elements of the list are joined by the `delimiter` 153 | and treated as a single ID element. 154 | EOT 155 | } 156 | 157 | variable "labels_as_tags" { 158 | type = set(string) 159 | default = ["default"] 160 | description = <<-EOT 161 | Set of labels (ID elements) to include as tags in the `tags` output. 162 | Default is to include all labels. 163 | Tags with empty values will not be included in the `tags` output. 164 | Set to `[]` to suppress all generated tags. 165 | **Notes:** 166 | The value of the `name` tag, if included, will be the `id`, not the `name`. 167 | Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be 168 | changed in later chained modules. Attempts to change it will be silently ignored. 169 | EOT 170 | } 171 | 172 | variable "tags" { 173 | type = map(string) 174 | default = {} 175 | description = <<-EOT 176 | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`). 177 | Neither the tag keys nor the tag values will be modified by this module. 178 | EOT 179 | } 180 | 181 | variable "additional_tag_map" { 182 | type = map(string) 183 | default = {} 184 | description = <<-EOT 185 | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`. 186 | This is for some rare cases where resources want additional configuration of tags 187 | and therefore take a list of maps with tag key, value, and additional configuration. 188 | EOT 189 | } 190 | 191 | variable "label_order" { 192 | type = list(string) 193 | default = null 194 | description = <<-EOT 195 | The order in which the labels (ID elements) appear in the `id`. 196 | Defaults to ["namespace", "environment", "stage", "name", "attributes"]. 197 | You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. 198 | EOT 199 | } 200 | 201 | variable "regex_replace_chars" { 202 | type = string 203 | default = null 204 | description = <<-EOT 205 | Terraform regular expression (regex) string. 206 | Characters matching the regex will be removed from the ID elements. 207 | If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. 208 | EOT 209 | } 210 | 211 | variable "id_length_limit" { 212 | type = number 213 | default = null 214 | description = <<-EOT 215 | Limit `id` to this many characters (minimum 6). 216 | Set to `0` for unlimited length. 217 | Set to `null` for keep the existing setting, which defaults to `0`. 218 | Does not affect `id_full`. 219 | EOT 220 | validation { 221 | condition = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0 222 | error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length." 223 | } 224 | } 225 | 226 | variable "label_key_case" { 227 | type = string 228 | default = null 229 | description = <<-EOT 230 | Controls the letter case of the `tags` keys (label names) for tags generated by this module. 231 | Does not affect keys of tags passed in via the `tags` input. 232 | Possible values: `lower`, `title`, `upper`. 233 | Default value: `title`. 234 | EOT 235 | 236 | validation { 237 | condition = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case) 238 | error_message = "Allowed values: `lower`, `title`, `upper`." 239 | } 240 | } 241 | 242 | variable "label_value_case" { 243 | type = string 244 | default = null 245 | description = <<-EOT 246 | Controls the letter case of ID elements (labels) as included in `id`, 247 | set as tag values, and output by this module individually. 248 | Does not affect values of tags passed in via the `tags` input. 249 | Possible values: `lower`, `title`, `upper` and `none` (no transformation). 250 | Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs. 251 | Default value: `lower`. 252 | EOT 253 | 254 | validation { 255 | condition = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case) 256 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 257 | } 258 | } 259 | 260 | variable "descriptor_formats" { 261 | type = any 262 | default = {} 263 | description = <<-EOT 264 | Describe additional descriptors to be output in the `descriptors` output map. 265 | Map of maps. Keys are names of descriptors. Values are maps of the form 266 | `{ 267 | format = string 268 | labels = list(string) 269 | }` 270 | (Type is `any` so the map values can later be enhanced to provide additional options.) 271 | `format` is a Terraform format string to be passed to the `format()` function. 272 | `labels` is a list of labels, in order, to pass to `format()` function. 273 | Label values will be normalized before being passed to `format()` so they will be 274 | identical to how they appear in `id`. 275 | Default is `{}` (`descriptors` output will be empty). 276 | EOT 277 | } 278 | 279 | #### End of copy of cloudposse/terraform-null-label/variables.tf 280 | -------------------------------------------------------------------------------- /examples/complete/context.tf: -------------------------------------------------------------------------------- 1 | # 2 | # ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label 3 | # All other instances of this file should be a copy of that one 4 | # 5 | # 6 | # Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf 7 | # and then place it in your Terraform module to automatically get 8 | # Cloud Posse's standard configuration inputs suitable for passing 9 | # to Cloud Posse modules. 10 | # 11 | # curl -sL https://raw.githubusercontent.com/cloudposse/terraform-null-label/master/exports/context.tf -o context.tf 12 | # 13 | # Modules should access the whole context as `module.this.context` 14 | # to get the input variables with nulls for defaults, 15 | # for example `context = module.this.context`, 16 | # and access individual variables as `module.this.`, 17 | # with final values filled in. 18 | # 19 | # For example, when using defaults, `module.this.context.delimiter` 20 | # will be null, and `module.this.delimiter` will be `-` (hyphen). 21 | # 22 | 23 | module "this" { 24 | source = "cloudposse/label/null" 25 | version = "0.25.0" # requires Terraform >= 0.13.0 26 | 27 | enabled = var.enabled 28 | namespace = var.namespace 29 | tenant = var.tenant 30 | environment = var.environment 31 | stage = var.stage 32 | name = var.name 33 | delimiter = var.delimiter 34 | attributes = var.attributes 35 | tags = var.tags 36 | additional_tag_map = var.additional_tag_map 37 | label_order = var.label_order 38 | regex_replace_chars = var.regex_replace_chars 39 | id_length_limit = var.id_length_limit 40 | label_key_case = var.label_key_case 41 | label_value_case = var.label_value_case 42 | descriptor_formats = var.descriptor_formats 43 | labels_as_tags = var.labels_as_tags 44 | 45 | context = var.context 46 | } 47 | 48 | # Copy contents of cloudposse/terraform-null-label/variables.tf here 49 | 50 | variable "context" { 51 | type = any 52 | default = { 53 | enabled = true 54 | namespace = null 55 | tenant = null 56 | environment = null 57 | stage = null 58 | name = null 59 | delimiter = null 60 | attributes = [] 61 | tags = {} 62 | additional_tag_map = {} 63 | regex_replace_chars = null 64 | label_order = [] 65 | id_length_limit = null 66 | label_key_case = null 67 | label_value_case = null 68 | descriptor_formats = {} 69 | # Note: we have to use [] instead of null for unset lists due to 70 | # https://github.com/hashicorp/terraform/issues/28137 71 | # which was not fixed until Terraform 1.0.0, 72 | # but we want the default to be all the labels in `label_order` 73 | # and we want users to be able to prevent all tag generation 74 | # by setting `labels_as_tags` to `[]`, so we need 75 | # a different sentinel to indicate "default" 76 | labels_as_tags = ["unset"] 77 | } 78 | description = <<-EOT 79 | Single object for setting entire context at once. 80 | See description of individual variables for details. 81 | Leave string and numeric variables as `null` to use default value. 82 | Individual variable settings (non-null) override settings in context object, 83 | except for attributes, tags, and additional_tag_map, which are merged. 84 | EOT 85 | 86 | validation { 87 | condition = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"]) 88 | error_message = "Allowed values: `lower`, `title`, `upper`." 89 | } 90 | 91 | validation { 92 | condition = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"]) 93 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 94 | } 95 | } 96 | 97 | variable "enabled" { 98 | type = bool 99 | default = null 100 | description = "Set to false to prevent the module from creating any resources" 101 | } 102 | 103 | variable "namespace" { 104 | type = string 105 | default = null 106 | description = "ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique" 107 | } 108 | 109 | variable "tenant" { 110 | type = string 111 | default = null 112 | description = "ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for" 113 | } 114 | 115 | variable "environment" { 116 | type = string 117 | default = null 118 | description = "ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'" 119 | } 120 | 121 | variable "stage" { 122 | type = string 123 | default = null 124 | description = "ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'" 125 | } 126 | 127 | variable "name" { 128 | type = string 129 | default = null 130 | description = <<-EOT 131 | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'. 132 | This is the only ID element not also included as a `tag`. 133 | The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. 134 | EOT 135 | } 136 | 137 | variable "delimiter" { 138 | type = string 139 | default = null 140 | description = <<-EOT 141 | Delimiter to be used between ID elements. 142 | Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. 143 | EOT 144 | } 145 | 146 | variable "attributes" { 147 | type = list(string) 148 | default = [] 149 | description = <<-EOT 150 | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`, 151 | in the order they appear in the list. New attributes are appended to the 152 | end of the list. The elements of the list are joined by the `delimiter` 153 | and treated as a single ID element. 154 | EOT 155 | } 156 | 157 | variable "labels_as_tags" { 158 | type = set(string) 159 | default = ["default"] 160 | description = <<-EOT 161 | Set of labels (ID elements) to include as tags in the `tags` output. 162 | Default is to include all labels. 163 | Tags with empty values will not be included in the `tags` output. 164 | Set to `[]` to suppress all generated tags. 165 | **Notes:** 166 | The value of the `name` tag, if included, will be the `id`, not the `name`. 167 | Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be 168 | changed in later chained modules. Attempts to change it will be silently ignored. 169 | EOT 170 | } 171 | 172 | variable "tags" { 173 | type = map(string) 174 | default = {} 175 | description = <<-EOT 176 | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`). 177 | Neither the tag keys nor the tag values will be modified by this module. 178 | EOT 179 | } 180 | 181 | variable "additional_tag_map" { 182 | type = map(string) 183 | default = {} 184 | description = <<-EOT 185 | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`. 186 | This is for some rare cases where resources want additional configuration of tags 187 | and therefore take a list of maps with tag key, value, and additional configuration. 188 | EOT 189 | } 190 | 191 | variable "label_order" { 192 | type = list(string) 193 | default = null 194 | description = <<-EOT 195 | The order in which the labels (ID elements) appear in the `id`. 196 | Defaults to ["namespace", "environment", "stage", "name", "attributes"]. 197 | You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. 198 | EOT 199 | } 200 | 201 | variable "regex_replace_chars" { 202 | type = string 203 | default = null 204 | description = <<-EOT 205 | Terraform regular expression (regex) string. 206 | Characters matching the regex will be removed from the ID elements. 207 | If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. 208 | EOT 209 | } 210 | 211 | variable "id_length_limit" { 212 | type = number 213 | default = null 214 | description = <<-EOT 215 | Limit `id` to this many characters (minimum 6). 216 | Set to `0` for unlimited length. 217 | Set to `null` for keep the existing setting, which defaults to `0`. 218 | Does not affect `id_full`. 219 | EOT 220 | validation { 221 | condition = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0 222 | error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length." 223 | } 224 | } 225 | 226 | variable "label_key_case" { 227 | type = string 228 | default = null 229 | description = <<-EOT 230 | Controls the letter case of the `tags` keys (label names) for tags generated by this module. 231 | Does not affect keys of tags passed in via the `tags` input. 232 | Possible values: `lower`, `title`, `upper`. 233 | Default value: `title`. 234 | EOT 235 | 236 | validation { 237 | condition = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case) 238 | error_message = "Allowed values: `lower`, `title`, `upper`." 239 | } 240 | } 241 | 242 | variable "label_value_case" { 243 | type = string 244 | default = null 245 | description = <<-EOT 246 | Controls the letter case of ID elements (labels) as included in `id`, 247 | set as tag values, and output by this module individually. 248 | Does not affect values of tags passed in via the `tags` input. 249 | Possible values: `lower`, `title`, `upper` and `none` (no transformation). 250 | Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs. 251 | Default value: `lower`. 252 | EOT 253 | 254 | validation { 255 | condition = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case) 256 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 257 | } 258 | } 259 | 260 | variable "descriptor_formats" { 261 | type = any 262 | default = {} 263 | description = <<-EOT 264 | Describe additional descriptors to be output in the `descriptors` output map. 265 | Map of maps. Keys are names of descriptors. Values are maps of the form 266 | `{ 267 | format = string 268 | labels = list(string) 269 | }` 270 | (Type is `any` so the map values can later be enhanced to provide additional options.) 271 | `format` is a Terraform format string to be passed to the `format()` function. 272 | `labels` is a list of labels, in order, to pass to `format()` function. 273 | Label values will be normalized before being passed to `format()` so they will be 274 | identical to how they appear in `id`. 275 | Default is `{}` (`descriptors` output will be empty). 276 | EOT 277 | } 278 | 279 | #### End of copy of cloudposse/terraform-null-label/variables.tf 280 | -------------------------------------------------------------------------------- /examples/minimal/context.tf: -------------------------------------------------------------------------------- 1 | # 2 | # ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label 3 | # All other instances of this file should be a copy of that one 4 | # 5 | # 6 | # Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf 7 | # and then place it in your Terraform module to automatically get 8 | # Cloud Posse's standard configuration inputs suitable for passing 9 | # to Cloud Posse modules. 10 | # 11 | # curl -sL https://raw.githubusercontent.com/cloudposse/terraform-null-label/master/exports/context.tf -o context.tf 12 | # 13 | # Modules should access the whole context as `module.this.context` 14 | # to get the input variables with nulls for defaults, 15 | # for example `context = module.this.context`, 16 | # and access individual variables as `module.this.`, 17 | # with final values filled in. 18 | # 19 | # For example, when using defaults, `module.this.context.delimiter` 20 | # will be null, and `module.this.delimiter` will be `-` (hyphen). 21 | # 22 | 23 | module "this" { 24 | source = "cloudposse/label/null" 25 | version = "0.25.0" # requires Terraform >= 0.13.0 26 | 27 | enabled = var.enabled 28 | namespace = var.namespace 29 | tenant = var.tenant 30 | environment = var.environment 31 | stage = var.stage 32 | name = var.name 33 | delimiter = var.delimiter 34 | attributes = var.attributes 35 | tags = var.tags 36 | additional_tag_map = var.additional_tag_map 37 | label_order = var.label_order 38 | regex_replace_chars = var.regex_replace_chars 39 | id_length_limit = var.id_length_limit 40 | label_key_case = var.label_key_case 41 | label_value_case = var.label_value_case 42 | descriptor_formats = var.descriptor_formats 43 | labels_as_tags = var.labels_as_tags 44 | 45 | context = var.context 46 | } 47 | 48 | # Copy contents of cloudposse/terraform-null-label/variables.tf here 49 | 50 | variable "context" { 51 | type = any 52 | default = { 53 | enabled = true 54 | namespace = null 55 | tenant = null 56 | environment = null 57 | stage = null 58 | name = null 59 | delimiter = null 60 | attributes = [] 61 | tags = {} 62 | additional_tag_map = {} 63 | regex_replace_chars = null 64 | label_order = [] 65 | id_length_limit = null 66 | label_key_case = null 67 | label_value_case = null 68 | descriptor_formats = {} 69 | # Note: we have to use [] instead of null for unset lists due to 70 | # https://github.com/hashicorp/terraform/issues/28137 71 | # which was not fixed until Terraform 1.0.0, 72 | # but we want the default to be all the labels in `label_order` 73 | # and we want users to be able to prevent all tag generation 74 | # by setting `labels_as_tags` to `[]`, so we need 75 | # a different sentinel to indicate "default" 76 | labels_as_tags = ["unset"] 77 | } 78 | description = <<-EOT 79 | Single object for setting entire context at once. 80 | See description of individual variables for details. 81 | Leave string and numeric variables as `null` to use default value. 82 | Individual variable settings (non-null) override settings in context object, 83 | except for attributes, tags, and additional_tag_map, which are merged. 84 | EOT 85 | 86 | validation { 87 | condition = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"]) 88 | error_message = "Allowed values: `lower`, `title`, `upper`." 89 | } 90 | 91 | validation { 92 | condition = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"]) 93 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 94 | } 95 | } 96 | 97 | variable "enabled" { 98 | type = bool 99 | default = null 100 | description = "Set to false to prevent the module from creating any resources" 101 | } 102 | 103 | variable "namespace" { 104 | type = string 105 | default = null 106 | description = "ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique" 107 | } 108 | 109 | variable "tenant" { 110 | type = string 111 | default = null 112 | description = "ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for" 113 | } 114 | 115 | variable "environment" { 116 | type = string 117 | default = null 118 | description = "ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'" 119 | } 120 | 121 | variable "stage" { 122 | type = string 123 | default = null 124 | description = "ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'" 125 | } 126 | 127 | variable "name" { 128 | type = string 129 | default = null 130 | description = <<-EOT 131 | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'. 132 | This is the only ID element not also included as a `tag`. 133 | The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. 134 | EOT 135 | } 136 | 137 | variable "delimiter" { 138 | type = string 139 | default = null 140 | description = <<-EOT 141 | Delimiter to be used between ID elements. 142 | Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. 143 | EOT 144 | } 145 | 146 | variable "attributes" { 147 | type = list(string) 148 | default = [] 149 | description = <<-EOT 150 | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`, 151 | in the order they appear in the list. New attributes are appended to the 152 | end of the list. The elements of the list are joined by the `delimiter` 153 | and treated as a single ID element. 154 | EOT 155 | } 156 | 157 | variable "labels_as_tags" { 158 | type = set(string) 159 | default = ["default"] 160 | description = <<-EOT 161 | Set of labels (ID elements) to include as tags in the `tags` output. 162 | Default is to include all labels. 163 | Tags with empty values will not be included in the `tags` output. 164 | Set to `[]` to suppress all generated tags. 165 | **Notes:** 166 | The value of the `name` tag, if included, will be the `id`, not the `name`. 167 | Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be 168 | changed in later chained modules. Attempts to change it will be silently ignored. 169 | EOT 170 | } 171 | 172 | variable "tags" { 173 | type = map(string) 174 | default = {} 175 | description = <<-EOT 176 | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`). 177 | Neither the tag keys nor the tag values will be modified by this module. 178 | EOT 179 | } 180 | 181 | variable "additional_tag_map" { 182 | type = map(string) 183 | default = {} 184 | description = <<-EOT 185 | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`. 186 | This is for some rare cases where resources want additional configuration of tags 187 | and therefore take a list of maps with tag key, value, and additional configuration. 188 | EOT 189 | } 190 | 191 | variable "label_order" { 192 | type = list(string) 193 | default = null 194 | description = <<-EOT 195 | The order in which the labels (ID elements) appear in the `id`. 196 | Defaults to ["namespace", "environment", "stage", "name", "attributes"]. 197 | You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. 198 | EOT 199 | } 200 | 201 | variable "regex_replace_chars" { 202 | type = string 203 | default = null 204 | description = <<-EOT 205 | Terraform regular expression (regex) string. 206 | Characters matching the regex will be removed from the ID elements. 207 | If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. 208 | EOT 209 | } 210 | 211 | variable "id_length_limit" { 212 | type = number 213 | default = null 214 | description = <<-EOT 215 | Limit `id` to this many characters (minimum 6). 216 | Set to `0` for unlimited length. 217 | Set to `null` for keep the existing setting, which defaults to `0`. 218 | Does not affect `id_full`. 219 | EOT 220 | validation { 221 | condition = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0 222 | error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length." 223 | } 224 | } 225 | 226 | variable "label_key_case" { 227 | type = string 228 | default = null 229 | description = <<-EOT 230 | Controls the letter case of the `tags` keys (label names) for tags generated by this module. 231 | Does not affect keys of tags passed in via the `tags` input. 232 | Possible values: `lower`, `title`, `upper`. 233 | Default value: `title`. 234 | EOT 235 | 236 | validation { 237 | condition = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case) 238 | error_message = "Allowed values: `lower`, `title`, `upper`." 239 | } 240 | } 241 | 242 | variable "label_value_case" { 243 | type = string 244 | default = null 245 | description = <<-EOT 246 | Controls the letter case of ID elements (labels) as included in `id`, 247 | set as tag values, and output by this module individually. 248 | Does not affect values of tags passed in via the `tags` input. 249 | Possible values: `lower`, `title`, `upper` and `none` (no transformation). 250 | Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs. 251 | Default value: `lower`. 252 | EOT 253 | 254 | validation { 255 | condition = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case) 256 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 257 | } 258 | } 259 | 260 | variable "descriptor_formats" { 261 | type = any 262 | default = {} 263 | description = <<-EOT 264 | Describe additional descriptors to be output in the `descriptors` output map. 265 | Map of maps. Keys are names of descriptors. Values are maps of the form 266 | `{ 267 | format = string 268 | labels = list(string) 269 | }` 270 | (Type is `any` so the map values can later be enhanced to provide additional options.) 271 | `format` is a Terraform format string to be passed to the `format()` function. 272 | `labels` is a list of labels, in order, to pass to `format()` function. 273 | Label values will be normalized before being passed to `format()` so they will be 274 | identical to how they appear in `id`. 275 | Default is `{}` (`descriptors` output will be empty). 276 | EOT 277 | } 278 | 279 | #### End of copy of cloudposse/terraform-null-label/variables.tf 280 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Apache License 2 | Version 2.0, January 2004 3 | http://www.apache.org/licenses/ 4 | 5 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 6 | 7 | 1. Definitions. 8 | 9 | "License" shall mean the terms and conditions for use, reproduction, 10 | and distribution as defined by Sections 1 through 9 of this document. 11 | 12 | "Licensor" shall mean the copyright owner or entity authorized by 13 | the copyright owner that is granting the License. 14 | 15 | "Legal Entity" shall mean the union of the acting entity and all 16 | other entities that control, are controlled by, or are under common 17 | control with that entity. For the purposes of this definition, 18 | "control" means (i) the power, direct or indirect, to cause the 19 | direction or management of such entity, whether by contract or 20 | otherwise, or (ii) ownership of fifty percent (50%) or more of the 21 | outstanding shares, or (iii) beneficial ownership of such entity. 22 | 23 | "You" (or "Your") shall mean an individual or Legal Entity 24 | exercising permissions granted by this License. 25 | 26 | "Source" form shall mean the preferred form for making modifications, 27 | including but not limited to software source code, documentation 28 | source, and configuration files. 29 | 30 | "Object" form shall mean any form resulting from mechanical 31 | transformation or translation of a Source form, including but 32 | not limited to compiled object code, generated documentation, 33 | and conversions to other media types. 34 | 35 | "Work" shall mean the work of authorship, whether in Source or 36 | Object form, made available under the License, as indicated by a 37 | copyright notice that is included in or attached to the work 38 | (an example is provided in the Appendix below). 39 | 40 | "Derivative Works" shall mean any work, whether in Source or Object 41 | form, that is based on (or derived from) the Work and for which the 42 | editorial revisions, annotations, elaborations, or other modifications 43 | represent, as a whole, an original work of authorship. For the purposes 44 | of this License, Derivative Works shall not include works that remain 45 | separable from, or merely link (or bind by name) to the interfaces of, 46 | the Work and Derivative Works thereof. 47 | 48 | "Contribution" shall mean any work of authorship, including 49 | the original version of the Work and any modifications or additions 50 | to that Work or Derivative Works thereof, that is intentionally 51 | submitted to Licensor for inclusion in the Work by the copyright owner 52 | or by an individual or Legal Entity authorized to submit on behalf of 53 | the copyright owner. For the purposes of this definition, "submitted" 54 | means any form of electronic, verbal, or written communication sent 55 | to the Licensor or its representatives, including but not limited to 56 | communication on electronic mailing lists, source code control systems, 57 | and issue tracking systems that are managed by, or on behalf of, the 58 | Licensor for the purpose of discussing and improving the Work, but 59 | excluding communication that is conspicuously marked or otherwise 60 | designated in writing by the copyright owner as "Not a Contribution." 61 | 62 | "Contributor" shall mean Licensor and any individual or Legal Entity 63 | on behalf of whom a Contribution has been received by Licensor and 64 | subsequently incorporated within the Work. 65 | 66 | 2. Grant of Copyright License. Subject to the terms and conditions of 67 | this License, each Contributor hereby grants to You a perpetual, 68 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 69 | copyright license to reproduce, prepare Derivative Works of, 70 | publicly display, publicly perform, sublicense, and distribute the 71 | Work and such Derivative Works in Source or Object form. 72 | 73 | 3. Grant of Patent License. Subject to the terms and conditions of 74 | this License, each Contributor hereby grants to You a perpetual, 75 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 76 | (except as stated in this section) patent license to make, have made, 77 | use, offer to sell, sell, import, and otherwise transfer the Work, 78 | where such license applies only to those patent claims licensable 79 | by such Contributor that are necessarily infringed by their 80 | Contribution(s) alone or by combination of their Contribution(s) 81 | with the Work to which such Contribution(s) was submitted. If You 82 | institute patent litigation against any entity (including a 83 | cross-claim or counterclaim in a lawsuit) alleging that the Work 84 | or a Contribution incorporated within the Work constitutes direct 85 | or contributory patent infringement, then any patent licenses 86 | granted to You under this License for that Work shall terminate 87 | as of the date such litigation is filed. 88 | 89 | 4. Redistribution. You may reproduce and distribute copies of the 90 | Work or Derivative Works thereof in any medium, with or without 91 | modifications, and in Source or Object form, provided that You 92 | meet the following conditions: 93 | 94 | (a) You must give any other recipients of the Work or 95 | Derivative Works a copy of this License; and 96 | 97 | (b) You must cause any modified files to carry prominent notices 98 | stating that You changed the files; and 99 | 100 | (c) You must retain, in the Source form of any Derivative Works 101 | that You distribute, all copyright, patent, trademark, and 102 | attribution notices from the Source form of the Work, 103 | excluding those notices that do not pertain to any part of 104 | the Derivative Works; and 105 | 106 | (d) If the Work includes a "NOTICE" text file as part of its 107 | distribution, then any Derivative Works that You distribute must 108 | include a readable copy of the attribution notices contained 109 | within such NOTICE file, excluding those notices that do not 110 | pertain to any part of the Derivative Works, in at least one 111 | of the following places: within a NOTICE text file distributed 112 | as part of the Derivative Works; within the Source form or 113 | documentation, if provided along with the Derivative Works; or, 114 | within a display generated by the Derivative Works, if and 115 | wherever such third-party notices normally appear. The contents 116 | of the NOTICE file are for informational purposes only and 117 | do not modify the License. You may add Your own attribution 118 | notices within Derivative Works that You distribute, alongside 119 | or as an addendum to the NOTICE text from the Work, provided 120 | that such additional attribution notices cannot be construed 121 | as modifying the License. 122 | 123 | You may add Your own copyright statement to Your modifications and 124 | may provide additional or different license terms and conditions 125 | for use, reproduction, or distribution of Your modifications, or 126 | for any such Derivative Works as a whole, provided Your use, 127 | reproduction, and distribution of the Work otherwise complies with 128 | the conditions stated in this License. 129 | 130 | 5. Submission of Contributions. Unless You explicitly state otherwise, 131 | any Contribution intentionally submitted for inclusion in the Work 132 | by You to the Licensor shall be under the terms and conditions of 133 | this License, without any additional terms or conditions. 134 | Notwithstanding the above, nothing herein shall supersede or modify 135 | the terms of any separate license agreement you may have executed 136 | with Licensor regarding such Contributions. 137 | 138 | 6. Trademarks. This License does not grant permission to use the trade 139 | names, trademarks, service marks, or product names of the Licensor, 140 | except as required for reasonable and customary use in describing the 141 | origin of the Work and reproducing the content of the NOTICE file. 142 | 143 | 7. Disclaimer of Warranty. Unless required by applicable law or 144 | agreed to in writing, Licensor provides the Work (and each 145 | Contributor provides its Contributions) on an "AS IS" BASIS, 146 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or 147 | implied, including, without limitation, any warranties or conditions 148 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A 149 | PARTICULAR PURPOSE. You are solely responsible for determining the 150 | appropriateness of using or redistributing the Work and assume any 151 | risks associated with Your exercise of permissions under this License. 152 | 153 | 8. Limitation of Liability. In no event and under no legal theory, 154 | whether in tort (including negligence), contract, or otherwise, 155 | unless required by applicable law (such as deliberate and grossly 156 | negligent acts) or agreed to in writing, shall any Contributor be 157 | liable to You for damages, including any direct, indirect, special, 158 | incidental, or consequential damages of any character arising as a 159 | result of this License or out of the use or inability to use the 160 | Work (including but not limited to damages for loss of goodwill, 161 | work stoppage, computer failure or malfunction, or any and all 162 | other commercial damages or losses), even if such Contributor 163 | has been advised of the possibility of such damages. 164 | 165 | 9. Accepting Warranty or Additional Liability. While redistributing 166 | the Work or Derivative Works thereof, You may choose to offer, 167 | and charge a fee for, acceptance of support, warranty, indemnity, 168 | or other liability obligations and/or rights consistent with this 169 | License. However, in accepting such obligations, You may act only 170 | on Your own behalf and on Your sole responsibility, not on behalf 171 | of any other Contributor, and only if You agree to indemnify, 172 | defend, and hold each Contributor harmless for any liability 173 | incurred by, or claims asserted against, such Contributor by reason 174 | of your accepting any such warranty or additional liability. 175 | 176 | END OF TERMS AND CONDITIONS 177 | 178 | APPENDIX: How to apply the Apache License to your work. 179 | 180 | To apply the Apache License to your work, attach the following 181 | boilerplate notice, with the fields enclosed by brackets "[]" 182 | replaced with your own identifying information. (Don't include 183 | the brackets!) The text should be enclosed in the appropriate 184 | comment syntax for the file format. We also recommend that a 185 | file or class name and description of purpose be included on the 186 | same "printed page" as the copyright notice for easier 187 | identification within third-party archives. 188 | 189 | Copyright 2020 Cloud Posse, LLC 190 | 191 | Licensed under the Apache License, Version 2.0 (the "License"); 192 | you may not use this file except in compliance with the License. 193 | You may obtain a copy of the License at 194 | 195 | http://www.apache.org/licenses/LICENSE-2.0 196 | 197 | Unless required by applicable law or agreed to in writing, software 198 | distributed under the License is distributed on an "AS IS" BASIS, 199 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 200 | See the License for the specific language governing permissions and 201 | limitations under the License. 202 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Project Banner
5 | 6 | 7 |

Latest ReleaseLast UpdatedSlack CommunityGet Support 8 | 9 |

10 | 11 | 12 | 32 | 33 | Terraform module to provision Amazon Managed Workflows for Apache Airflow 34 | 35 | 36 | > [!TIP] 37 | > #### 👽 Use Atmos with Terraform 38 | > Cloud Posse uses [`atmos`](https://atmos.tools) to easily orchestrate multiple environments using Terraform.
39 | > Works with [Github Actions](https://atmos.tools/integrations/github-actions/), [Atlantis](https://atmos.tools/integrations/atlantis), or [Spacelift](https://atmos.tools/integrations/spacelift). 40 | > 41 | >
42 | > Watch demo of using Atmos with Terraform 43 | >
44 | > Example of running atmos to manage infrastructure from our Quick Start tutorial. 45 | > 46 | 47 | 48 | 49 | 50 | 51 | ## Usage 52 | 53 | For a complete example, see [examples/complete](examples/complete). 54 | 55 | For automated tests of the complete example using [bats](https://github.com/bats-core/bats-core) and [Terratest](https://github.com/gruntwork-io/terratest) 56 | (which tests and deploys the example on AWS), see [test](test). 57 | 58 | ```hcl 59 | module "mwaa" { 60 | source = "cloudposse/mwaa/aws" 61 | # Cloud Posse recommends pinning every module to a specific version 62 | # version = "x.x.x" 63 | vpc_id = var.vpc_id 64 | subnet_ids = var.subnet_ids 65 | airflow_version = "2.0.2" 66 | dag_s3_path = "dags" 67 | environment_class = "mw1.small" 68 | min_workers = 1 69 | max_workers = 10 70 | webserver_access_mode = "PRIVATE_ONLY" 71 | dag_processing_logs_enabled = true 72 | dag_processing_logs_level = "INFO" 73 | name = "app" 74 | stage = "test" 75 | namespace = "eg" 76 | enabled = true 77 | } 78 | ``` 79 | 80 | > [!IMPORTANT] 81 | > In Cloud Posse's examples, we avoid pinning modules to specific versions to prevent discrepancies between the documentation 82 | > and the latest released versions. However, for your own projects, we strongly advise pinning each module to the exact version 83 | > you're using. This practice ensures the stability of your infrastructure. Additionally, we recommend implementing a systematic 84 | > approach for updating versions to avoid unexpected changes. 85 | 86 | 87 | 88 | 89 | 90 | ## Examples 91 | 92 | Here is an example of using this module: 93 | - [`examples/complete`](https://github.com/cloudposse/terraform-aws-mwaa/) - complete example of using this module 94 | 95 | 96 | 97 | 98 | 99 | ## Requirements 100 | 101 | | Name | Version | 102 | |------|---------| 103 | | [terraform](#requirement\_terraform) | >= 1.0 | 104 | | [aws](#requirement\_aws) | >= 4.2.0 | 105 | 106 | ## Providers 107 | 108 | | Name | Version | 109 | |------|---------| 110 | | [aws](#provider\_aws) | >= 4.2.0 | 111 | 112 | ## Modules 113 | 114 | | Name | Source | Version | 115 | |------|--------|---------| 116 | | [iam\_label](#module\_iam\_label) | cloudposse/label/null | 0.25.0 | 117 | | [mwaa\_iam\_role](#module\_mwaa\_iam\_role) | cloudposse/iam-role/aws | 0.20.0 | 118 | | [mwaa\_s3\_bucket](#module\_mwaa\_s3\_bucket) | cloudposse/s3-bucket/aws | 4.0.0 | 119 | | [mwaa\_security\_group](#module\_mwaa\_security\_group) | cloudposse/security-group/aws | 1.0.1 | 120 | | [s3\_label](#module\_s3\_label) | cloudposse/label/null | 0.25.0 | 121 | | [sg\_label](#module\_sg\_label) | cloudposse/label/null | 0.25.0 | 122 | | [this](#module\_this) | cloudposse/label/null | 0.25.0 | 123 | 124 | ## Resources 125 | 126 | | Name | Type | 127 | |------|------| 128 | | [aws_mwaa_environment.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/mwaa_environment) | resource | 129 | | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | 130 | | [aws_iam_policy_document.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | 131 | | [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source | 132 | 133 | ## Inputs 134 | 135 | | Name | Description | Type | Default | Required | 136 | |------|-------------|------|---------|:--------:| 137 | | [additional\_security\_group\_rules](#input\_additional\_security\_group\_rules) | A list of Security Group rule objects to add to the created security group, in addition to the ones
this module normally creates. (To suppress the module's rules, set `create_security_group` to false
and supply your own security group(s) via `associated_security_group_ids`.)
The keys and values of the objects are fully compatible with the `aws_security_group_rule` resource, except
for `security_group_id` which will be ignored, and the optional "key" which, if provided, must be unique and known at "plan" time.
For more info see https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule
and https://github.com/cloudposse/terraform-aws-security-group. | `list(any)` | `[]` | no | 138 | | [additional\_tag\_map](#input\_additional\_tag\_map) | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.
This is for some rare cases where resources want additional configuration of tags
and therefore take a list of maps with tag key, value, and additional configuration. | `map(string)` | `{}` | no | 139 | | [additionals\_managed\_policy\_arns](#input\_additionals\_managed\_policy\_arns) | List of managed policies to attach to the MWAA IAM role | `list(any)` | `[]` | no | 140 | | [additionals\_policy\_documents](#input\_additionals\_policy\_documents) | List of JSON IAM policy documents to attach to the MWAA IAM role | `list(any)` | `[]` | no | 141 | | [airflow\_configuration\_options](#input\_airflow\_configuration\_options) | The Airflow override options | `any` | `null` | no | 142 | | [airflow\_version](#input\_airflow\_version) | Airflow version of the MWAA environment, will be set by default to the latest version that MWAA supports. | `string` | `""` | no | 143 | | [allow\_all\_egress](#input\_allow\_all\_egress) | If `true`, the created security group will allow egress on all ports and protocols to all IP addresses.
If this is false and no egress rules are otherwise specified, then no egress will be allowed. | `bool` | `true` | no | 144 | | [allowed\_cidr\_blocks](#input\_allowed\_cidr\_blocks) | A list of IPv4 CIDRs to allow access to the security group created by this module.
The length of this list must be known at "plan" time. | `list(string)` | `[]` | no | 145 | | [allowed\_security\_group\_ids](#input\_allowed\_security\_group\_ids) | A list of IDs of Security Groups to allow access to the security group created by this module.
The length of this list must be known at "plan" time. | `list(string)` | `[]` | no | 146 | | [associated\_security\_group\_ids](#input\_associated\_security\_group\_ids) | A list of IDs of Security Groups to associate the created resource with, in addition to the created security group.
These security groups will not be modified and, if `create_security_group` is `false`, must have rules providing the desired access. | `list(string)` | `[]` | no | 147 | | [attributes](#input\_attributes) | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,
in the order they appear in the list. New attributes are appended to the
end of the list. The elements of the list are joined by the `delimiter`
and treated as a single ID element. | `list(string)` | `[]` | no | 148 | | [context](#input\_context) | Single object for setting entire context at once.
See description of individual variables for details.
Leave string and numeric variables as `null` to use default value.
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | 
{
  "additional_tag_map": {},
  "attributes": [],
  "delimiter": null,
  "descriptor_formats": {},
  "enabled": true,
  "environment": null,
  "id_length_limit": null,
  "label_key_case": null,
  "label_order": [],
  "label_value_case": null,
  "labels_as_tags": [
    "unset"
  ],
  "name": null,
  "namespace": null,
  "regex_replace_chars": null,
  "stage": null,
  "tags": {},
  "tenant": null
}
| no | 149 | | [create\_iam\_role](#input\_create\_iam\_role) | Enabling or disabling the creatation of a default IAM Role for AWS MWAA | `bool` | `true` | no | 150 | | [create\_s3\_bucket](#input\_create\_s3\_bucket) | Enabling or disabling the creatation of an S3 bucket for AWS MWAA | `bool` | `true` | no | 151 | | [create\_security\_group](#input\_create\_security\_group) | Set `true` to create and configure a new security group. If false, `associated_security_group_ids` must be provided. | `bool` | `true` | no | 152 | | [dag\_processing\_logs\_enabled](#input\_dag\_processing\_logs\_enabled) | Enabling or disabling the collection of logs for processing DAGs | `bool` | `false` | no | 153 | | [dag\_processing\_logs\_level](#input\_dag\_processing\_logs\_level) | DAG processing logging level. Valid values: CRITICAL, ERROR, WARNING, INFO, DEBUG | `string` | `"INFO"` | no | 154 | | [dag\_s3\_path](#input\_dag\_s3\_path) | The relative path to the DAG folder on your Amazon S3 storage bucket. | `string` | `"dags"` | no | 155 | | [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.
Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no | 156 | | [descriptor\_formats](#input\_descriptor\_formats) | Describe additional descriptors to be output in the `descriptors` output map.
Map of maps. Keys are names of descriptors. Values are maps of the form
`{
format = string
labels = list(string)
}`
(Type is `any` so the map values can later be enhanced to provide additional options.)
`format` is a Terraform format string to be passed to the `format()` function.
`labels` is a list of labels, in order, to pass to `format()` function.
Label values will be normalized before being passed to `format()` so they will be
identical to how they appear in `id`.
Default is `{}` (`descriptors` output will be empty). | `any` | `{}` | no | 157 | | [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no | 158 | | [environment](#input\_environment) | ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no | 159 | | [environment\_class](#input\_environment\_class) | Environment class for the cluster. Possible options are mw1.small, mw1.medium, mw1.large. | `string` | `"mw1.small"` | no | 160 | | [execution\_role\_arn](#input\_execution\_role\_arn) | If `create_iam_role` is `false` then set this to the target MWAA execution role | `string` | `""` | no | 161 | | [id\_length\_limit](#input\_id\_length\_limit) | Limit `id` to this many characters (minimum 6).
Set to `0` for unlimited length.
Set to `null` for keep the existing setting, which defaults to `0`.
Does not affect `id_full`. | `number` | `null` | no | 162 | | [kms\_key](#input\_kms\_key) | The Amazon Resource Name (ARN) of your KMS key that you want to use for encryption. Will be set to the ARN of the managed KMS key aws/airflow by default. | `string` | `null` | no | 163 | | [label\_key\_case](#input\_label\_key\_case) | Controls the letter case of the `tags` keys (label names) for tags generated by this module.
Does not affect keys of tags passed in via the `tags` input.
Possible values: `lower`, `title`, `upper`.
Default value: `title`. | `string` | `null` | no | 164 | | [label\_order](#input\_label\_order) | The order in which the labels (ID elements) appear in the `id`.
Defaults to ["namespace", "environment", "stage", "name", "attributes"].
You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. | `list(string)` | `null` | no | 165 | | [label\_value\_case](#input\_label\_value\_case) | Controls the letter case of ID elements (labels) as included in `id`,
set as tag values, and output by this module individually.
Does not affect values of tags passed in via the `tags` input.
Possible values: `lower`, `title`, `upper` and `none` (no transformation).
Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs.
Default value: `lower`. | `string` | `null` | no | 166 | | [labels\_as\_tags](#input\_labels\_as\_tags) | Set of labels (ID elements) to include as tags in the `tags` output.
Default is to include all labels.
Tags with empty values will not be included in the `tags` output.
Set to `[]` to suppress all generated tags.
**Notes:**
The value of the `name` tag, if included, will be the `id`, not the `name`.
Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be
changed in later chained modules. Attempts to change it will be silently ignored. | `set(string)` | 
[
  "default"
]
| no | 167 | | [max\_webservers](#input\_max\_webservers) | The maximum number of web servers that you want to run in your environment. | `number` | `2` | no | 168 | | [max\_workers](#input\_max\_workers) | The maximum number of workers that can be automatically scaled up. Value need to be between 1 and 25. | `number` | `10` | no | 169 | | [min\_webservers](#input\_min\_webservers) | The minimum number of web servers that you want to run in your environment. | `number` | `2` | no | 170 | | [min\_workers](#input\_min\_workers) | The minimum number of workers that you want to run in your environment. | `number` | `1` | no | 171 | | [name](#input\_name) | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
This is the only ID element not also included as a `tag`.
The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. | `string` | `null` | no | 172 | | [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no | 173 | | [plugins\_s3\_object\_version](#input\_plugins\_s3\_object\_version) | The plugins.zip file version you want to use. | `string` | `null` | no | 174 | | [plugins\_s3\_path](#input\_plugins\_s3\_path) | The relative path to the plugins.zip file on your Amazon S3 storage bucket. For example, plugins.zip. If a relative path is provided in the request, then plugins\_s3\_object\_version is required | `string` | `null` | no | 175 | | [regex\_replace\_chars](#input\_regex\_replace\_chars) | Terraform regular expression (regex) string.
Characters matching the regex will be removed from the ID elements.
If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no | 176 | | [region](#input\_region) | AWS region | `string` | n/a | yes | 177 | | [requirements\_s3\_object\_version](#input\_requirements\_s3\_object\_version) | The requirements.txt file version you | `string` | `null` | no | 178 | | [requirements\_s3\_path](#input\_requirements\_s3\_path) | The relative path to the requirements.txt file on your Amazon S3 storage bucket. For example, requirements.txt. If a relative path is provided in the request, then requirements\_s3\_object\_version is required | `string` | `null` | no | 179 | | [scheduler\_logs\_enabled](#input\_scheduler\_logs\_enabled) | Enabling or disabling the collection of logs for the schedulers | `bool` | `false` | no | 180 | | [scheduler\_logs\_level](#input\_scheduler\_logs\_level) | Schedulers logging level. Valid values: CRITICAL, ERROR, WARNING, INFO, DEBUG | `string` | `"INFO"` | no | 181 | | [schedulers](#input\_schedulers) | The number of schedulers that you want to run in your environment. | `number` | `2` | no | 182 | | [security\_group\_create\_before\_destroy](#input\_security\_group\_create\_before\_destroy) | Set `true` to enable Terraform `create_before_destroy` behavior on the created security group.
We only recommend setting this `false` if you are upgrading this module and need to keep
the existing security group from being replaced.
Note that changing this value will always cause the security group to be replaced. | `bool` | `true` | no | 183 | | [security\_group\_create\_timeout](#input\_security\_group\_create\_timeout) | How long to wait for the security group to be created. | `string` | `"10m"` | no | 184 | | [security\_group\_delete\_timeout](#input\_security\_group\_delete\_timeout) | How long to retry on `DependencyViolation` errors during security group deletion from
lingering ENIs left by certain AWS services such as Elastic Load Balancing. | `string` | `"15m"` | no | 185 | | [security\_group\_description](#input\_security\_group\_description) | Security Group for AWS MWAA | `string` | `"Managed by Terraform"` | no | 186 | | [security\_group\_name](#input\_security\_group\_name) | The name to assign to the created security group. Must be unique within the VPC.
If not provided, will be derived from the `null-label.context` passed in.
If `create_before_destroy` is true, will be used as a name prefix. | `list(string)` | `[]` | no | 187 | | [source\_bucket\_arn](#input\_source\_bucket\_arn) | If `create_s3_bucket` is `false` then set this to the Amazon Resource Name (ARN) of your Amazon S3 storage bucket. | `string` | `null` | no | 188 | | [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no | 189 | | [startup\_script\_s3\_object\_version](#input\_startup\_script\_s3\_object\_version) | The version of the startup shell script you want to use. You must specify the version ID that Amazon S3 assigns to the file every time you update the script. | `string` | `null` | no | 190 | | [startup\_script\_s3\_path](#input\_startup\_script\_s3\_path) | The relative path to the script hosted in your bucket. The script runs as your environment starts before starting the Apache Airflow process. | `string` | `null` | no | 191 | | [subnet\_ids](#input\_subnet\_ids) | The private subnet IDs in which the environment should be created. MWAA requires two subnets | `list(string)` | n/a | yes | 192 | | [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no | 193 | | [task\_logs\_enabled](#input\_task\_logs\_enabled) | Enabling or disabling the collection of logs for DAG tasks | `bool` | `false` | no | 194 | | [task\_logs\_level](#input\_task\_logs\_level) | DAG tasks logging level. Valid values: CRITICAL, ERROR, WARNING, INFO, DEBUG | `string` | `"INFO"` | no | 195 | | [tenant](#input\_tenant) | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no | 196 | | [vpc\_id](#input\_vpc\_id) | The ID of the VPC where the Security Group will be created. | `string` | n/a | yes | 197 | | [webserver\_access\_mode](#input\_webserver\_access\_mode) | Specifies whether the webserver should be accessible over the internet or via your specified VPC. Possible options: PRIVATE\_ONLY (default) and PUBLIC\_ONLY. | `string` | `"PRIVATE_ONLY"` | no | 198 | | [webserver\_logs\_enabled](#input\_webserver\_logs\_enabled) | Enabling or disabling the collection of logs for the webservers | `bool` | `false` | no | 199 | | [webserver\_logs\_level](#input\_webserver\_logs\_level) | Webserver logging level. Valid values: CRITICAL, ERROR, WARNING, INFO, DEBUG | `string` | `"INFO"` | no | 200 | | [weekly\_maintenance\_window\_start](#input\_weekly\_maintenance\_window\_start) | Specifies the start date for the weekly maintenance window. | `string` | `null` | no | 201 | | [worker\_logs\_enabled](#input\_worker\_logs\_enabled) | Enabling or disabling the collection of logs for the workers | `bool` | `false` | no | 202 | | [worker\_logs\_level](#input\_worker\_logs\_level) | Workers logging level. Valid values: CRITICAL, ERROR, WARNING, INFO, DEBUG | `string` | `"INFO"` | no | 203 | 204 | ## Outputs 205 | 206 | | Name | Description | 207 | |------|-------------| 208 | | [arn](#output\_arn) | The ARN of the Amazon MWAA Environment | 209 | | [created\_at](#output\_created\_at) | The Created At date of the Amazon MWAA Environment | 210 | | [execution\_role\_arn](#output\_execution\_role\_arn) | IAM Role ARN for Amazon MWAA Execution Role | 211 | | [logging\_configuration](#output\_logging\_configuration) | The Logging Configuration of the Amazon MWAA Environment | 212 | | [s3\_bucket\_arn](#output\_s3\_bucket\_arn) | ARN of the S3 bucket | 213 | | [security\_group\_arn](#output\_security\_group\_arn) | The ARN of the created security group | 214 | | [security\_group\_id](#output\_security\_group\_id) | The ID of the created security group | 215 | | [security\_group\_name](#output\_security\_group\_name) | The name of the created security group | 216 | | [service\_role\_arn](#output\_service\_role\_arn) | The Service Role ARN of the Amazon MWAA Environment | 217 | | [status](#output\_status) | The status of the Amazon MWAA Environment | 218 | | [tags\_all](#output\_tags\_all) | A map of tags assigned to the resource, including those inherited from the provider for the Amazon MWAA Environment | 219 | | [webserver\_url](#output\_webserver\_url) | The webserver URL of the Amazon MWAA Environment | 220 | 221 | 222 | 223 | 224 | 225 | 226 | 227 | 228 | ## Related Projects 229 | 230 | Check out these related projects. 231 | 232 | - [terraform-null-label](https://github.com/cloudposse/terraform-null-label) - Terraform module designed to generate consistent names and tags for resources. Use terraform-null-label to implement a strict naming convention. 233 | 234 | 235 | ## References 236 | 237 | For additional context, refer to some of these links. 238 | 239 | - [Terraform Standard Module Structure](https://www.terraform.io/docs/modules/index.html#standard-module-structure) - HashiCorp's standard module structure is a file and directory layout we recommend for reusable modules distributed in separate repositories. 240 | - [Terraform Module Requirements](https://www.terraform.io/docs/registry/modules/publish.html#requirements) - HashiCorp's guidance on all the requirements for publishing a module. Meeting the requirements for publishing a module is extremely easy. 241 | - [Terraform `random_integer` Resource](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/integer) - The resource random_integer generates random values from a given range, described by the min and max attributes of a given resource. 242 | - [Terraform Version Pinning](https://www.terraform.io/docs/configuration/terraform.html#specifying-a-required-terraform-version) - The required_version setting can be used to constrain which versions of the Terraform CLI can be used with your configuration 243 | 244 | 245 | 246 | > [!TIP] 247 | > #### Use Terraform Reference Architectures for AWS 248 | > 249 | > Use Cloud Posse's ready-to-go [terraform architecture blueprints](https://cloudposse.com/reference-architecture/) for AWS to get up and running quickly. 250 | > 251 | > ✅ We build it together with your team.
252 | > ✅ Your team owns everything.
253 | > ✅ 100% Open Source and backed by fanatical support.
254 | > 255 | > Request Quote 256 | >
📚 Learn More 257 | > 258 | >
259 | > 260 | > Cloud Posse is the leading [**DevOps Accelerator**](https://cpco.io/commercial-support?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-mwaa&utm_content=commercial_support) for funded startups and enterprises. 261 | > 262 | > *Your team can operate like a pro today.* 263 | > 264 | > Ensure that your team succeeds by using Cloud Posse's proven process and turnkey blueprints. Plus, we stick around until you succeed. 265 | > #### Day-0: Your Foundation for Success 266 | > - **Reference Architecture.** You'll get everything you need from the ground up built using 100% infrastructure as code. 267 | > - **Deployment Strategy.** Adopt a proven deployment strategy with GitHub Actions, enabling automated, repeatable, and reliable software releases. 268 | > - **Site Reliability Engineering.** Gain total visibility into your applications and services with Datadog, ensuring high availability and performance. 269 | > - **Security Baseline.** Establish a secure environment from the start, with built-in governance, accountability, and comprehensive audit logs, safeguarding your operations. 270 | > - **GitOps.** Empower your team to manage infrastructure changes confidently and efficiently through Pull Requests, leveraging the full power of GitHub Actions. 271 | > 272 | > Request Quote 273 | > 274 | > #### Day-2: Your Operational Mastery 275 | > - **Training.** Equip your team with the knowledge and skills to confidently manage the infrastructure, ensuring long-term success and self-sufficiency. 276 | > - **Support.** Benefit from a seamless communication over Slack with our experts, ensuring you have the support you need, whenever you need it. 277 | > - **Troubleshooting.** Access expert assistance to quickly resolve any operational challenges, minimizing downtime and maintaining business continuity. 278 | > - **Code Reviews.** Enhance your team’s code quality with our expert feedback, fostering continuous improvement and collaboration. 279 | > - **Bug Fixes.** Rely on our team to troubleshoot and resolve any issues, ensuring your systems run smoothly. 280 | > - **Migration Assistance.** Accelerate your migration process with our dedicated support, minimizing disruption and speeding up time-to-value. 281 | > - **Customer Workshops.** Engage with our team in weekly workshops, gaining insights and strategies to continuously improve and innovate. 282 | > 283 | > Request Quote 284 | > 285 |
286 | 287 | ## ✨ Contributing 288 | 289 | This project is under active development, and we encourage contributions from our community. 290 | 291 | 292 | 293 | Many thanks to our outstanding contributors: 294 | 295 | 296 | 297 | 298 | 299 | For 🐛 bug reports & feature requests, please use the [issue tracker](https://github.com/cloudposse/terraform-aws-mwaa/issues). 300 | 301 | In general, PRs are welcome. We follow the typical "fork-and-pull" Git workflow. 302 | 1. Review our [Code of Conduct](https://github.com/cloudposse/terraform-aws-mwaa/?tab=coc-ov-file#code-of-conduct) and [Contributor Guidelines](https://github.com/cloudposse/.github/blob/main/CONTRIBUTING.md). 303 | 2. **Fork** the repo on GitHub 304 | 3. **Clone** the project to your own machine 305 | 4. **Commit** changes to your own branch 306 | 5. **Push** your work back up to your fork 307 | 6. Submit a **Pull Request** so that we can review your changes 308 | 309 | **NOTE:** Be sure to merge the latest changes from "upstream" before making a pull request! 310 | 311 | 312 | ## Running Terraform Tests 313 | 314 | We use [Atmos](https://atmos.tools) to streamline how Terraform tests are run. It centralizes configuration and wraps common test workflows with easy-to-use commands. 315 | 316 | All tests are located in the [`test/`](test) folder. 317 | 318 | Under the hood, tests are powered by Terratest together with our internal [Test Helpers](https://github.com/cloudposse/test-helpers) library, providing robust infrastructure validation. 319 | 320 | Setup dependencies: 321 | - Install Atmos ([installation guide](https://atmos.tools/install/)) 322 | - Install Go [1.24+ or newer](https://go.dev/doc/install) 323 | - Install Terraform or OpenTofu 324 | 325 | To run tests: 326 | 327 | - Run all tests: 328 | ```sh 329 | atmos test run 330 | ``` 331 | - Clean up test artifacts: 332 | ```sh 333 | atmos test clean 334 | ``` 335 | - Explore additional test options: 336 | ```sh 337 | atmos test --help 338 | ``` 339 | The configuration for test commands is centrally managed. To review what's being imported, see the [`atmos.yaml`](https://raw.githubusercontent.com/cloudposse/.github/refs/heads/main/.github/atmos/terraform-module.yaml) file. 340 | 341 | Learn more about our [automated testing in our documentation](https://docs.cloudposse.com/community/contribute/automated-testing/) or implementing [custom commands](https://atmos.tools/core-concepts/custom-commands/) with atmos. 342 | 343 | ### 🌎 Slack Community 344 | 345 | Join our [Open Source Community](https://cpco.io/slack?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-mwaa&utm_content=slack) on Slack. It's **FREE** for everyone! Our "SweetOps" community is where you get to talk with others who share a similar vision for how to rollout and manage infrastructure. This is the best place to talk shop, ask questions, solicit feedback, and work together as a community to build totally *sweet* infrastructure. 346 | 347 | ### 📰 Newsletter 348 | 349 | Sign up for [our newsletter](https://cpco.io/newsletter?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-mwaa&utm_content=newsletter) and join 3,000+ DevOps engineers, CTOs, and founders who get insider access to the latest DevOps trends, so you can always stay in the know. 350 | Dropped straight into your Inbox every week — and usually a 5-minute read. 351 | 352 | ### 📆 Office Hours 353 | 354 | [Join us every Wednesday via Zoom](https://cloudposse.com/office-hours?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-mwaa&utm_content=office_hours) for your weekly dose of insider DevOps trends, AWS news and Terraform insights, all sourced from our SweetOps community, plus a _live Q&A_ that you can’t find anywhere else. 355 | It's **FREE** for everyone! 356 | ## License 357 | 358 | License 359 | 360 |
361 | Preamble to the Apache License, Version 2.0 362 |
363 |
364 | 365 | Complete license is available in the [`LICENSE`](LICENSE) file. 366 | 367 | ```text 368 | Licensed to the Apache Software Foundation (ASF) under one 369 | or more contributor license agreements. See the NOTICE file 370 | distributed with this work for additional information 371 | regarding copyright ownership. The ASF licenses this file 372 | to you under the Apache License, Version 2.0 (the 373 | "License"); you may not use this file except in compliance 374 | with the License. You may obtain a copy of the License at 375 | 376 | https://www.apache.org/licenses/LICENSE-2.0 377 | 378 | Unless required by applicable law or agreed to in writing, 379 | software distributed under the License is distributed on an 380 | "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 381 | KIND, either express or implied. See the License for the 382 | specific language governing permissions and limitations 383 | under the License. 384 | ``` 385 |
386 | 387 | ## Trademarks 388 | 389 | All other trademarks referenced herein are the property of their respective owners. 390 | 391 | 392 | ## Copyrights 393 | 394 | Copyright © 2022-2025 [Cloud Posse, LLC](https://cloudposse.com) 395 | 396 | 397 | 398 | README footer 399 | 400 | Beacon 401 | --------------------------------------------------------------------------------