From 2b73468d6c844c5ff077f54f4affc634ffbdd5e7 Mon Sep 17 00:00:00 2001 From: Julien Dessaux Date: Sat, 12 Apr 2025 07:39:57 +0200 Subject: [PATCH] feat(module): add output variable `arn` and deprecate the output variable `iam_role_arn` --- .forgejo/workflows/main.yaml | 16 ++++++++++++++++ CHANGELOG.md | 13 ++++++++++++- README.md | 2 +- infrastructure/tofu/.gitignore | 1 + infrastructure/tofu/.terraform.lock.hcl | 21 +++++++++++++++++++++ infrastructure/tofu/main.tf | 19 +++++++++++++++++++ infrastructure/tofu/providers.tf | 24 ++++++++++++++++++++++++ main.tftest.hcl | 15 +++++++++++++++ outputs.tf | 7 +++++++ 9 files changed, 116 insertions(+), 2 deletions(-) create mode 100644 .forgejo/workflows/main.yaml create mode 100644 infrastructure/tofu/.gitignore create mode 100644 infrastructure/tofu/.terraform.lock.hcl create mode 100644 infrastructure/tofu/main.tf create mode 100644 infrastructure/tofu/providers.tf create mode 100644 main.tftest.hcl diff --git a/.forgejo/workflows/main.yaml b/.forgejo/workflows/main.yaml new file mode 100644 index 0000000..2e4bd1f --- /dev/null +++ b/.forgejo/workflows/main.yaml @@ -0,0 +1,16 @@ +--- +name: 'main' + +on: + push: + workflow_dispatch: + +jobs: + test: + runs-on: 'self-hosted' + steps: + - uses: 'actions/checkout@v4' + - uses: "https://git.adyxax.org/adyxax/action-tofu-aws-test@1.0.0" + with: + aws-access-key-id: "${{ vars.AWS_ACCESS_KEY_ID }}" + aws-access-key-secret: "${{ secrets.AWS_ACCESS_KEY_SECRET }}" diff --git a/CHANGELOG.md b/CHANGELOG.md index d511684..df04049 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,8 +2,19 @@ All notable changes to this project will be documented in this file. +## 1.1.0 - 2025-04-12 + +### Add + +- Add output variable `arn`. + +### Deprecated + +- Output variable `iam_role_arn` will be removed in a later release. Use `arn` + instead. + ## 1.0.0 - 2025-04-11 ### Added -- initial import +- Initial import. diff --git a/README.md b/README.md index af5a1f6..e7ca711 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@ continuous integration tasks on AWS. ``` hcl module "aws_iam_role" { - source = "git::ssh://git@git.adyxax.org/adyxax/tofu-module-aws-iam-role?depth=1&ref=1.0.0" + source = "git::ssh://git@git.adyxax.org/adyxax/tofu-module-aws-iam-role?depth=1&ref=1.1.0" name = local.name policy_statements = jsonencode([ diff --git a/infrastructure/tofu/.gitignore b/infrastructure/tofu/.gitignore new file mode 100644 index 0000000..a8c8222 --- /dev/null +++ b/infrastructure/tofu/.gitignore @@ -0,0 +1 @@ +!.terraform.lock.hcl diff --git a/infrastructure/tofu/.terraform.lock.hcl b/infrastructure/tofu/.terraform.lock.hcl new file mode 100644 index 0000000..9ee3c83 --- /dev/null +++ b/infrastructure/tofu/.terraform.lock.hcl @@ -0,0 +1,21 @@ +# This file is maintained automatically by "tofu init". +# Manual edits may be lost in future updates. + +provider "registry.opentofu.org/hashicorp/aws" { + version = "5.91.0" + constraints = "5.91.0" + hashes = [ + "h1:g+uDHz6bZ36QaxoKWmJEYGh7OP5RAE5MPbxLohzcU18=", + "h1:qw1Sp5py+7rRwzHgHNJvgYTeTkBnPHY7WercO1BsOh0=", + "zh:057e6cb85e3efe2c30ef5ca47cc47abc8217e2e0dddce2e92a8d2d6f18b6cee6", + "zh:0f15d3f599e07307ac9771c602dcaaf0c46dd259649da985cb3cb80a7a647cea", + "zh:187086070cc878ab0a27163939516983e3efae65ebff78dc3466619cdf978dee", + "zh:67a58fc85c630bcc6c772f573813caabe6c9af291c71c7207590fc4792e4d94e", + "zh:68abb9382928ce29c0f3dd9a75b41ad2a453f3a46330f484d1ea858589146c1b", + "zh:772134ba713e879e5b70d614d08a6650f156e7a3fa724d538bfa85632b1ed639", + "zh:bf67439e47cf6720dcec7a1e2988d6c10c56d7eea69bb1ecff1b22d6bb63a36d", + "zh:bfd0b91dc4ae338eb79ec41bede5eed7a0740380bffbdfbda362f7ed08e0e2ad", + "zh:ca3c3313cd4971850da45ce4337b027a804389db740c310ba637bc0a86775eef", + "zh:d75a8ec54a4783c25cb806b887f0d3c67cded08db8c496fd9cf831791e4c8482", + ] +} diff --git a/infrastructure/tofu/main.tf b/infrastructure/tofu/main.tf new file mode 100644 index 0000000..37037f8 --- /dev/null +++ b/infrastructure/tofu/main.tf @@ -0,0 +1,19 @@ +locals { + name = "tofu-module-aws-iam-role" +} + +module "aws_iam_ci_user" { + providers = { + aws.core = aws.all["core"] + aws.root = aws.all["root"] + aws.tests = aws.all["tests"] + } + source = "git::ssh://git@git.adyxax.org/adyxax/tofu-module-aws-iam-ci-user?depth=1&ref=1.0.0" + + name = local.name + tests_policy_statements = jsonencode([{ + Action = "iam:*" + Effect = "Allow" + Resource = "arn:aws:iam::*:role/tftest", + }]) +} diff --git a/infrastructure/tofu/providers.tf b/infrastructure/tofu/providers.tf new file mode 100644 index 0000000..8b42979 --- /dev/null +++ b/infrastructure/tofu/providers.tf @@ -0,0 +1,24 @@ +terraform { + backend "s3" { + bucket = "adyxax-tofu-states" + dynamodb_table = "tofu-states" + key = "repositories/${local.name}" + profile = "core" + region = "eu-west-3" + } + required_providers { + aws = { + source = "hashicorp/aws" + version = "5.91.0" + } + } +} + +provider "aws" { + for_each = toset(["core", "root", "tests"]) + + alias = "all" + default_tags { tags = { "managed-by" = "tofu" } } + profile = each.key + region = "eu-west-3" +} diff --git a/main.tftest.hcl b/main.tftest.hcl new file mode 100644 index 0000000..c21db0b --- /dev/null +++ b/main.tftest.hcl @@ -0,0 +1,15 @@ +provider "aws" { + profile = "tests" + region = "eu-west-3" +} + +run "main" { + assert { + condition = output.arn != null + error_message = "invalid IAM role ARN" + } +} + +variables { + name = "tftest" +} diff --git a/outputs.tf b/outputs.tf index f3ef649..ebfd120 100644 --- a/outputs.tf +++ b/outputs.tf @@ -1,3 +1,10 @@ +output "arn" { + description = "AWS IAM role ARN." + sensitive = false + value = aws_iam_role.main.id +} + +# Deprecated since 1.1.0 output "iam_role_arn" { description = "AWS IAM role ARN." sensitive = false