├── .gitignore ├── 0_remote_state ├── data.tf ├── provider.tf ├── img │ └── Remote-state.png ├── main.tf ├── usage.md ├── dynamodb.tf ├── outputs.tf ├── .terraform-docs.yml ├── README.md └── s3.tf ├── 1_pipeline ├── provider.tf ├── img │ └── CICD-pipeline-architecture.png ├── ssm_parameters.tf ├── variables.tf ├── main.tf ├── buildspecs │ ├── buildspec.yml │ ├── checkov.yml │ ├── terratest.yml │ ├── opa.yml │ ├── tflint.yml │ ├── terrascan.yml │ └── infracost.yml ├── .terraform-docs.yml ├── data.tf ├── usage.md ├── README.md ├── artifacts_s3.tf ├── codepipeline.tf └── codebuild.tf └── README.md /.gitignore: -------------------------------------------------------------------------------- 1 | .idea/ 2 | .terraform/ 3 | .terraform.lock.hcl 4 | *.tfstate* -------------------------------------------------------------------------------- /0_remote_state/data.tf: -------------------------------------------------------------------------------- 1 | data "aws_caller_identity" "current_account" {} 2 | -------------------------------------------------------------------------------- /1_pipeline/provider.tf: -------------------------------------------------------------------------------- 1 | provider "aws" { 2 | region = local.aws_region 3 | } 4 | -------------------------------------------------------------------------------- /0_remote_state/provider.tf: -------------------------------------------------------------------------------- 1 | provider "aws" { 2 | region = local.aws_region 3 | } 4 | -------------------------------------------------------------------------------- /0_remote_state/img/Remote-state.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/hands-on-cloud/aws-codepipeline-terraform-cicd-pipeline/HEAD/0_remote_state/img/Remote-state.png -------------------------------------------------------------------------------- /1_pipeline/img/CICD-pipeline-architecture.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/hands-on-cloud/aws-codepipeline-terraform-cicd-pipeline/HEAD/1_pipeline/img/CICD-pipeline-architecture.png -------------------------------------------------------------------------------- /1_pipeline/ssm_parameters.tf: -------------------------------------------------------------------------------- 1 | data "aws_caller_identity" "current" {} 2 | 3 | data "aws_ssm_parameter" "remote_state_bucket" { 4 | name = "${local.ssm_prefix}/tf-remote-state-bucket" 5 | } 6 | 7 | data "aws_ssm_parameter" "locks_table_arn" { 8 | name = "${local.ssm_prefix}/tf-locks-table-arn" 9 | } 10 | -------------------------------------------------------------------------------- /1_pipeline/variables.tf: -------------------------------------------------------------------------------- 1 | variable "repository_name" { 2 | default = "tf-demo-project" 3 | description = "CodeCommit repository name for CodePipeline builds" 4 | } 5 | 6 | variable "listen_branch_name" { 7 | default = "master" 8 | description = "CodeCommit branch name for CodePipeline builds" 9 | } 10 | -------------------------------------------------------------------------------- /0_remote_state/main.tf: -------------------------------------------------------------------------------- 1 | locals { 2 | aws_region = "us-west-2" 3 | prefix = "hands-on-cloud-terraform-remote-state" 4 | ssm_prefix = "/org/hands-on-cloud/terraform" 5 | common_tags = { 6 | Project = "hands-on-cloud" 7 | ManagedBy = "Terraform" 8 | } 9 | } 10 | -------------------------------------------------------------------------------- /0_remote_state/usage.md: -------------------------------------------------------------------------------- 1 | # Terraform remote state 2 | 3 | This module deploys AWS infrastructure to store Terraform remote state in S3 bucket and lock Terraform execution in DynamoDB table. 4 | 5 | ![Terraform remote state](img/Remote-state.png) 6 | 7 | ## Deployment 8 | 9 | ```sh 10 | terraform init 11 | terraform plan 12 | terraform apply -auto-approve 13 | ``` 14 | 15 | ## Tier down 16 | 17 | ```sh 18 | terraform destroy -auto-approve 19 | ``` 20 | -------------------------------------------------------------------------------- /1_pipeline/main.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | backend "s3" { 3 | bucket = "hands-on-cloud-terraform-remote-state-s3" 4 | key = "hands-on-cloud-terraform-demo-pipeline.tfstate" 5 | region = "us-west-2" 6 | encrypt = "true" 7 | } 8 | } 9 | 10 | locals { 11 | aws_region = "us-west-2" 12 | prefix = "${var.repository_name}-${var.listen_branch_name}-pipeline" 13 | ssm_prefix = "/org/hands-on-cloud/terraform" 14 | common_tags = { 15 | Project = local.prefix 16 | ManagedBy = "Terraform" 17 | } 18 | } 19 | 20 | -------------------------------------------------------------------------------- /0_remote_state/dynamodb.tf: -------------------------------------------------------------------------------- 1 | resource "aws_dynamodb_table" "lock_table" { 2 | name = "${local.prefix}-dynamodb" 3 | billing_mode = "PROVISIONED" 4 | read_capacity = 5 5 | write_capacity = 5 6 | hash_key = "LockID" 7 | tags = local.common_tags 8 | 9 | attribute { 10 | name = "LockID" 11 | type = "S" 12 | } 13 | } 14 | 15 | resource "aws_ssm_parameter" "locks_table_arn" { 16 | name = "${local.ssm_prefix}/tf-locks-table-arn" 17 | type = "String" 18 | value = aws_dynamodb_table.lock_table.arn 19 | } 20 | -------------------------------------------------------------------------------- /1_pipeline/buildspecs/buildspec.yml: -------------------------------------------------------------------------------- 1 | version: 0.2 2 | 3 | env: 4 | variables: 5 | TF_VERSION: "1.3.9" 6 | 7 | phases: 8 | 9 | install: 10 | commands: 11 | - cd /usr/bin 12 | - "curl -s -qL -o terraform.zip https://releases.hashicorp.com/terraform/${TF_VERSION}/terraform_${TF_VERSION}_linux_amd64.zip" 13 | - unzip -o terraform.zip 14 | 15 | build: 16 | commands: 17 | - cd "$CODEBUILD_SRC_DIR" 18 | - terraform init -no-color 19 | - terraform plan 20 | - terraform apply --auto-approve 21 | 22 | post_build: 23 | commands: 24 | - echo "terraform apply completed on `date`" 25 | -------------------------------------------------------------------------------- /1_pipeline/buildspecs/checkov.yml: -------------------------------------------------------------------------------- 1 | version: 0.2 2 | env: 3 | variables: 4 | TF_VERSION: "1.0.6" 5 | phases: 6 | install: 7 | runtime-versions: 8 | python: latest 9 | commands: 10 | - cd /usr/bin 11 | - "curl -s -qL -o terraform.zip https://releases.hashicorp.com/terraform/${TF_VERSION}/terraform_${TF_VERSION}_linux_amd64.zip" 12 | - unzip -o terraform.zip 13 | - python -V 14 | - pip3 install checkov 15 | build: 16 | commands: 17 | - cd "$CODEBUILD_SRC_DIR" 18 | - checkov --directory ./ --skip-check CKV_AWS_18,CKV_AWS_144 19 | post_build: 20 | commands: 21 | - echo "Checkov test is completed on `date`" 22 | -------------------------------------------------------------------------------- /1_pipeline/buildspecs/terratest.yml: -------------------------------------------------------------------------------- 1 | version: 0.2 2 | env: 3 | variables: 4 | TF_VERSION: "1.0.6" 5 | phases: 6 | install: 7 | commands: 8 | - cd /usr/bin 9 | - "curl -s -qL -o terraform.zip https://releases.hashicorp.com/terraform/${TF_VERSION}/terraform_${TF_VERSION}_linux_amd64.zip" 10 | - unzip -o terraform.zip 11 | build: 12 | commands: 13 | - cd "$CODEBUILD_SRC_DIR" 14 | - cd test/terratest 15 | - go mod init "tftest" 16 | - go get github.com/gruntwork-io/terratest/modules/aws 17 | - go get github.com/gruntwork-io/terratest/modules/terraform@v0.38.2 18 | - go test -v 19 | post_build: 20 | commands: 21 | - echo "terratest completed on `date`" 22 | -------------------------------------------------------------------------------- /0_remote_state/outputs.tf: -------------------------------------------------------------------------------- 1 | output "dynamodb-lock-table" { 2 | value = aws_dynamodb_table.lock_table.name 3 | description = "DynamoDB table for Terraform execution locks" 4 | } 5 | 6 | output "dynamodb-lock-table-ssm-parameter" { 7 | value = "${local.ssm_prefix}/tf-locks-table-arn" 8 | description = "SSM parameter containing DynamoDB table for Terraform execution locks" 9 | } 10 | 11 | output "s3-state-bucket" { 12 | value = aws_s3_bucket.remote_state.id 13 | description = "S3 bucket for storing Terraform state" 14 | } 15 | 16 | output "s3-state-bucket-ssm-parameter" { 17 | value = "${local.ssm_prefix}/tf-remote-state-bucket" 18 | description = "SSM parameter containing S3 bucket for storing Terraform state" 19 | } 20 | -------------------------------------------------------------------------------- /1_pipeline/buildspecs/opa.yml: -------------------------------------------------------------------------------- 1 | version: 0.2 2 | env: 3 | variables: 4 | TF_VERSION: "1.0.6" 5 | phases: 6 | install: 7 | commands: 8 | - cd /usr/bin 9 | - "curl -s -qL -o terraform.zip https://releases.hashicorp.com/terraform/${TF_VERSION}/terraform_${TF_VERSION}_linux_amd64.zip" 10 | - unzip -o terraform.zip 11 | - curl -L -o opa https://openpolicyagent.org/downloads/v0.32.0/opa_linux_amd64_static 12 | - chmod 755 ./opa 13 | build: 14 | commands: 15 | - cd "$CODEBUILD_SRC_DIR" 16 | - terraform init -no-color 17 | - terraform plan -out tf.plan 18 | - terraform show -json tf.plan > tf.json 19 | - opa eval --format pretty --data ./test/opa/terraform.rego --input tf.json "data.terraform" 20 | post_build: 21 | commands: 22 | - echo "OPA Test completed on `date`" 23 | -------------------------------------------------------------------------------- /1_pipeline/buildspecs/tflint.yml: -------------------------------------------------------------------------------- 1 | version: 0.2 2 | env: 3 | variables: 4 | TF_VERSION: "1.0.6" 5 | phases: 6 | install: 7 | commands: 8 | - cd /usr/bin 9 | - "curl -s -qL -o terraform.zip https://releases.hashicorp.com/terraform/${TF_VERSION}/terraform_${TF_VERSION}_linux_amd64.zip" 10 | - unzip -o terraform.zip 11 | - "curl --location https://github.com/terraform-linters/tflint/releases/download/v0.33.0/tflint_linux_amd64.zip --output tflint_linux_amd64.zip" 12 | - unzip -o tflint_linux_amd64.zip 13 | build: 14 | commands: 15 | - cd "$CODEBUILD_SRC_DIR" 16 | - terraform init 17 | - terraform validate 18 | - tflint --init 19 | - tflint 20 | post_build: 21 | commands: 22 | - echo "terraform validate completed on `date`" 23 | - echo "tflint completed on `date`" 24 | -------------------------------------------------------------------------------- /1_pipeline/buildspecs/terrascan.yml: -------------------------------------------------------------------------------- 1 | version: 0.2 2 | env: 3 | variables: 4 | TF_VERSION: "1.0.6" 5 | TERRASCAN_VERSION: "1.9.0" 6 | phases: 7 | install: 8 | runtime-versions: 9 | python: latest 10 | commands: 11 | - cd /usr/bin 12 | - "curl -s -qL -o terraform.zip https://releases.hashicorp.com/terraform/${TF_VERSION}/terraform_${TF_VERSION}_linux_amd64.zip" 13 | - unzip -o terraform.zip 14 | - "curl -L -o terrascan_${TERRASCAN_VERSION}_Linux_x86_64.tar.gz https://github.com/accurics/terrascan/releases/download/v${TERRASCAN_VERSION}/terrascan_${TERRASCAN_VERSION}_Linux_x86_64.tar.gz" 15 | - "tar -xf terrascan_${TERRASCAN_VERSION}_Linux_x86_64.tar.gz terrascan" 16 | build: 17 | commands: 18 | - cd "$CODEBUILD_SRC_DIR" 19 | - terrascan init 20 | - terrascan scan -i terraform 21 | post_build: 22 | commands: 23 | - echo "Terrascan test is completed on `date`" 24 | -------------------------------------------------------------------------------- /0_remote_state/.terraform-docs.yml: -------------------------------------------------------------------------------- 1 | formatter: "markdown" 2 | 3 | version: "" 4 | 5 | header-from: main.tf 6 | footer-from: "" 7 | 8 | recursive: 9 | enabled: false 10 | path: modules 11 | 12 | sections: 13 | hide: [] 14 | show: [] 15 | 16 | content: |- 17 | {{ include "./usage.md" }} 18 | {{ .Providers }} 19 | {{ .Resources }} 20 | {{ .Outputs }} 21 | 22 | output: 23 | file: README.md 24 | mode: inject 25 | template: |- 26 | 27 | 28 | {{ .Content }} 29 | 30 | 31 | 32 | output-values: 33 | enabled: false 34 | from: "" 35 | 36 | sort: 37 | enabled: true 38 | by: name 39 | 40 | settings: 41 | anchor: true 42 | color: true 43 | default: true 44 | description: false 45 | escape: true 46 | hide-empty: false 47 | html: true 48 | indent: 2 49 | lockfile: true 50 | read-comments: true 51 | required: true 52 | sensitive: true 53 | type: true 54 | -------------------------------------------------------------------------------- /1_pipeline/.terraform-docs.yml: -------------------------------------------------------------------------------- 1 | formatter: "markdown" 2 | 3 | version: "" 4 | 5 | header-from: main.tf 6 | footer-from: "" 7 | 8 | recursive: 9 | enabled: false 10 | path: modules 11 | 12 | sections: 13 | hide: [] 14 | show: [] 15 | 16 | content: |- 17 | {{ include "./usage.md" }} 18 | {{ .Providers }} 19 | {{ .Resources }} 20 | {{ .Outputs }} 21 | 22 | output: 23 | file: README.md 24 | mode: inject 25 | template: |- 26 | 27 | 28 | {{ .Content }} 29 | 30 | 31 | 32 | output-values: 33 | enabled: false 34 | from: "" 35 | 36 | sort: 37 | enabled: true 38 | by: name 39 | 40 | settings: 41 | anchor: true 42 | color: true 43 | default: true 44 | description: false 45 | escape: true 46 | hide-empty: false 47 | html: true 48 | indent: 2 49 | lockfile: true 50 | read-comments: true 51 | required: true 52 | sensitive: true 53 | type: true 54 | -------------------------------------------------------------------------------- /1_pipeline/buildspecs/infracost.yml: -------------------------------------------------------------------------------- 1 | version: 0.2 2 | env: 3 | variables: 4 | TF_VERSION: "1.0.6" 5 | INFRACOST_API_KEY_SSM_PARAM_NAME: "/org/hands-on-cloud/terraform/infracost_api_key" 6 | phases: 7 | install: 8 | commands: 9 | - cd /usr/bin 10 | - "curl -s -qL -o terraform.zip https://releases.hashicorp.com/terraform/${TF_VERSION}/terraform_${TF_VERSION}_linux_amd64.zip" 11 | - unzip -o terraform.zip 12 | - apt-get update 13 | - apt-get -y install sudo 14 | - "curl -fsSL https://raw.githubusercontent.com/infracost/infracost/master/scripts/install.sh | bash" 15 | build: 16 | commands: 17 | - cd "$CODEBUILD_SRC_DIR" 18 | - 'export INFRACOST_API_KEY=$(aws --region=us-west-2 ssm get-parameter --name "${INFRACOST_API_KEY_SSM_PARAM_NAME}" --with-decryption --output text --query Parameter.Value)' 19 | - infracost breakdown --path . 20 | post_build: 21 | commands: 22 | - echo "Costs breakdown completed on `date`" 23 | -------------------------------------------------------------------------------- /1_pipeline/data.tf: -------------------------------------------------------------------------------- 1 | 2 | data "aws_caller_identity" "current_account" { 3 | # To retrieve the account ID -- needed for KMS key policy 4 | } 5 | 6 | 7 | data "aws_region" "current_region" { 8 | # To retrieve the current AWS region 9 | } 10 | 11 | ##### Buildspecs ##### 12 | data "local_file" "buildspec" { 13 | filename = "${path.module}/buildspecs/buildspec.yml" 14 | } 15 | 16 | data "local_file" "checkov" { 17 | filename = "${path.module}/buildspecs/checkov.yml" 18 | } 19 | 20 | 21 | data "local_file" "infracost" { 22 | filename = "${path.module}/buildspecs/infracost.yml" 23 | } 24 | 25 | data "local_file" "opa" { 26 | filename = "${path.module}/buildspecs/opa.yml" 27 | } 28 | 29 | data "local_file" "terrascan" { 30 | filename = "${path.module}/buildspecs/terrascan.yml" 31 | } 32 | 33 | data "local_file" "terratest" { 34 | filename = "${path.module}/buildspecs/terratest.yml" 35 | } 36 | 37 | data "local_file" "tflint" { 38 | filename = "${path.module}/buildspecs/tflint.yml" 39 | } 40 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # How to use CodePipeline CICD pipeline to test Terraform modules 2 | 3 | This is a demo Terraform repository to set up AWS CodePipeline to test Terraform projects using tflint, Checkov, OPA, Terrascan, and Terratest. 4 | 5 | Check out [How to use CodePipeline CICD pipeline to test Terraform](https://hands-on.cloud/how-to-use-codepipeline-cicd-pipeline-to-test-terraform/) article for more information. 6 | 7 | ![CICD pipeline architecture](1_pipeline/img/CICD-pipeline-architecture.png) 8 | 9 | ## Set up Terraform remote state infrastructure 10 | 11 | This step is required to set up an infrastructure to store Terraform remote state files 12 | 13 | ```sh 14 | cd 0_remote_state 15 | terraform init 16 | terraform plan 17 | terraform apply -auto-approve 18 | ``` 19 | 20 | ## Set up AWS CodePipeline 21 | 22 | This step is required to set up an AWS CodePipeline to test Terraform projects using tflint, Checkov, OPA, Terrascan, and Terratest. 23 | 24 | ```sh 25 | cd 1_pipeline 26 | terraform init 27 | terraform plan 28 | terraform apply -auto-approve 29 | ``` 30 | -------------------------------------------------------------------------------- /1_pipeline/usage.md: -------------------------------------------------------------------------------- 1 | # AWS CodePipeline demo CICD pipeline for testing Terraform projects 2 | 3 | This module deploys AWS CodePipeline, which uses tflint, Checkov, OPA, Terrascan, and Terratest to test Terraform modules. 4 | 5 | Check out [How to use CodePipeline CICD pipeline to test Terraform](https://hands-on.cloud/how-to-use-codepipeline-cicd-pipeline-to-test-terraform/) article for more information. 6 | 7 | ![CICD pipeline architecture](img/CICD-pipeline-architecture.png) 8 | 9 | ## Deployment 10 | 11 | Manually create SSM Parameter store parameter to store Infracost API key. For example: 12 | 13 | * Key name: `/org/hands-on-cloud/terraform/infracost_api_key` 14 | * Type: `SecureString` 15 | * Description: `Infracost API key` 16 | * Value: `YOUR_INFRACOST_API_KEY` (Use `infracost register` to get one) 17 | 18 | By default, we're using the following prefix for SSM Parameter Store keys `/org/hands-on-cloud/terraform` (defined in [ssm_parameters](ssm_parameters.tf) file). 19 | 20 | ```sh 21 | terraform init 22 | terraform plan 23 | terraform apply -auto-approve 24 | ``` 25 | 26 | ## Tier down 27 | 28 | ```sh 29 | terraform destroy -auto-approve 30 | ``` 31 | -------------------------------------------------------------------------------- /0_remote_state/README.md: -------------------------------------------------------------------------------- 1 | 2 | 3 | # Terraform remote state 4 | 5 | This module deploys AWS infrastructure to store Terraform remote state in S3 bucket and lock Terraform execution in DynamoDB table. 6 | 7 | ![Terraform remote state](img/Remote-state.png) 8 | 9 | ## Deployment 10 | 11 | ```sh 12 | terraform init 13 | terraform plan 14 | terraform apply -auto-approve 15 | ``` 16 | 17 | ## Tier down 18 | 19 | ```sh 20 | terraform destroy -auto-approve 21 | ``` 22 | ## Providers 23 | 24 | | Name | Version | 25 | |------|---------| 26 | | [aws](#provider\_aws) | n/a | 27 | ## Resources 28 | 29 | | Name | Type | 30 | |------|------| 31 | | [aws_dynamodb_table.lock_table](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dynamodb_table) | resource | 32 | | [aws_s3_bucket.remote_state](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource | 33 | | [aws_s3_bucket_policy.remote_state](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource | 34 | | [aws_s3_bucket_public_access_block.s3Public_remote_state](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource | 35 | | [aws_ssm_parameter.locks_table_arn](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource | 36 | | [aws_ssm_parameter.remote_state_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource | 37 | ## Outputs 38 | 39 | | Name | Description | 40 | |------|-------------| 41 | | [dynamodb-lock-table](#output\_dynamodb-lock-table) | DynamoDB table for Terraform execution locks | 42 | | [dynamodb-lock-table-ssm-parameter](#output\_dynamodb-lock-table-ssm-parameter) | SSM parameter containing DynamoDB table for Terraform execution locks | 43 | | [s3-state-bucket](#output\_s3-state-bucket) | S3 bucket for storing Terraform state | 44 | | [s3-state-bucket-ssm-parameter](#output\_s3-state-bucket-ssm-parameter) | SSM parameter containing S3 bucket for storing Terraform state | 45 | 46 | -------------------------------------------------------------------------------- /1_pipeline/README.md: -------------------------------------------------------------------------------- 1 | 2 | 3 | # AWS CodePipeline demo CICD pipeline for testing Terraform projects 4 | 5 | This module deploys AWS CodePipeline, which uses tflint, Checkov, OPA, Terrascan, and Terratest to test Terraform modules. 6 | 7 | Check out [How to use CodePipeline CICD pipeline to test Terraform](https://hands-on.cloud/how-to-use-codepipeline-cicd-pipeline-to-test-terraform/) article for more information. 8 | 9 | ![CICD pipeline architecture](img/CICD-pipeline-architecture.png) 10 | 11 | ## Deployment 12 | 13 | ```sh 14 | terraform init 15 | terraform plan 16 | terraform apply -auto-approve 17 | ``` 18 | 19 | ## Tier down 20 | 21 | ```sh 22 | terraform destroy -auto-approve 23 | ``` 24 | ## Providers 25 | 26 | | Name | Version | 27 | |------|---------| 28 | | [aws](#provider\_aws) | 3.63.0 | 29 | ## Resources 30 | 31 | | Name | Type | 32 | |------|------| 33 | | [aws_codebuild_project.checkov](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/codebuild_project) | resource | 34 | | [aws_codebuild_project.opa](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/codebuild_project) | resource | 35 | | [aws_codebuild_project.terrascan](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/codebuild_project) | resource | 36 | | [aws_codebuild_project.terratest](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/codebuild_project) | resource | 37 | | [aws_codebuild_project.tf_apply](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/codebuild_project) | resource | 38 | | [aws_codebuild_project.tflint](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/codebuild_project) | resource | 39 | | [aws_codepipeline.demo](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/codepipeline) | resource | 40 | | [aws_iam_role.codebuild](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | 41 | | [aws_iam_role.codepipeline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | 42 | | [aws_iam_role_policy.codebuild](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource | 43 | | [aws_iam_role_policy.codepipeline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource | 44 | | [aws_s3_bucket.artifacts](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource | 45 | | [aws_s3_bucket_public_access_block.s3Public_artifacts](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource | 46 | | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | 47 | | [aws_ssm_parameter.locks_table_arn](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source | 48 | | [aws_ssm_parameter.remote_state_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source | 49 | ## Outputs 50 | 51 | No outputs. 52 | 53 | -------------------------------------------------------------------------------- /1_pipeline/artifacts_s3.tf: -------------------------------------------------------------------------------- 1 | resource "aws_s3_bucket" "artifacts" { 2 | #checkov:skip=CKV_AWS_144: "Cross Region Unneccessary" 3 | #checkov:skip=CKV_AWS_145: "Bucket Encryption IS enabled separately" 4 | 5 | bucket = "${var.project_name}-s3" 6 | force_destroy = true 7 | lifecycle { 8 | prevent_destroy = false 9 | } 10 | 11 | tags = local.common_tags 12 | } 13 | 14 | resource "aws_s3_bucket_public_access_block" "s3Public_artifacts" { 15 | bucket = aws_s3_bucket.artifacts.id 16 | block_public_acls = true 17 | block_public_policy = true 18 | ignore_public_acls = true 19 | restrict_public_buckets = true 20 | } 21 | 22 | 23 | 24 | resource "aws_s3_bucket_logging" "example" { 25 | bucket = aws_s3_bucket.artifacts.id 26 | target_bucket = var.logging_bucket 27 | target_prefix = "s3/${aws_s3_bucket.artifacts.id}/" 28 | } 29 | 30 | 31 | resource "aws_s3_bucket_server_side_encryption_configuration" "example" { 32 | bucket = aws_s3_bucket.artifacts.id 33 | rule { 34 | apply_server_side_encryption_by_default { 35 | sse_algorithm = "AES256" 36 | } 37 | bucket_key_enabled = true 38 | } 39 | } 40 | 41 | resource "aws_s3_bucket_versioning" "versioning" { 42 | bucket = aws_s3_bucket.artifacts.id 43 | versioning_configuration { 44 | status = "Enabled" 45 | } 46 | } 47 | 48 | 49 | resource "aws_s3_bucket_acl" "bucket_acl" { 50 | bucket = aws_s3_bucket.artifacts.id 51 | acl = "private" 52 | } 53 | 54 | 55 | resource "aws_s3_bucket_logging" "artifacts" { 56 | bucket = aws_s3_bucket.artifacts.id 57 | target_bucket = var.logging_bucket 58 | target_prefix = "s3/${aws_s3_bucket.artifacts.id}/" 59 | } 60 | 61 | resource "aws_s3_bucket_policy" "artifacts" { 62 | bucket = aws_s3_bucket.artifacts.id 63 | 64 | policy = <