update oidc branch based on a simplified ecs module

CDCgov · Sep 4, 2024 · ba1bc44 · ba1bc44
1 parent 768cf52
commit ba1bc44
Show file tree

Hide file tree

Showing 9 changed files with 467 additions and 130 deletions.
diff --git a/terraform/implementation/ecs/ecs.sh b/terraform/implementation/ecs/ecs.sh
@@ -145,5 +145,5 @@ fi
 if [ "$CI" = false ]; then
     terraform apply -var-file="$ENVIRONMENT.tfvars"
 else
-    terraform apply -auto-approve -var-file="$ENVIRONMENT.tfvars"
+    terraform destroy -auto-approve -var-file="$ENVIRONMENT.tfvars"
 fi
diff --git a/terraform/implementation/setup/iam.tf b/terraform/implementation/setup/iam.tf
diff --git a/terraform/implementation/setup/main.tf b/terraform/implementation/setup/main.tf
@@ -11,6 +11,22 @@ provider "aws" {
   }
 }
 
+# GitHub OIDC for prod
+module "oidc" {
+  source = "../../modules/oidc"
+
+  # The github repo that will be used for OIDC
+  oidc_github_repo = var.oidc_github_repo
+
+  # These variables must match the values that you'll be using for your ECS module call in the /ecs module
+  region           = var.region
+  owner            = var.owner
+  project          = var.project
+
+  # This variable must match the name of the terraform workspace that you'll be using for your ECS module call in the /ecs module
+  workspace        = "prod"
+}
+
 resource "random_string" "setup" {
   length  = 8
   special = false
@@ -69,7 +85,7 @@ resource "local_file" "setup_env" {
     BUCKET="${aws_s3_bucket.tfstate.bucket}"
     DYNAMODB_TABLE="${aws_dynamodb_table.tfstate_lock.id}"
     REGION="${var.region}"
-    TERRAFORM_ROLE="${aws_iam_role.github.arn}"
+    TERRAFORM_ROLE="${module.oidc.role.arn}"
   EOT
   filename = ".env"
 }
@@ -79,7 +95,7 @@ resource "local_file" "ecs_env" {
     BUCKET="${aws_s3_bucket.tfstate.bucket}"
     DYNAMODB_TABLE="${aws_dynamodb_table.tfstate_lock.id}"
     REGION="${var.region}"
-    TERRAFORM_ROLE="${aws_iam_role.github.arn}"
+    TERRAFORM_ROLE="${module.oidc.role.arn}"
   EOT
   filename = "../ecs/.env"
 }
diff --git a/terraform/implementation/setup/setup.sh b/terraform/implementation/setup/setup.sh
@@ -52,7 +52,7 @@ if ! grep -q "region" "$WORKSPACE.tfvars"; then
 fi
 
 if ! grep -q "oidc_github_repo" "$WORKSPACE.tfvars"; then
-    read -p "Are you using GitHub for your source control? (y/n): " github_choice
+    read -p "Do you want to setup a GitHub IODC role? (y/n): " github_choice
     if [[ "$github_choice" =~ ^[Yy]$ ]]; then
         read -p "What is the organization/repo value for assume role? ( default=\"\" ): " repo_choice
         repo_choice=${repo_choice:-""}