diff --git a/Jenkinsfile_k8s b/Jenkinsfile_k8s index eba60d8..124c9a1 100644 --- a/Jenkinsfile_k8s +++ b/Jenkinsfile_k8s @@ -2,22 +2,19 @@ if (env.BRANCH_IS_PRIMARY) { // Only trigger a daily check on the principal branch properties([pipelineTriggers([cron('@daily')])]) } -withEnv([ - "TF_VAR_aws_profile=default" -]) { - terraform( - stagingCredentials: [ - string(variable: 'AWS_ACCESS_KEY_ID', credentialsId: 'staging-terraform-aws-sponsorship-access-key'), - string(variable: 'AWS_SECRET_ACCESS_KEY', credentialsId:'staging-terraform-aws-sponsorship-secret-key'), - file(variable: 'BACKEND_CONFIG_FILE', credentialsId: 'staging-terraform-aws-sponsorship-backend-config'), - ], - productionCredentials: [ - string(variable: 'AWS_ACCESS_KEY_ID', credentialsId: 'production-terraform-aws-sponsorship-access-key'), - string(variable: 'AWS_SECRET_ACCESS_KEY', credentialsId:'production-terraform-aws-sponsorship-secret-key'), - file(variable: 'BACKEND_CONFIG_FILE', credentialsId: 'production-terraform-aws-sponsorship-backend-config'), - ], - // TODO: generate a local report to be published - // publishReports: ['jenkins-infra-data-reports/aws-sponsorship.json'], - ) -} +terraform( + stagingCredentials: [ + string(variable: 'AWS_ACCESS_KEY_ID', credentialsId: 'staging-terraform-aws-sponsorship-access-key'), + string(variable: 'AWS_SECRET_ACCESS_KEY', credentialsId:'staging-terraform-aws-sponsorship-secret-key'), + file(variable: 'BACKEND_CONFIG_FILE', credentialsId: 'staging-terraform-aws-sponsorship-backend-config'), + ], + productionCredentials: [ + string(variable: 'AWS_ACCESS_KEY_ID', credentialsId: 'production-terraform-aws-sponsorship-access-key'), + string(variable: 'AWS_SECRET_ACCESS_KEY', credentialsId:'production-terraform-aws-sponsorship-secret-key'), + + file(variable: 'BACKEND_CONFIG_FILE', credentialsId: 'production-terraform-aws-sponsorship-backend-config'), + ], + // TODO: generate a local report to be published + // publishReports: ['jenkins-infra-data-reports/aws-sponsorship.json'], +) diff --git a/packer-resources.tf b/packer-resources.tf deleted file mode 100644 index a99adc8..0000000 --- a/packer-resources.tf +++ /dev/null @@ -1,100 +0,0 @@ -resource "aws_iam_user" "terraform_packer_user" { - name = "terraform-packer-user" - - tags = { - scope = "terraform-managed" - } -} - -resource "aws_iam_access_key" "terraform_packer_api_keys" { - user = aws_iam_user.terraform_packer_user.name - # TODO CHECK WITH DAMIEN No pgp_key provided: the secret value is unencrypted in the state file (which is fine: we encrypt the state file here with sops) -} - -resource "aws_iam_policy" "packer" { - name = "packer.iam_policy" - path = "/" - description = "IAM Policy to allow packer user usage on AWS" - - policy = data.aws_iam_policy_document.packer.json -} - -data "aws_iam_policy_document" "packer" { - statement { - sid = "ec2" - effect = "Allow" - - actions = [ - "ec2:AllocateAddress", - "ec2:AssignPrivateIpAddresses", - "ec2:Associate*", - "ec2:AttachInternetGateway", - "ec2:AttachNetworkInterface", - "ec2:AuthorizeSecurityGroupEgress", - "ec2:AuthorizeSecurityGroupIngress", - "ec2:CreateDefaultSubnet", - "ec2:CreateDhcpOptions", - "ec2:CreateEgressOnlyInternetGateway", - "ec2:CreateInternetGateway", - "ec2:CreateKeyPair", - "ec2:CreateLaunchTemplate", - "ec2:CreateLaunchTemplateVersion", - "ec2:CreateNatGateway", - "ec2:CreateNetworkInterface", - "ec2:CreateRoute", - "ec2:CreateRouteTable", - "ec2:CreateSecurityGroup", - "ec2:CreateSubnet", - "ec2:CreateTags", - "ec2:CreateVolume", - "ec2:CreateVpc", - "ec2:CreateVpcEndpoint", - "ec2:DeleteDhcpOptions", - "ec2:DeleteEgressOnlyInternetGateway", - "ec2:DeleteInternetGateway", - "ec2:DeleteKeyPair", - "ec2:DeleteLaunchTemplate", - "ec2:DeleteLaunchTemplateVersions", - "ec2:DeleteNatGateway", - "ec2:DeleteNetworkInterface", - "ec2:DeleteRoute", - "ec2:DeleteRouteTable", - "ec2:DeleteSecurityGroup", - "ec2:DeleteSubnet", - "ec2:DeleteTags", - "ec2:DeleteVolume", - "ec2:DeleteVpc", - "ec2:DeleteVpnGateway", - "ec2:Describe*", - "ec2:DescribeKeyPairs", - "ec2:DescribeLaunchTemplates", - "ec2:DescribeLaunchTemplateVersions", - "ec2:DetachInternetGateway", - "ec2:DetachNetworkInterface", - "ec2:DetachVolume", - "ec2:Disassociate*", - "ec2:GetLaunchTemplateData", - "ec2:ImportKeyPair", - "ec2:ModifyLaunchTemplate", - "ec2:ModifyNetworkInterfaceAttribute", - "ec2:ModifySubnetAttribute", - "ec2:ModifyVpcAttribute", - "ec2:ModifyVpcEndpoint", - "ec2:ReleaseAddress", - "ec2:RevokeSecurityGroupEgress", - "ec2:RevokeSecurityGroupIngress", - "ec2:RunInstances", - "ec2:UpdateSecurityGroupRuleDescriptionsEgress", - "ec2:UpdateSecurityGroupRuleDescriptionsIngress", - ] - - # TODO: list all resources and remove the tfsec ignore rule - #tfsec:ignore:AWS099 - resources = ["*"] - } -} - -resource "aws_iam_user_policy_attachment" "allow_packer_user" { - user = resource.aws_iam_user.terraform_packer_user.name - policy_arn = aws_iam_policy.packer.arn -} diff --git a/providers.tf b/providers.tf index e66df9b..5162abd 100644 --- a/providers.tf +++ b/providers.tf @@ -1,5 +1,5 @@ provider "aws" { - region = "us-east-1" + region = "us-east-1" # profile = var.aws_profile default_tags {