Skip to content

Commit f0f3f9b

Browse files
darrillagaclaude
darrillaga
and
claude
committed
Fix Terraform config to match DAP/people-cvs patterns
- Use correct S3 backend bucket (terraform-crunchloop-aws) - Use remote state for EKS OIDC provider instead of hardcoded values - Use data.aws_caller_identity for account ID - Reference GitHub OIDC from crunchloop-oidc-dev remote state - Use proper IAM policy document resources - Add role-session-name to CD workflow Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 32a21eb commit f0f3f9b

7 files changed

Lines changed: 129 additions & 104 deletions

File tree

‎.github/workflows/cd.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ jobs:
5656
uses: aws-actions/configure-aws-credentials@v4
5757
with:
5858
role-to-assume: arn:aws:iam::176434290504:role/workshops-github-deploy
59+
role-session-name: workshops-github-deploy
5960
aws-region: ${{ env.AWS_REGION }}
6061

6162
- name: Configure kubeconfig

‎infra/aws/app/eks-deploy-irsa.tf‎

Lines changed: 50 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,49 +1,62 @@
1-
locals {
2-
oidc_provider = replace(data.aws_eks_cluster.k8_dev.identity[0].oidc[0].issuer, "https://", "")
3-
github_oidc_arn = "arn:aws:iam::${var.aws_account_id}:oidc-provider/token.actions.githubusercontent.com"
1+
# Remote state: GitHub OIDC Provider
2+
data "terraform_remote_state" "oidc" {
3+
backend = "s3"
4+
config = {
5+
bucket = "terraform-crunchloop-aws"
6+
key = "crunchloop-oidc-dev.tfstate"
7+
region = "us-east-1"
8+
}
49
}
510

6-
# IAM role for GitHub Actions to deploy to EKS
7-
resource "aws_iam_role" "github_deploy" {
8-
name = "workshops-github-deploy"
11+
# EKS deploy policy
12+
data "aws_iam_policy_document" "workshops_github_deploy" {
13+
statement {
14+
effect = "Allow"
15+
actions = [
16+
"eks:DescribeCluster",
17+
"eks:ListClusters"
18+
]
19+
resources = ["*"]
20+
}
21+
}
22+
23+
resource "aws_iam_policy" "workshops_github_deploy" {
24+
name = "workshops-github-deploy-policy"
25+
description = "IAM policy for GitHub Actions to deploy workshops to EKS cluster"
26+
policy = data.aws_iam_policy_document.workshops_github_deploy.json
27+
}
28+
29+
# IAM role for GitHub Actions with OIDC trust policy
30+
resource "aws_iam_role" "workshops_github_deploy" {
31+
name = "workshops-github-deploy"
32+
description = "IAM role for GitHub Actions to deploy workshops to EKS with OIDC"
933

1034
assume_role_policy = jsonencode({
1135
Version = "2012-10-17"
12-
Statement = [
13-
{
14-
Effect = "Allow"
15-
Principal = {
16-
Federated = local.github_oidc_arn
36+
Statement = [{
37+
Effect = "Allow"
38+
Principal = {
39+
Federated = data.terraform_remote_state.oidc.outputs.github_oidc_provider_arn
40+
}
41+
Action = "sts:AssumeRoleWithWebIdentity"
42+
Condition = {
43+
StringEquals = {
44+
"token.actions.githubusercontent.com:aud" = "sts.amazonaws.com"
1745
}
18-
Action = "sts:AssumeRoleWithWebIdentity"
19-
Condition = {
20-
StringEquals = {
21-
"token.actions.githubusercontent.com:aud" = "sts.amazonaws.com"
22-
}
23-
StringLike = {
24-
"token.actions.githubusercontent.com:sub" = "repo:crunchloop/workshops:*"
25-
}
46+
StringLike = {
47+
"token.actions.githubusercontent.com:sub" = "repo:${local.github_repo}:*"
2648
}
2749
}
28-
]
50+
}]
2951
})
30-
}
3152

32-
resource "aws_iam_role_policy" "github_deploy_eks" {
33-
name = "eks-access"
34-
role = aws_iam_role.github_deploy.id
53+
tags = {
54+
Name = "workshops-github-deploy"
55+
}
56+
}
3557

36-
policy = jsonencode({
37-
Version = "2012-10-17"
38-
Statement = [
39-
{
40-
Effect = "Allow"
41-
Action = [
42-
"eks:DescribeCluster",
43-
"eks:ListClusters"
44-
]
45-
Resource = "*"
46-
}
47-
]
48-
})
58+
# Attach the custom policy to the IAM role
59+
resource "aws_iam_role_policy_attachment" "workshops_github_deploy" {
60+
role = aws_iam_role.workshops_github_deploy.name
61+
policy_arn = aws_iam_policy.workshops_github_deploy.arn
4962
}

‎infra/aws/app/external-secrets-irsa.tf‎

Lines changed: 43 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,42 +1,52 @@
1-
# IAM role for External Secrets Operator to read from Secrets Manager
2-
resource "aws_iam_role" "external_secrets" {
3-
name = "workshops-external-secrets"
1+
# External Secrets policy
2+
data "aws_iam_policy_document" "workshops_external_secrets" {
3+
statement {
4+
effect = "Allow"
5+
actions = [
6+
"secretsmanager:GetSecretValue",
7+
"secretsmanager:DescribeSecret"
8+
]
9+
resources = [
10+
"arn:aws:secretsmanager:sa-east-1:${data.aws_caller_identity.current.account_id}:secret:/workshops/*",
11+
"arn:aws:secretsmanager:sa-east-1:${data.aws_caller_identity.current.account_id}:secret:workshops/*"
12+
]
13+
}
14+
}
15+
16+
resource "aws_iam_policy" "workshops_external_secrets" {
17+
name = "workshops-external-secrets-policy"
18+
description = "IAM policy for External Secrets to read workshops secrets"
19+
policy = data.aws_iam_policy_document.workshops_external_secrets.json
20+
}
21+
22+
# IAM role for External Secrets Operator
23+
resource "aws_iam_role" "workshops_external_secrets" {
24+
name = "workshops-external-secrets"
25+
description = "IAM role for External Secrets Operator in workshops namespace"
426

527
assume_role_policy = jsonencode({
628
Version = "2012-10-17"
7-
Statement = [
8-
{
9-
Effect = "Allow"
10-
Principal = {
11-
Federated = "arn:aws:iam::${var.aws_account_id}:oidc-provider/${local.oidc_provider}"
12-
}
13-
Action = "sts:AssumeRoleWithWebIdentity"
14-
Condition = {
15-
StringEquals = {
16-
"${local.oidc_provider}:sub" = "system:serviceaccount:${var.namespace}:external-secrets"
17-
"${local.oidc_provider}:aud" = "sts.amazonaws.com"
18-
}
29+
Statement = [{
30+
Effect = "Allow"
31+
Principal = {
32+
Federated = data.terraform_remote_state.eks.outputs.oidc_provider_arn
33+
}
34+
Action = "sts:AssumeRoleWithWebIdentity"
35+
Condition = {
36+
StringEquals = {
37+
"${replace(data.terraform_remote_state.eks.outputs.oidc_provider_arn, "/^(.*provider/)/", "")}:sub" = "system:serviceaccount:${var.namespace}:external-secrets"
38+
"${replace(data.terraform_remote_state.eks.outputs.oidc_provider_arn, "/^(.*provider/)/", "")}:aud" = "sts.amazonaws.com"
1939
}
2040
}
21-
]
41+
}]
2242
})
23-
}
2443

25-
resource "aws_iam_role_policy" "external_secrets" {
26-
name = "secrets-access"
27-
role = aws_iam_role.external_secrets.id
44+
tags = {
45+
Name = "workshops-external-secrets"
46+
}
47+
}
2848

29-
policy = jsonencode({
30-
Version = "2012-10-17"
31-
Statement = [
32-
{
33-
Effect = "Allow"
34-
Action = [
35-
"secretsmanager:GetSecretValue",
36-
"secretsmanager:DescribeSecret"
37-
]
38-
Resource = "arn:aws:secretsmanager:${var.aws_region}:${var.aws_account_id}:secret:/workshops/*"
39-
}
40-
]
41-
})
49+
resource "aws_iam_role_policy_attachment" "workshops_external_secrets" {
50+
role = aws_iam_role.workshops_external_secrets.name
51+
policy_arn = aws_iam_policy.workshops_external_secrets.arn
4252
}

‎infra/aws/app/main.tf‎

Lines changed: 32 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,51 @@
11
terraform {
2+
required_version = ">= 1.5.7"
3+
24
backend "s3" {
3-
bucket = "crunchloop-terraform-state"
4-
key = "workshops/app/terraform.tfstate"
5-
region = "sa-east-1"
5+
bucket = "terraform-crunchloop-aws"
6+
key = "apps-workshops.tfstate"
7+
region = "us-east-1"
68
}
79

810
required_providers {
911
aws = {
1012
source = "hashicorp/aws"
11-
version = "~> 5.0"
13+
version = "~> 6.20"
1214
}
1315
}
1416
}
1517

18+
locals {
19+
aws_region = "sa-east-1"
20+
github_repo = "crunchloop/workshops"
21+
}
22+
1623
provider "aws" {
17-
region = var.aws_region
24+
region = local.aws_region
25+
profile = "development"
26+
27+
allowed_account_ids = [
28+
"176434290504"
29+
]
30+
31+
default_tags {
32+
tags = {
33+
Terraform = "true"
34+
Application = "workshops"
35+
Environment = "dev"
36+
}
37+
}
1838
}
1939

20-
data "terraform_remote_state" "vpc" {
40+
# Remote state: EKS cluster (for OIDC provider)
41+
data "terraform_remote_state" "eks" {
2142
backend = "s3"
2243
config = {
23-
bucket = "crunchloop-terraform-state"
24-
key = "crunchloop-vpc-dev/terraform.tfstate"
25-
region = "sa-east-1"
44+
bucket = "terraform-crunchloop-aws"
45+
key = "crunchloop-k8-dev.tfstate"
46+
region = "us-east-1"
2647
}
2748
}
2849

29-
data "aws_eks_cluster" "k8_dev" {
30-
name = var.eks_cluster_name
31-
}
50+
# AWS caller identity
51+
data "aws_caller_identity" "current" {}

‎infra/aws/app/outputs.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
output "deploy_role_arn" {
22
description = "ARN of the GitHub Actions deploy role"
3-
value = aws_iam_role.github_deploy.arn
3+
value = aws_iam_role.workshops_github_deploy.arn
44
}
55

66
output "external_secrets_role_arn" {
77
description = "ARN of the External Secrets role"
8-
value = aws_iam_role.external_secrets.arn
8+
value = aws_iam_role.workshops_external_secrets.arn
99
}

‎infra/aws/app/variables.tf‎

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,3 @@
1-
variable "aws_region" {
2-
description = "AWS region"
3-
type = string
4-
default = "sa-east-1"
5-
}
6-
7-
variable "aws_account_id" {
8-
description = "AWS account ID"
9-
type = string
10-
default = "176434290504"
11-
}
12-
13-
variable "eks_cluster_name" {
14-
description = "EKS cluster name"
15-
type = string
16-
default = "k8-dev"
17-
}
18-
191
variable "namespace" {
202
description = "Kubernetes namespace"
213
type = string

‎infra/k8/apps/values/workshops.yaml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,5 +29,4 @@ nodeSelector:
2929
serviceAccount:
3030
create: true
3131
name: workshops
32-
annotations:
33-
eks.amazonaws.com/role-arn: arn:aws:iam::176434290504:role/workshops-external-secrets
32+
annotations: {}

0 commit comments

Comments
 (0)