Skip to content

Commit 5b1238c

Browse files
rcmonteirorcmonteiro
committed
chore: terraform setup
1 parent fd4970a commit 5b1238c

File tree

8 files changed

+353
-10
lines changed

8 files changed

+353
-10
lines changed

‎.github/workflows/ci.yml

Lines changed: 27 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -45,20 +45,37 @@ jobs:
4545
- name: Run tests
4646
run: pnpm run test
4747

48-
- name: Login on Container Registry
49-
uses: docker/login-action@v3
50-
with:
51-
username: ${{ secrets.DOCKERHUB_USERNAME }}
52-
password: ${{ secrets.DOCKERHUB_TOKEN }}
53-
5448
- name: Create tag
5549
id: create_tag
5650
run: |
5751
SHA=$(echo $GITHUB_SHA | head -c7)
5852
echo "sha=$SHA" >> $GITHUB_OUTPUT
5953
60-
- name: Build docker image
61-
run: docker build -t rcmonteiro/devops-sample-api-ci:${{ steps.create_tag.outputs.sha }} .
54+
- name: Configure AWS credentials
55+
uses: aws-actions/configure-aws-credentials@v4
56+
with:
57+
role-to-assume: arn:aws:iam::381492262362:role/ecr_role
58+
aws-region: us-east-2
59+
60+
- name: Login to AWS ECR
61+
id: login-ecr
62+
uses: aws-actions/amazon-ecr-login@v2
63+
64+
# Exemplo de publicação no Docker Hub
65+
# - name: Login on Container Registry
66+
# uses: docker/login-action@v3
67+
# with:
68+
# username: ${{ secrets.DOCKERHUB_USERNAME }}
69+
# password: ${{ secrets.DOCKERHUB_TOKEN }}
70+
71+
# - name: Build and Push to Docker
72+
# uses: docker/build-push-action@v5
73+
# with:
74+
# push: true
75+
# tags: rcmonteiro/devops-sample-api-ci:${{ steps.create_tag.outputs.sha }},rcmonteiro/devops-sample-api-ci:latest
6276

63-
- name: Push image to container registry
64-
run: docker push rcmonteiro/devops-sample-api-ci:${{ steps.create_tag.outputs.sha }}
77+
# - name: Build docker image
78+
# run: docker build -t rcmonteiro/devops-sample-api-ci:${{ steps.create_tag.outputs.sha }} .
79+
#
80+
# - name: Push image to container registry
81+
# run: docker push rcmonteiro/devops-sample-api-ci:${{ steps.create_tag.outputs.sha }}

‎.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
/node_modules
44
/build
55

6+
**/.terraform/
7+
68
# Logs
79
logs
810
*.log

‎iac/.terraform.lock.hcl

Lines changed: 25 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎iac/ecr.tf

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
resource "aws_ecr_repository" "rcmonteiro_devops_nest_api" {
2+
name = "rcmonteiro_devops_nest_ci"
3+
4+
image_tag_mutability = "MUTABLE"
5+
6+
image_scanning_configuration {
7+
scan_on_push = true
8+
}
9+
10+
tags = {
11+
IaC = "True"
12+
}
13+
}

‎iac/iam.tf

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# Step 1: Create an IAM identity provider for GitHub
2+
resource "aws_iam_openid_connect_provider" "openid_connect_provider" {
3+
url = "https://token.actions.githubusercontent.com"
4+
client_id_list = [
5+
"sts.amazonaws.com",
6+
]
7+
thumbprint_list = [
8+
"959CB2B52B4AD201A593847ABCA32FF48F838C2E",
9+
]
10+
tags = {
11+
IaC = "True"
12+
}
13+
}
14+
15+
# Step 2: Create an IAM role for the ECR repository
16+
resource "aws_iam_role" "ecr_role" {
17+
name = "ecr_role"
18+
19+
assume_role_policy = jsonencode({
20+
"Version": "2012-10-17",
21+
"Statement": [
22+
{
23+
"Effect": "Allow",
24+
"Action": "sts:AssumeRoleWithWebIdentity",
25+
"Principal": {
26+
"Federated": "arn:aws:iam::381492262362:oidc-provider/token.actions.githubusercontent.com"
27+
},
28+
"Condition": {
29+
"StringEquals": {
30+
"token.actions.githubusercontent.com:aud": [
31+
"sts.amazonaws.com"
32+
],
33+
"token.actions.githubusercontent.com:sub": [
34+
"repo:rcmonteiro/devops-create-image-nest-api:ref:refs/heads/main"
35+
]
36+
}
37+
}
38+
}
39+
]
40+
})
41+
42+
# Step 3: Attach the AmazonEC2ContainerRegistryPowerUser managed policy to the IAM role
43+
inline_policy {
44+
name = "ecr-app-permission"
45+
46+
policy = jsonencode({
47+
"Version": "2012-10-17",
48+
"Statement": [
49+
{
50+
"Effect": "Allow",
51+
"Action": [
52+
"ecr:GetDownloadUrlForLayer",
53+
"ecr:BatchGetImage",
54+
"ecr:BatchCheckLayerAvailability",
55+
"ecr:PutImage",
56+
"ecr:InitiateLayerUpload",
57+
"ecr:UploadLayerPart",
58+
"ecr:CompleteLayerUpload",
59+
"ecr:GetAuthorizationToken"
60+
],
61+
"Resource": "*"
62+
}
63+
]
64+
})
65+
}
66+
67+
tags = {
68+
IaC = "True"
69+
}
70+
}
71+
72+
73+

‎iac/main.tf

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
terraform {
2+
required_providers {
3+
aws = {
4+
source = "hashicorp/aws"
5+
version = "5.53.0"
6+
}
7+
}
8+
}
9+
10+
provider "aws" {
11+
profile = "rcmonteiro-iac"
12+
region = "us-east-2"
13+
}

‎iac/terraform.tfstate

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
{
2+
"version": 4,
3+
"terraform_version": "1.8.5",
4+
"serial": 13,
5+
"lineage": "822cea9a-3abf-0b83-a30a-b80aa636cd29",
6+
"outputs": {},
7+
"resources": [
8+
{
9+
"mode": "managed",
10+
"type": "aws_ecr_repository",
11+
"name": "rcmonteiro_devops_nest_api",
12+
"provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
13+
"instances": [
14+
{
15+
"schema_version": 0,
16+
"attributes": {
17+
"arn": "arn:aws:ecr:us-east-2:381492262362:repository/rcmonteiro_devops_nest_ci",
18+
"encryption_configuration": [
19+
{
20+
"encryption_type": "AES256",
21+
"kms_key": ""
22+
}
23+
],
24+
"force_delete": null,
25+
"id": "rcmonteiro_devops_nest_ci",
26+
"image_scanning_configuration": [
27+
{
28+
"scan_on_push": true
29+
}
30+
],
31+
"image_tag_mutability": "MUTABLE",
32+
"name": "rcmonteiro_devops_nest_ci",
33+
"registry_id": "381492262362",
34+
"repository_url": "381492262362.dkr.ecr.us-east-2.amazonaws.com/rcmonteiro_devops_nest_ci",
35+
"tags": {
36+
"IaC": "True"
37+
},
38+
"tags_all": {
39+
"IaC": "True"
40+
},
41+
"timeouts": null
42+
},
43+
"sensitive_attributes": [],
44+
"private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiZGVsZXRlIjoxMjAwMDAwMDAwMDAwfX0="
45+
}
46+
]
47+
},
48+
{
49+
"mode": "managed",
50+
"type": "aws_iam_openid_connect_provider",
51+
"name": "openid_connect_provider",
52+
"provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
53+
"instances": [
54+
{
55+
"schema_version": 0,
56+
"attributes": {
57+
"arn": "arn:aws:iam::381492262362:oidc-provider/token.actions.githubusercontent.com",
58+
"client_id_list": [
59+
"sts.amazonaws.com"
60+
],
61+
"id": "arn:aws:iam::381492262362:oidc-provider/token.actions.githubusercontent.com",
62+
"tags": {
63+
"IaC": "True"
64+
},
65+
"tags_all": {
66+
"IaC": "True"
67+
},
68+
"thumbprint_list": [
69+
"959cb2b52b4ad201a593847abca32ff48f838c2e"
70+
],
71+
"url": "token.actions.githubusercontent.com"
72+
},
73+
"sensitive_attributes": [],
74+
"private": "bnVsbA=="
75+
}
76+
]
77+
},
78+
{
79+
"mode": "managed",
80+
"type": "aws_iam_role",
81+
"name": "ecr_role",
82+
"provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
83+
"instances": [
84+
{
85+
"schema_version": 0,
86+
"attributes": {
87+
"arn": "arn:aws:iam::381492262362:role/ecr_role",
88+
"assume_role_policy": "{\"Statement\":[{\"Action\":\"sts:AssumeRoleWithWebIdentity\",\"Condition\":{\"StringEquals\":{\"token.actions.githubusercontent.com:aud\":[\"sts.amazonaws.com\"],\"token.actions.githubusercontent.com:sub\":[\"repo:rcmonteiro/devops-create-image-nest-api:ref:refs/heads/main\"]}},\"Effect\":\"Allow\",\"Principal\":{\"Federated\":\"arn:aws:iam::381492262362:oidc-provider/token.actions.githubusercontent.com\"}}],\"Version\":\"2012-10-17\"}",
89+
"create_date": "2024-06-13T14:46:28Z",
90+
"description": "",
91+
"force_detach_policies": false,
92+
"id": "ecr_role",
93+
"inline_policy": [
94+
{
95+
"name": "ecr-app-permission",
96+
"policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"ecr:GetDownloadUrlForLayer\",\"ecr:BatchGetImage\",\"ecr:BatchCheckLayerAvailability\",\"ecr:PutImage\",\"ecr:InitiateLayerUpload\",\"ecr:UploadLayerPart\",\"ecr:CompleteLayerUpload\",\"ecr:GetAuthorizationToken\"],\"Effect\":\"Allow\",\"Resource\":\"*\"}]}"
97+
}
98+
],
99+
"managed_policy_arns": [],
100+
"max_session_duration": 3600,
101+
"name": "ecr_role",
102+
"name_prefix": "",
103+
"path": "/",
104+
"permissions_boundary": "",
105+
"tags": {
106+
"IaC": "True"
107+
},
108+
"tags_all": {
109+
"IaC": "True"
110+
},
111+
"unique_id": "AROAVRUVV6XNFQSFABCAM"
112+
},
113+
"sensitive_attributes": [],
114+
"private": "bnVsbA=="
115+
}
116+
]
117+
}
118+
],
119+
"check_results": null
120+
}

‎iac/terraform.tfstate.backup

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
{
2+
"version": 4,
3+
"terraform_version": "1.8.5",
4+
"serial": 10,
5+
"lineage": "822cea9a-3abf-0b83-a30a-b80aa636cd29",
6+
"outputs": {},
7+
"resources": [
8+
{
9+
"mode": "managed",
10+
"type": "aws_iam_openid_connect_provider",
11+
"name": "openid_connect_provider",
12+
"provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
13+
"instances": [
14+
{
15+
"schema_version": 0,
16+
"attributes": {
17+
"arn": "arn:aws:iam::381492262362:oidc-provider/token.actions.githubusercontent.com",
18+
"client_id_list": [
19+
"sts.amazonaws.com"
20+
],
21+
"id": "arn:aws:iam::381492262362:oidc-provider/token.actions.githubusercontent.com",
22+
"tags": {
23+
"IaC": "True"
24+
},
25+
"tags_all": {
26+
"IaC": "True"
27+
},
28+
"thumbprint_list": [
29+
"959cb2b52b4ad201a593847abca32ff48f838c2e"
30+
],
31+
"url": "token.actions.githubusercontent.com"
32+
},
33+
"sensitive_attributes": [],
34+
"private": "bnVsbA=="
35+
}
36+
]
37+
},
38+
{
39+
"mode": "managed",
40+
"type": "aws_iam_role",
41+
"name": "ecr_role",
42+
"provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
43+
"instances": [
44+
{
45+
"schema_version": 0,
46+
"attributes": {
47+
"arn": "arn:aws:iam::381492262362:role/ecr_role",
48+
"assume_role_policy": "{\"Statement\":[{\"Action\":\"sts:AssumeRoleWithWebIdentity\",\"Condition\":{\"StringEquals\":{\"token.actions.githubusercontent.com:aud\":[\"sts.amazonaws.com\"],\"token.actions.githubusercontent.com:sub\":[\"repo:rcmonteiro/devops-create-image-nest-api:ref:refs/heads/main\"]}},\"Effect\":\"Allow\",\"Principal\":{\"Federated\":\"arn:aws:iam::381492262362:oidc-provider/token.actions.githubusercontent.com\"}}],\"Version\":\"2012-10-17\"}",
49+
"create_date": "2024-06-13T14:46:28Z",
50+
"description": "",
51+
"force_detach_policies": false,
52+
"id": "ecr_role",
53+
"inline_policy": [
54+
{
55+
"name": "ecr-app-permission",
56+
"policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"ecr:GetDownloadUrlForLayer\",\"ecr:BatchGetImage\",\"ecr:BatchCheckLayerAvailability\",\"ecr:PutImage\",\"ecr:InitiateLayerUpload\",\"ecr:UploadLayerPart\",\"ecr:CompleteLayerUpload\",\"ecr:GetAuthorizationToken\"],\"Effect\":\"Allow\",\"Resource\":\"*\"}]}"
57+
}
58+
],
59+
"managed_policy_arns": [],
60+
"max_session_duration": 3600,
61+
"name": "ecr_role",
62+
"name_prefix": "",
63+
"path": "/",
64+
"permissions_boundary": "",
65+
"tags": {
66+
"IaC": "True"
67+
},
68+
"tags_all": {
69+
"IaC": "True"
70+
},
71+
"unique_id": "AROAVRUVV6XNFQSFABCAM"
72+
},
73+
"sensitive_attributes": [],
74+
"private": "bnVsbA=="
75+
}
76+
]
77+
}
78+
],
79+
"check_results": null
80+
}

0 commit comments

Comments
 (0)